@@ -1673,10 +1673,24 @@ private module Stage2 {
16731673 storeStepFwd ( _, ap , tc , _, _, config )
16741674 }
16751675
1676- predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
1676+ private predicate revConsCand ( TypedContent tc , Ap ap , Configuration config ) {
16771677 storeStepCand ( _, ap , tc , _, _, config )
16781678 }
16791679
1680+ private predicate validAp ( Ap ap , Configuration config ) {
1681+ revFlow ( _, _, _, _, ap , config ) and ap instanceof ApNil
1682+ or
1683+ exists ( TypedContent head , Ap tail |
1684+ consCand ( head , tail , config ) and
1685+ ap = apCons ( head , tail )
1686+ )
1687+ }
1688+
1689+ predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
1690+ revConsCand ( tc , ap , config ) and
1691+ validAp ( ap , config )
1692+ }
1693+
16801694 pragma [ noinline]
16811695 private predicate parameterFlow (
16821696 ParamNodeEx p , Ap ap , Ap ap0 , DataFlowCallable c , Configuration config
@@ -2495,10 +2509,24 @@ private module Stage3 {
24952509 storeStepFwd ( _, ap , tc , _, _, config )
24962510 }
24972511
2498- predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
2512+ private predicate revConsCand ( TypedContent tc , Ap ap , Configuration config ) {
24992513 storeStepCand ( _, ap , tc , _, _, config )
25002514 }
25012515
2516+ private predicate validAp ( Ap ap , Configuration config ) {
2517+ revFlow ( _, _, _, _, ap , config ) and ap instanceof ApNil
2518+ or
2519+ exists ( TypedContent head , Ap tail |
2520+ consCand ( head , tail , config ) and
2521+ ap = apCons ( head , tail )
2522+ )
2523+ }
2524+
2525+ predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
2526+ revConsCand ( tc , ap , config ) and
2527+ validAp ( ap , config )
2528+ }
2529+
25022530 pragma [ noinline]
25032531 private predicate parameterFlow (
25042532 ParamNodeEx p , Ap ap , Ap ap0 , DataFlowCallable c , Configuration config
@@ -3322,10 +3350,24 @@ private module Stage4 {
33223350 storeStepFwd ( _, ap , tc , _, _, config )
33233351 }
33243352
3325- predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
3353+ private predicate revConsCand ( TypedContent tc , Ap ap , Configuration config ) {
33263354 storeStepCand ( _, ap , tc , _, _, config )
33273355 }
33283356
3357+ private predicate validAp ( Ap ap , Configuration config ) {
3358+ revFlow ( _, _, _, _, ap , config ) and ap instanceof ApNil
3359+ or
3360+ exists ( TypedContent head , Ap tail |
3361+ consCand ( head , tail , config ) and
3362+ ap = apCons ( head , tail )
3363+ )
3364+ }
3365+
3366+ predicate consCand ( TypedContent tc , Ap ap , Configuration config ) {
3367+ revConsCand ( tc , ap , config ) and
3368+ validAp ( ap , config )
3369+ }
3370+
33293371 pragma [ noinline]
33303372 private predicate parameterFlow (
33313373 ParamNodeEx p , Ap ap , Ap ap0 , DataFlowCallable c , Configuration config
0 commit comments