C++: Fix join orders.

MathiasVP · MathiasVP · commit 526b913f7d09 · 2022-12-15T11:55:25.000Z
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -1209,15 +1209,16 @@ private module Cached {
     // the operand also flows to the indirction of the instruction.
     exists(Operand operand, Instruction instr, int indirectionIndex |
       simpleInstructionLocalFlowStep(operand, instr) and
-      hasOperandAndIndex(nodeFrom, operand, indirectionIndex) and
-      hasInstructionAndIndex(nodeTo, instr, indirectionIndex)
+      hasOperandAndIndex(nodeFrom, operand, pragma[only_bind_into](indirectionIndex)) and
+      hasInstructionAndIndex(nodeTo, instr, pragma[only_bind_into](indirectionIndex))
     )
     or
     // If there's indirect flow to an operand, then there's also indirect
     // flow to the operand after applying some pointer arithmetic.
     exists(PointerArithmeticInstruction pointerArith, int indirectionIndex |
-      hasOperandAndIndex(nodeFrom, pointerArith.getAnOperand(), indirectionIndex) and
-      hasInstructionAndIndex(nodeTo, pointerArith, indirectionIndex)
+      hasOperandAndIndex(nodeFrom, pointerArith.getAnOperand(),
+        pragma[only_bind_into](indirectionIndex)) and
+      hasInstructionAndIndex(nodeTo, pointerArith, pragma[only_bind_into](indirectionIndex))
     )
   }
 
@@ -1229,8 +1230,8 @@ private module Cached {
     exists(Operand operand, Instruction instr, int indirectionIndex |
       simpleOperandLocalFlowStep(pragma[only_bind_into](instr), pragma[only_bind_into](operand))
     |
-      hasOperandAndIndex(nodeTo, operand, indirectionIndex) and
-      hasInstructionAndIndex(nodeFrom, instr, indirectionIndex)
+      hasOperandAndIndex(nodeTo, operand, pragma[only_bind_into](indirectionIndex)) and
+      hasInstructionAndIndex(nodeFrom, instr, pragma[only_bind_into](indirectionIndex))
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -1209,15 +1209,16 @@ private module Cached {`
`1209`	`1209`	`// the operand also flows to the indirction of the instruction.`
`1210`	`1210`	`exists(Operand operand, Instruction instr, int indirectionIndex \|`
`1211`	`1211`	`simpleInstructionLocalFlowStep(operand, instr) and`
`1212`		`- hasOperandAndIndex(nodeFrom, operand, indirectionIndex) and`
`1213`		`- hasInstructionAndIndex(nodeTo, instr, indirectionIndex)`
	`1212`	`+ hasOperandAndIndex(nodeFrom, operand, pragma[only_bind_into](indirectionIndex)) and`
	`1213`	`+ hasInstructionAndIndex(nodeTo, instr, pragma[only_bind_into](indirectionIndex))`
`1214`	`1214`	`)`
`1215`	`1215`	`or`
`1216`	`1216`	`// If there's indirect flow to an operand, then there's also indirect`
`1217`	`1217`	`// flow to the operand after applying some pointer arithmetic.`
`1218`	`1218`	`exists(PointerArithmeticInstruction pointerArith, int indirectionIndex \|`
`1219`		`- hasOperandAndIndex(nodeFrom, pointerArith.getAnOperand(), indirectionIndex) and`
`1220`		`- hasInstructionAndIndex(nodeTo, pointerArith, indirectionIndex)`
	`1219`	`+ hasOperandAndIndex(nodeFrom, pointerArith.getAnOperand(),`
	`1220`	`+ pragma[only_bind_into](indirectionIndex)) and`
	`1221`	`+ hasInstructionAndIndex(nodeTo, pointerArith, pragma[only_bind_into](indirectionIndex))`
`1221`	`1222`	`)`
`1222`	`1223`	`}`
`1223`	`1224`
`@@ -1229,8 +1230,8 @@ private module Cached {`
`1229`	`1230`	`exists(Operand operand, Instruction instr, int indirectionIndex \|`
`1230`	`1231`	`simpleOperandLocalFlowStep(pragma[only_bind_into](instr), pragma[only_bind_into](operand))`
`1231`	`1232`	`\|`
`1232`		`- hasOperandAndIndex(nodeTo, operand, indirectionIndex) and`
`1233`		`- hasInstructionAndIndex(nodeFrom, instr, indirectionIndex)`
	`1233`	`+ hasOperandAndIndex(nodeTo, operand, pragma[only_bind_into](indirectionIndex)) and`
	`1234`	`+ hasInstructionAndIndex(nodeFrom, instr, pragma[only_bind_into](indirectionIndex))`
`1234`	`1235`	`)`
`1235`	`1236`	`}`
`1236`	`1237`