CPP: Alter the dataflow case.

Author: geoffw0

cpp/ql/src/definitions.ql

@@ -1,13 +1,23 @@
-/**
- * @name Jump-to-definition links
- * @description Generates use-definition pairs that provide the data
- *              for jump-to-definition in the code viewer.
- * @kind definitions
- * @id cpp/jump-to-definition
- */
 
-import definitions
+class MyInt extends int {
+	MyInt() {
+		this in [1 .. 10000]
+	}
+}
 
-from Top e, Top def, string kind
-where def = definitionOf(e, kind)
-select e, def, kind
+predicate rel(MyInt x, MyInt y) {
+	x = 1 or
+	y = 1
+}
+
+from MyInt x
+where
+  // 23s (1 result):
+  //forall(MyInt y | rel(x, y))
+  // 4s (10,000 results):
+  exists(MyInt y | rel(x, y))
+  // 18s (1 result):
+  forall(MyInt y | rel(x, y))
+  and
+  exists(MyInt y | rel(x, y))
+select x

cpp/ql/src/semmle/code/cpp/commons/Buffer.qll

@@ -48,6 +48,7 @@ predicate memberMayBeVarSize(Class c, MemberVariable v) {
 /**
  * Get the size in bytes of the buffer pointed to by an expression (if this can be determined). 
  */
+language[monotonicAggregates]
 int getBufferSize(Expr bufferExpr, Element why) {
   exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
     (
@@ -82,16 +83,19 @@ int getBufferSize(Expr bufferExpr, Element why) {
     why = bufferExpr
   ) or (
     // dataflow (all sources must be the same size)
-    forex(Expr def |
+    result = min(Expr def |
       DataFlow::localFlowStep(DataFlow::exprNode(def), DataFlow::exprNode(bufferExpr)) |
-      result = getBufferSize(def, _)
+      getBufferSize(def, _)
+    ) and result = max(Expr def |
+      DataFlow::localFlowStep(DataFlow::exprNode(def), DataFlow::exprNode(bufferExpr)) |
+      getBufferSize(def, _)
     ) and
 
     // find reason
     exists(Expr def |
       DataFlow::localFlowStep(DataFlow::exprNode(def), DataFlow::exprNode(bufferExpr)) |
       why = def or
-      result = getBufferSize(def, why)
+      exists(getBufferSize(def, why))
     )
   ) or exists(Type bufferType |
     // buffer is the address of a variable