C++: Handle ArrayExprs in sizeof VLAs

jketema · jketema · commit fdab63fd5fb9 · 2025-09-02T12:29:04.000+02:00
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
@@ -4099,6 +4099,8 @@ private VlaDeclStmt getVlaDeclStmt(Expr expr, int pointerDerefCount) {
   pointerDerefCount = 0
   or
   result = getVlaDeclStmt(expr.(PointerDereferenceExpr).getOperand(), pointerDerefCount - 1)
+  or
+  result = getVlaDeclStmt(expr.(ArrayExpr).getArrayBase(), pointerDerefCount - 1)
 }
 
 class TranslatedSizeofExpr extends TranslatedNonConstantExpr {

Original file line number	Diff line number	Diff line change
`@@ -4099,6 +4099,8 @@ private VlaDeclStmt getVlaDeclStmt(Expr expr, int pointerDerefCount) {`
`4099`	`4099`	`pointerDerefCount = 0`
`4100`	`4100`	`or`
`4101`	`4101`	`result = getVlaDeclStmt(expr.(PointerDereferenceExpr).getOperand(), pointerDerefCount - 1)`
	`4102`	`+ or`
	`4103`	`+ result = getVlaDeclStmt(expr.(ArrayExpr).getArrayBase(), pointerDerefCount - 1)`
`4102`	`4104`	`}`
`4103`	`4105`
`4104`	`4106`	`class TranslatedSizeofExpr extends TranslatedNonConstantExpr {`