|
12 | 12 | */ |
13 | 13 |
|
14 | 14 | import cpp |
15 | | -import semmle.code.cpp.dataflow.DataFlow |
| 15 | +import semmle.code.cpp.dataflow.new.DataFlow |
16 | 16 |
|
17 | 17 | from Function nuller, Parameter pd, FunctionCall fc, Variable v |
18 | 18 | where |
19 | 19 | mayReturnNull(nuller) and |
20 | 20 | functionDereferences(pd.getFunction(), pd.getIndex()) and |
21 | | - |
22 | 21 | // there is a function call which will deref parameter pd |
23 | 22 | fc.getTarget() = pd.getFunction() and |
24 | 23 | // the parameter pd comes from a variable v |
25 | | - DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), DataFlow::exprNode(fc.getArgument(pd.getIndex()))) and |
| 24 | + DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), |
| 25 | + DataFlow::exprNode(fc.getArgument(pd.getIndex()))) and |
26 | 26 | // this variable v was assigned by a call to the nuller function |
27 | 27 | v.getAnAssignedValue() = nuller.getACallToThisFunction() and |
28 | 28 | // this variable v is not accessed for an operation (check for NULLness) |
29 | | - not exists (VariableAccess vc | vc.getTarget() = v and (vc.getParent() instanceof Operation or vc.getParent() instanceof IfStmt)) |
30 | | - |
31 | | -select fc, "This function call may deref $@ when it can be NULL from $@", v, v.getName(), nuller, nuller.getName() |
| 29 | + not exists(VariableAccess vc | |
| 30 | + vc.getTarget() = v and |
| 31 | + (vc.getParent() instanceof Operation or vc.getParent() instanceof IfStmt) |
| 32 | + ) |
| 33 | +select fc, "This function call may deref $@ when it can be NULL from $@", v, v.getName(), nuller, |
| 34 | + nuller.getName() |
0 commit comments