@@ -748,6 +748,8 @@ private module Stage2 {
748748 ApNil ( ) { this = false }
749749 }
750750
751+ ApNil getApNil ( Node node ) { any ( ) }
752+
751753 bindingset [ tc, tail]
752754 private Ap apCons ( TypedContent tc , Ap tail ) { result = true and exists ( tc ) and exists ( tail ) }
753755
@@ -762,6 +764,8 @@ private module Stage2 {
762764
763765 class Cc = boolean ;
764766
767+ Cc ccAny ( ) { result = false }
768+
765769 /* Begin: Stage 2 logic. */
766770 /**
767771 * Holds if `node` is reachable from a source in the configuration `config`.
@@ -775,9 +779,9 @@ private module Stage2 {
775779 private predicate fwdFlow ( Node node , Cc cc , ApOption argAp , Ap ap , Configuration config ) {
776780 Stage1:: revFlow ( node , config ) and
777781 config .isSource ( node ) and
778- cc = false and
782+ cc = ccAny ( ) and
779783 argAp = apNone ( ) and
780- ap = false
784+ ap = getApNil ( node )
781785 or
782786 Stage1:: revFlow ( node , unbind ( config ) ) and
783787 (
@@ -795,16 +799,16 @@ private module Stage2 {
795799 exists ( Node mid |
796800 fwdFlow ( mid , _, _, ap , config ) and
797801 jumpStep ( mid , node , config ) and
798- cc = false and
802+ cc = ccAny ( ) and
799803 argAp = apNone ( )
800804 )
801805 or
802- exists ( Node mid |
803- fwdFlow ( mid , _, _, ap , config ) and
806+ exists ( Node mid , ApNil nil |
807+ fwdFlow ( mid , _, _, nil , config ) and
804808 additionalJumpStep ( mid , node , config ) and
805- cc = false and
809+ cc = ccAny ( ) and
806810 argAp = apNone ( ) and
807- ap = false
811+ ap = getApNil ( node )
808812 )
809813 or
810814 // store
@@ -827,7 +831,7 @@ private module Stage2 {
827831 // flow out of a callable
828832 exists ( DataFlowCall call |
829833 fwdFlowOut ( call , node , cc , argAp , ap , config ) and
830- cc = false
834+ cc = ccAny ( )
831835 or
832836 exists ( Ap argAp0 |
833837 fwdFlowOutFromArg ( call , node , argAp0 , ap , config ) and
@@ -1001,30 +1005,30 @@ private module Stage2 {
10011005 else returnAp = apNone ( )
10021006 }
10031007
1004- /**
1005- * Holds if `c` is the target of a read in the flow covered by `revFlow`.
1006- */
1007- pragma [ nomagic]
1008- private predicate revFlowConsCand ( Ap cons , Content c , Ap tail , Configuration config ) {
1009- exists ( Node mid |
1010- revFlow ( mid , _, _, tail , config ) and
1011- readStepFwd ( _, cons , c , mid , tail , config )
1012- )
1013- }
1014-
10151008 pragma [ nomagic]
10161009 private predicate revFlowStore (
10171010 Ap ap0 , Content c , Node node , boolean toReturn , ApOption returnAp , Ap ap , Configuration config
10181011 ) {
10191012 exists ( Node mid , TypedContent tc |
1013+ revFlow ( mid , toReturn , returnAp , ap0 , config ) and
10201014 storeCand1 ( node , tc , mid , config ) and
10211015 tc .getContent ( ) = c and
1022- revFlow ( mid , toReturn , returnAp , ap0 , config ) and
10231016 ap0 = true and
10241017 fwdFlow ( node , _, _, ap , unbind ( config ) )
10251018 )
10261019 }
10271020
1021+ /**
1022+ * Holds if `c` is the target of a read in the flow covered by `revFlow`.
1023+ */
1024+ pragma [ nomagic]
1025+ private predicate revFlowConsCand ( Ap cons , Content c , Ap tail , Configuration config ) {
1026+ exists ( Node mid |
1027+ revFlow ( mid , _, _, tail , config ) and
1028+ readStepFwd ( _, cons , c , mid , tail , config )
1029+ )
1030+ }
1031+
10281032 /**
10291033 * Holds if `c` is the target of a store in the flow covered by `revFlow`.
