Merge pull request #20727 from hvitved/rust/variable-overlap-fix

Rust: Fix variable access overlap

Author: hvitved

rust/ql/lib/codeql/rust/elements/internal/VariableImpl.qll

@@ -460,7 +460,12 @@ module Impl {
     VariableAccessCand cand, VariableScope scope, string name, int nestLevel, int ord
   ) {
     name = cand.getName() and
-    scope = [cand.(VariableScope), getEnclosingScope(cand)] and
+    (
+      scope = cand
+      or
+      not cand instanceof VariableScope and
+      scope = getEnclosingScope(cand)
+    ) and
     ord = getPreOrderNumbering(scope, cand) and
     nestLevel = 0
     or

rust/ql/lib/codeql/rust/internal/AstConsistency.qll

@@ -73,6 +73,14 @@ query predicate multiplePositions(Element parent, int pos1, int pos2, string acc
   pos1 != pos2
 }
 
+/**
+ * Holds if `va` is a variable access that refers to multiple variables.
+ */
+query predicate multipleVariableTargets(VariableAccess va, Variable v1) {
+  va = v1.getAnAccess() and
+  strictcount(va.getVariable()) > 1
+}
+
 /**
  * Gets counts of abstract syntax tree inconsistencies of each type.
  */
@@ -98,4 +106,7 @@ int getAstInconsistencyCounts(string type) {
   or
   type = "Multiple positions" and
   result = count(Element e | multiplePositions(_, _, _, _, e) | e)
+  or
+  type = "Multiple variable targets" and
+  result = count(VariableAccess va | multipleVariableTargets(va, _) | va)
 }

rust/ql/test/library-tests/variables/Cfg.expected

@@ -360,6 +360,15 @@ fn match_pattern14() {
     }
 }
 
+fn match_pattern15() {
+    let x = Some(0); // x1
+    match x { // $ read_access=x1
+            Some(x) // x2
+                => x, // $ read_access=x2
+            _ => 0
+        };
+}
+
 fn param_pattern1(
     a8: &str, // a8
     (
@@ -757,6 +766,7 @@ fn main() {
     match_pattern12();
     match_pattern13();
     match_pattern14();
+    match_pattern15();
     param_pattern1("a", ("b", "c"));
     param_pattern2(Either::Left(45));
     destruct_assignment();