Skip to content

Commit d3066af

Browse files
committed
Create IndirectUninitializedNode and add a bridge from it to LocalVariable
This way the changes do not alter the meaning of `UninitializedNode`. In the meantime, the code still provides a specialized `Node` type `IndirectUninitializedNode` to access the nodes behind levels of indirection.
1 parent 8c03136 commit d3066af

File tree

1 file changed

+47
-0
lines changed

1 file changed

+47
-0
lines changed

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,25 @@ module Public {
617617
*/
618618
LocalVariable asUninitialized() { result = this.(UninitializedNode).getLocalVariable() }
619619

620+
/**
621+
* Gets the uninitialized local variable corresponding to this node behind
622+
* the given levels of indirection, if any.
623+
*/
624+
LocalVariable asIndirectUninitialized(int indirectionIndex) {
625+
exists(IndirectUninitializedNode indirectUninitializedNode |
626+
this = indirectUninitializedNode and
627+
indirectUninitializedNode.getIndirectionIndex() = indirectionIndex
628+
|
629+
result = indirectUninitializedNode.getLocalVariable()
630+
)
631+
}
632+
633+
/**
634+
* Gets the uninitialized local variable corresponding to this node behind
635+
* any levels of indirection, if any.
636+
*/
637+
LocalVariable asIndirectUninitialized() { result = this.asIndirectUninitialized(_) }
638+
620639
/**
621640
* Gets the positional parameter corresponding to the node that represents
622641
* the value of the parameter after `index` number of loads, if any. For
@@ -781,6 +800,34 @@ module Public {
781800
LocalVariable getLocalVariable() { result = v }
782801
}
783802

803+
/**
804+
* The value of an uninitialized local variable behind one or more levels of
805+
* indirection, viewed as a node in a data flow graph.
806+
*
807+
* NOTE: For the direct value of the uninitialized local variable, see
808+
* `UninitializedNode`.
809+
*/
810+
class IndirectUninitializedNode extends Node {
811+
LocalVariable v;
812+
int indirectionIndex;
813+
814+
IndirectUninitializedNode() {
815+
exists(SsaImpl::Definition def, SsaImpl::SourceVariable sv |
816+
def.getIndirectionIndex() = indirectionIndex and
817+
indirectionIndex > 0 and // With `indirectionIndex` = 0, this class becomes the same as `UninitializedNode`.
818+
def.getValue().asInstruction() instanceof UninitializedInstruction and
819+
SsaImpl::defToNode(this, def, sv) and
820+
v = sv.getBaseVariable().(SsaImpl::BaseIRVariable).getIRVariable().getAst()
821+
)
822+
}
823+
824+
/** Gets the uninitialized local variable corresponding to this node. */
825+
LocalVariable getLocalVariable() { result = v }
826+
827+
/** Gets the level of indirection to get to this node. */
828+
int getIndirectionIndex() { result = indirectionIndex }
829+
}
830+
784831
/**
785832
* The value of a parameter at function entry, viewed as a node in a data
786833
* flow graph. This includes both explicit parameters such as `x` in `f(x)`

0 commit comments

Comments
 (0)