C++: replace getType().getUnspecifiedType()

Author: Robert Marsh

cpp/ql/src/Likely Bugs/AmbiguouslySignedBitField.ql

@@ -17,10 +17,10 @@
 import cpp
 
 from BitField bf
-where not bf.getType().getUnspecifiedType().(IntegralType).isExplicitlySigned()
-  and not bf.getType().getUnspecifiedType().(IntegralType).isExplicitlyUnsigned()
-  and not bf.getType().getUnspecifiedType() instanceof Enum
-  and not bf.getType().getUnspecifiedType() instanceof BoolType
+where not bf.getUnspecifiedType().(IntegralType).isExplicitlySigned()
+  and not bf.getUnspecifiedType().(IntegralType).isExplicitlyUnsigned()
+  and not bf.getUnspecifiedType() instanceof Enum
+  and not bf.getUnspecifiedType() instanceof BoolType
   // At least for C programs on Windows, BOOL is a common typedef for a type
   // representing BoolType.
   and not bf.getType().hasName("BOOL")

cpp/ql/src/Likely Bugs/Arithmetic/BadCheckOdd.ql

@@ -15,7 +15,7 @@ import cpp
 from EqualityOperation t, RemExpr lhs, Literal rhs
 where t.getLeftOperand() = lhs and
       t.getRightOperand() = rhs and
-      lhs.getLeftOperand().getType().getUnspecifiedType().(IntegralType).isSigned() and
+      lhs.getLeftOperand().getUnspecifiedType().(IntegralType).isSigned() and
       lhs.getRightOperand().getValue() = "2" and
       rhs.getValue() = "1"
 select t, "Possibly invalid test for oddness. This will fail for negative numbers."

cpp/ql/src/Likely Bugs/Arithmetic/PointlessSelfComparison.qll

@@ -45,7 +45,7 @@ predicate pointlessSelfComparison(ComparisonOperation cmp) {
 predicate nanTest(EqualityOperation cmp) {
   pointlessSelfComparison(cmp) and
   exists (Type t
-  | t = cmp.getLeftOperand().getType().getUnspecifiedType()
+  | t = cmp.getLeftOperand().getUnspecifiedType()
   | t instanceof FloatingPointType or
     t instanceof TemplateParameter)
 }

cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql

@@ -55,5 +55,5 @@ predicate introducesNewField(Class derived, Class base) {
 
 from DataFlow::PathNode source, DataFlow::PathNode sink, CastToPointerArithFlow cfg
 where cfg.hasFlowPath(source, sink)
-  and source.getNode().asExpr().getFullyConverted().getType().getUnspecifiedType() = sink.getNode().asExpr().getFullyConverted().getType().getUnspecifiedType()
+  and source.getNode().asExpr().getFullyConverted().getUnspecifiedType() = sink.getNode().asExpr().getFullyConverted().getUnspecifiedType()
 select sink, source, sink, "Pointer arithmetic here may be done with the wrong type because of the cast $@.", source, "here"

cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

@@ -48,7 +48,7 @@ predicate gettextFunction(Function f, int arg) {
 
 predicate stringArray(Variable arr, AggregateLiteral init) {
   arr.getInitializer().getExpr() = init and
-  stringType(arr.getType().getUnspecifiedType().(ArrayType).getBaseType(), _)
+  stringType(arr.getUnspecifiedType().(ArrayType).getBaseType(), _)
   // Ideally, this predicate should also check that no item of `arr` is ever
   // reassigned, but such an analysis could get fairly complicated. Instead, we
   // just hope that nobody would initialize an array of constants and then

