@@ -73,40 +73,33 @@ private int isSource(Expr bufferExpr, Element why) {
7373 )
7474}
7575
76- /**
77- * Holds if data flow steps from `e1` to `e2` without stepping through any
78- * other intermediate expressions.
79- */
80- private predicate localFlowStepToExpr ( Expr e1 , Expr e2 ) {
81- getBufferSizeCand0 ( e1 ) and
82- DataFlow:: localExprFlowStep ( e1 , e2 )
83- }
84-
8576/**
8677 * Holds if `e2` is an expression that is derived from `e1` such that if `e1[n]` is a
8778 * well-defined expression for some number `n`, then `e2[n + delta]` is also a well-defined
8879 * expression.
8980 */
9081private predicate step ( Expr e1 , Expr e2 , int delta ) {
9182 getBufferSizeCand0 ( e1 ) and
92- exists ( Variable bufferVar , Class parentClass , VariableAccess parentPtr , int bufferSize |
93- e1 = parentPtr
94- |
95- bufferVar = e2 .( VariableAccess ) .getTarget ( ) and
96- // buffer is the parentPtr->bufferVar of a 'variable size struct'
97- memberMayBeVarSize ( parentClass , bufferVar ) and
98- parentPtr = e2 .( VariableAccess ) .getQualifier ( ) and
99- parentPtr .getTarget ( ) .getUnspecifiedType ( ) .( PointerType ) .getBaseType ( ) = parentClass and
100- (
101- if exists ( bufferVar .getType ( ) .getSize ( ) )
102- then bufferSize = bufferVar .getType ( ) .getSize ( )
103- else bufferSize = 0
104- ) and
105- delta = bufferSize - parentClass .getSize ( )
83+ (
84+ exists ( Variable bufferVar , Class parentClass , VariableAccess parentPtr , int bufferSize |
85+ e1 = parentPtr
86+ |
87+ bufferVar = e2 .( VariableAccess ) .getTarget ( ) and
88+ // buffer is the parentPtr->bufferVar of a 'variable size struct'
89+ memberMayBeVarSize ( parentClass , bufferVar ) and
90+ parentPtr = e2 .( VariableAccess ) .getQualifier ( ) and
91+ parentPtr .getTarget ( ) .getUnspecifiedType ( ) .( PointerType ) .getBaseType ( ) = parentClass and
92+ (
93+ if exists ( bufferVar .getType ( ) .getSize ( ) )
94+ then bufferSize = bufferVar .getType ( ) .getSize ( )
95+ else bufferSize = 0
96+ ) and
97+ delta = bufferSize - parentClass .getSize ( )
98+ )
99+ or
100+ DataFlow:: localExprFlowStep ( e1 , e2 ) and
101+ delta = 0
106102 )
107- or
108- localFlowStepToExpr ( e1 , e2 ) and
109- delta = 0
110103}
111104
112105pragma [ nomagic]
0 commit comments