@@ -14,9 +14,9 @@ predicate allocated(FunctionCall fc) { allocExpr(fc, _) }
1414
1515/** An expression for which there exists a function call that might free it. */
1616class FreedExpr extends PointsToExpr {
17- FreedExpr ( ) { freeExprOrIndirect ( this , _ , _) }
17+ FreedExpr ( ) { freeExprOrIndirect ( _ , this , _) }
1818
19- override predicate interesting ( ) { freeExprOrIndirect ( this , _ , _) }
19+ override predicate interesting ( ) { freeExprOrIndirect ( _ , this , _) }
2020}
2121
2222/**
@@ -59,19 +59,6 @@ predicate allocCallOrIndirect(Expr e) {
5959 )
6060}
6161
62- predicate freeCallOrIndirect ( FunctionCall fc , Variable v ) {
63- // direct free call
64- v .getAnAccess ( ) = fc .( DeallocationExpr ) .getFreedExpr ( )
65- or
66- // indirect free call
67- exists ( FunctionCall midcall , Function mid , int arg |
68- fc .getArgument ( arg ) = v .getAnAccess ( ) and
69- mayCallFunction ( fc , mid ) and
70- midcall .getEnclosingFunction ( ) = mid and
71- freeCallOrIndirect ( midcall , mid .getParameter ( arg ) )
72- )
73- }
74-
7562predicate allocDefinition ( StackVariable v , ControlFlowNode def ) {
7663 exists ( Expr expr | exprDefinition ( v , def , expr ) and allocCallOrIndirect ( expr ) )
7764}
@@ -86,7 +73,7 @@ class MallocVariableReachability extends StackVariableReachabilityWithReassignme
8673 override predicate isSinkActual ( ControlFlowNode node , StackVariable v ) {
8774 // node may be used in allocReaches
8875 exists ( node .( AnalysedExpr ) .getNullSuccessor ( v ) ) or
89- freeCallOrIndirect ( node , v ) or
76+ freeExprOrIndirect ( node , v . getAnAccess ( ) , _ ) or
9077 assignedToFieldOrGlobal ( v , node ) or
9178 // node may be used directly in query
9279 v .getFunction ( ) = node .( ReturnStmt ) .getEnclosingFunction ( )
@@ -133,7 +120,7 @@ class MallocReachability extends StackVariableReachabilityExt {
133120 // assigned to a global at node, or NULL checked on the edge node -> next.
134121 exists ( StackVariable v0 | mallocVariableReaches ( v0 , source , node ) |
135122 node .( AnalysedExpr ) .getNullSuccessor ( v0 ) = next or
136- freeCallOrIndirect ( node , v0 ) or
123+ freeExprOrIndirect ( node , v0 . getAnAccess ( ) , _ ) or
137124 assignedToFieldOrGlobal ( v0 , node )
138125 )
139126 }
0 commit comments