cpp/ql/src/Likely Bugs/Memory Management/AllocaInLoop.ql

@@ -75,7 +75,7 @@ class LoopWithAlloca extends Stmt {
       conditionRequires(eq, truth) and
       eq.getAnOperand().getValue().toInt() = 1 and
       e = eq.getAnOperand() and
-      e.getType().getUnspecifiedType() instanceof BoolType and
+      e.getUnspecifiedType() instanceof BoolType and
       not exists(e.getValue())
     )
     or
@@ -84,7 +84,7 @@ class LoopWithAlloca extends Stmt {
       conditionRequires(eq, truth.booleanNot()) and
       eq.getAnOperand().getValue().toInt() = 1 and
       e = eq.getAnOperand() and
-      e.getType().getUnspecifiedType() instanceof BoolType and
+      e.getUnspecifiedType() instanceof BoolType and
       not exists(e.getValue())
     )
     or

cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql

@@ -45,7 +45,7 @@ predicate hasNontrivialConversion(Expr e) {
 from LocalScopeVariable var, VariableAccess va, ReturnStmt r
 where
   not var.isStatic() and
-  not var.getType().getUnspecifiedType() instanceof ReferenceType and
+  not var.getUnspecifiedType() instanceof ReferenceType and
   not r.isFromUninstantiatedTemplate(_) and
   va = var.getAnAccess() and
   (

cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.ql

@@ -84,12 +84,12 @@ string nthString (int num) {
  * with a fixed size array.
  */
 int arrayExprFixedSize(Expr e) {
-  result = e.getType().getUnspecifiedType().(ArrayType).getSize()
+  result = e.getUnspecifiedType().(ArrayType).getSize()
   or
   result = e.(NewArrayExpr).getAllocatedType().(ArrayType).getSize()
   or
   exists (SsaDefinition def, LocalVariable v
-  | not (e.getType().getUnspecifiedType() instanceof ArrayType) and
+  | not (e.getUnspecifiedType() instanceof ArrayType) and
     e = def.getAUse(v) and
     result = arrayExprFixedSize(def.getDefiningValue(v)))
 }
@@ -103,7 +103,7 @@ where
   copySource = fc.getArgument(argSrc) and
   // Some of the functions operate on a larger char type, like `wchar_t`, so we
   // need to take this into account in the fixed size case.
-  charSize = f.getParameter(argDest).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() and
+  charSize = f.getParameter(argDest).getUnspecifiedType().(PointerType).getBaseType().getSize() and
   if exists(fc.getArgument(argLimit).getValue().toInt()) then (
     // Fixed sized case
     exists(int size |

cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.ql

@@ -17,11 +17,11 @@ import cpp
 class CandidateParameter extends Parameter {
   CandidateParameter() {
       // an array parameter
-      getType().getUnspecifiedType() instanceof ArrayType
+      getUnspecifiedType() instanceof ArrayType
       or
       (
         // a pointer parameter
-        getType().getUnspecifiedType() instanceof PointerType and
+        getUnspecifiedType() instanceof PointerType and
 
         // whose address is never taken (rules out common
         // false positive patterns)

cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.ql

@@ -34,7 +34,7 @@ predicate bindThrownType(ThrowExpr te, Type thrown)
 
   // For rethrows, we use the unqualified version of the type caught by the enclosing catch block.
   // Note that this is not precise, but is a reasonable first approximation.
-  or exists(CatchBlock cb | bindEnclosingCatch(te, cb) and bindStrippedReferenceType(cb.getParameter().getType().getUnspecifiedType(), thrown))
+  or exists(CatchBlock cb | bindEnclosingCatch(te, cb) and bindStrippedReferenceType(cb.getParameter().getUnspecifiedType(), thrown))
 }
 
 // This predicate determines the catch blocks that can catch the exceptions thrown by each throw expression.
@@ -43,7 +43,7 @@ predicate canCatch(ThrowExpr te, CatchBlock cb)
 {
   exists(Type thrown, Type caught |
     bindThrownType(te, thrown)
-    and caught = cb.getParameter().getType().getUnspecifiedType()
+    and caught = cb.getParameter().getUnspecifiedType()
     and not bindEnclosingCatch(te, cb)
 
     and