C++: Fix pointer flow modeling for smart pointer setters

Dave Bartolomeo · Dave Bartolomeo · commit f0a994a570dd · 2021-05-07T16:33:15.000-04:00
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll
@@ -158,11 +158,11 @@ private class SmartPtrSetterFunction extends MemberFunction, AliasFunction, Side
           // parameter.
           result.isParameter(1)
         else result.isParameterDeref(0)
+        or
+        // One of the functions that takes ownership of a raw pointer.
+        param0.getUnspecifiedType() instanceof PointerType and
+        result.isParameter(0)
       )
-      or
-      // One of the functions that takes ownership of a raw pointer.
-      param0.getUnspecifiedType() instanceof PointerType and
-      result.isParameter(0)
     )
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -158,11 +158,11 @@ private class SmartPtrSetterFunction extends MemberFunction, AliasFunction, Side`
`158`	`158`	`// parameter.`
`159`	`159`	`result.isParameter(1)`
`160`	`160`	`else result.isParameterDeref(0)`
	`161`	`+ or`
	`162`	`+ // One of the functions that takes ownership of a raw pointer.`
	`163`	`+ param0.getUnspecifiedType() instanceof PointerType and`
	`164`	`+ result.isParameter(0)`
`161`	`165`	`)`
`162`		`- or`
`163`		`- // One of the functions that takes ownership of a raw pointer.`
`164`		`- param0.getUnspecifiedType() instanceof PointerType and`
`165`		`- result.isParameter(0)`
`166`	`166`	`)`
`167`	`167`	`}`
`168`	`168`	`}`