Skip to content

Commit 9fb5fbd

Browse files
committed
C++: Restructure UnsafeUseOfStrcat for performance
This query gets optimized badly, and it has started timing out when we run it on our own code base. Most of the evaluation time is spent in an RA predicate named `#select#cpe#1#f#antijoin_rhs#1`, which takes 1m36s a Wireshark snapshot. This restructuring of the code makes the problematic RA predicate go away.
1 parent b17aeb6 commit 9fb5fbd

File tree

1 file changed

+14
-5
lines changed

1 file changed

+14
-5
lines changed

cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,20 @@ predicate isEffectivelyConstAccess(VariableAccess a)
2929
)
3030
}
3131

32-
from FunctionCall fc, VariableAccess src
33-
where fc.getTarget().hasName("strcat") and
34-
src = fc.getArgument(1) and
35-
not src.getType() instanceof ArrayType and
32+
class StrcatSource extends VariableAccess {
33+
FunctionCall strcat;
34+
35+
StrcatSource() {
36+
strcat.getTarget().hasName("strcat") and
37+
this = strcat.getArgument(1)
38+
}
39+
40+
FunctionCall getStrcatCall() { result = strcat }
41+
}
42+
43+
from StrcatSource src
44+
where not src.getType() instanceof ArrayType and
3645
not exists(BufferSizeExpr bse |
3746
bse.getArg().(VariableAccess).getTarget() = src.getTarget()) and
3847
not isEffectivelyConstAccess(src)
39-
select fc, "Always check the size of the source buffer when using strcat."
48+
select src.getStrcatCall(), "Always check the size of the source buffer when using strcat."

0 commit comments

Comments
 (0)