10301034 */
@@ -1261,6 +1265,8 @@ private module Stage3 {
12611265
12621266 class ApNil = AccessPathFrontNil ;
12631267
1268+ ApNil getApNil ( Node node ) { result = TFrontNil ( getNodeType ( node ) ) }
1269+
12641270 bindingset [ tc, tail]
12651271 private Ap apCons ( TypedContent tc , Ap tail ) { result .getHead ( ) = tc and exists ( tail ) }
12661272
@@ -1275,6 +1281,8 @@ private module Stage3 {
12751281
12761282 class Cc = boolean ;
12771283
1284+ Cc ccAny ( ) { result = false }
1285+
12781286 /* Begin: Stage 3 logic. */
12791287 /**
12801288 * Holds if `node` is reachable with access path front `ap` from a
@@ -1295,9 +1303,9 @@ private module Stage3 {
12951303 private predicate fwdFlow0 ( Node node , Cc cc , ApOption argAp , Ap ap , Configuration config ) {
12961304 Stage2:: revFlow ( node , _, _, false , config ) and
12971305 config .isSource ( node ) and
1298- cc = false and
1306+ cc = ccAny ( ) and
12991307 argAp = apNone ( ) and
1300- ap = TFrontNil ( getNodeType ( node ) )
1308+ ap = getApNil ( node )
13011309 or
13021310 exists ( Node mid |
13031311 fwdFlow ( mid , cc , argAp , ap , config ) and
@@ -1313,17 +1321,17 @@ private module Stage3 {
13131321 fwdFlow ( mid , _, _, ap , config ) and
13141322 Stage2:: revFlow ( node , unbind ( config ) ) and
13151323 jumpStep ( mid , node , config ) and
1316- cc = false and
1324+ cc = ccAny ( ) and
13171325 argAp = apNone ( )
13181326 )
13191327 or
13201328 exists ( Node mid , ApNil nil |
13211329 fwdFlow ( mid , _, _, nil , config ) and
13221330 Stage2:: revFlow ( node , unbind ( config ) ) and
13231331 additionalJumpStep ( mid , node , config ) and
1324- cc = false and
1332+ cc = ccAny ( ) and
13251333 argAp = apNone ( ) and
1326- ap = TFrontNil ( getNodeType ( node ) )
1334+ ap = getApNil ( node )
13271335 )
13281336 or
13291337 // store
@@ -1349,7 +1357,7 @@ private module Stage3 {
13491357 // flow out of a callable
13501358 exists ( DataFlowCall call |
13511359 fwdFlowOut ( call , node , cc , argAp , ap , config ) and
1352- cc = false
1360+ cc = ccAny ( )
13531361 or
13541362 exists ( Ap argAp0 |
13551363 fwdFlowOutFromArg ( call , node , argAp0 , ap , config ) and
@@ -1492,7 +1500,7 @@ private module Stage3 {
14921500 or
14931501 // store
14941502 exists ( Ap ap0 , Content c |
1495- revFlowStore ( ap0 , c , node , ap , toReturn , returnAp , config ) and
1503+ revFlowStore ( ap0 , c , node , toReturn , returnAp , ap , config ) and
14961504 revFlowConsCand ( ap0 , c , ap , config )
14971505 )
14981506 or
@@ -1528,12 +1536,12 @@ private module Stage3 {
15281536
15291537 pragma [ nomagic]
15301538 private predicate revFlowStore (
1531- Ap ap0 , Content c , Node node , Ap ap , boolean toReturn , ApOption returnAp , Configuration config
1539+ Ap ap0 , Content c , Node node , boolean toReturn , ApOption returnAp , Ap ap , Configuration config
15321540 ) {
15331541 exists ( Node mid , TypedContent tc |
1542+ revFlow ( mid , toReturn , returnAp , ap0 , unbind ( config ) ) and
15341543 fwdFlow ( node , _, _, ap , config ) and
15351544 storeCand2 ( node , tc , mid , _, unbind ( config ) ) and
1536- revFlow ( mid , toReturn , returnAp , ap0 , unbind ( config ) ) and
15371545 ap0 = TFrontHead ( tc ) and
15381546 tc .getContent ( ) = c
15391547 )
@@ -1819,6 +1827,8 @@ private module Stage4 {
18191827
18201828 class ApNil = AccessPathApproxNil ;
18211829
1830+ ApNil getApNil ( Node node ) { result = TNil ( getNodeType ( node ) ) }
1831+
18221832 bindingset [ tc, tail]
18231833 private Ap apCons ( TypedContent tc , Ap tail ) { result = push ( tc , tail ) }
18241834
@@ -1833,6 +1843,8 @@ private module Stage4 {
18331843
18341844 class Cc = CallContext ;
18351845
1846+ Cc ccAny ( ) { result instanceof CallContextAny }
1847+
18361848 /* Begin: Stage 4 logic. */
18371849 /**
18381850 * Holds if `node` is reachable with approximate access path `ap` from a source
@@ -1850,9 +1862,9 @@ private module Stage4 {
18501862 private predicate fwdFlow0 ( Node node , Cc cc , ApOption argAp , Ap ap , Configuration config ) {
18511863 Stage3:: revFlow ( node , _, _, _, config ) and
18521864 config .isSource ( node ) and
1853- cc instanceof CallContextAny and
1865+ cc = ccAny ( ) and
18541866 argAp = apNone ( ) and
1855- ap = TNil ( getNodeType ( node ) )
1867+ ap = getApNil ( node )
18561868 or
18571869 Stage3:: revFlow ( node , _, _, _, unbind ( config ) ) and
18581870 (
@@ -1870,16 +1882,16 @@ private module Stage4 {
18701882 exists ( Node mid |
18711883 fwdFlow ( mid , _, _, ap , config ) and
18721884 jumpStep ( mid , node , config ) and
1873- cc instanceof CallContextAny and
1885+ cc = ccAny ( ) and
18741886 argAp = apNone ( )
18751887 )
18761888 or
18771889 exists ( Node mid , ApNil nil |
18781890 fwdFlow ( mid , _, _, nil , config ) and
18791891 additionalJumpStep ( mid , node , config ) and
1880- cc instanceof CallContextAny and
1892+ cc = ccAny ( ) and
18811893 argAp = apNone ( ) and
1882- ap = TNil ( getNodeType ( node ) )
1894+ ap = getApNil ( node )
18831895 )
18841896 )
18851897 or
@@ -2135,8 +2147,8 @@ private module Stage4 {
21352147 Ap ap0 , Content c , Node node , boolean toReturn , ApOption returnAp , Ap ap , Configuration config
21362148 ) {
21372149 exists ( Node mid , TypedContent tc |
2138- storeFlowFwd ( node , tc , mid , ap , ap0 , config ) and
21392150 revFlow ( mid , toReturn , returnAp , ap0 , config ) and
2151+ storeFlowFwd ( node , tc , mid , ap , ap0 , config ) and
21402152 tc .getContent ( ) = c
21412153 )
21422154 }
0 commit comments