Skip to content

Commit 437c679

Browse files
committed
C++: Switch to using the Buffer.qll implementation directly.
1 parent e8718f9 commit 437c679

File tree

1 file changed

+2
-10
lines changed

1 file changed

+2
-10
lines changed

cpp/ql/src/Critical/SizeCheck2.ql

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
import cpp
1717
import semmle.code.cpp.models.Models
18+
import semmle.code.cpp.commons.Buffer
1819

1920
predicate baseType(AllocationExpr alloc, Type base) {
2021
exists(PointerType pointer |
@@ -35,15 +36,6 @@ predicate decideOnSize(Type t, int size) {
3536
size = min(t.getSize())
3637
}
3738

38-
predicate mayHaveVarSize(Type t) {
39-
// a member (normally at the end of the type) that looks like it may be intended have variable size.
40-
exists(MemberVariable mv, ArrayType at |
41-
mv.getDeclaringType() = t and
42-
mv.getUnspecifiedType() = at and
43-
not at.getArraySize() > 1
44-
)
45-
}
46-
4739
from AllocationExpr alloc, Type base, int basesize, int allocated
4840
where
4941
baseType(alloc, base) and
@@ -56,7 +48,7 @@ where
5648
(allocated / size) * size = allocated
5749
) and
5850
not basesize > allocated and // covered by SizeCheck.ql
59-
not mayHaveVarSize(base.getUnspecifiedType()) // exclude variable size types
51+
not memberMayBeVarSize(base.getUnspecifiedType(), _) // exclude variable size types
6052
select alloc,
6153
"Allocated memory (" + allocated.toString() + " bytes) is not a multiple of the size of '" +
6254
base.getName() + "' (" + basesize.toString() + " bytes)."

0 commit comments

Comments
 (0)