Skip to content

Commit 6a0bd77

Browse files
Fix Fizz query after a backwards-incompatible change happened in the IR dataflow library.
1 parent c3f0bea commit 6a0bd77

1 file changed

Lines changed: 12 additions & 4 deletions

File tree

ql_demos/cpp/Facebook_Fizz_CVE-2019-3560/FizzOverflow.ql

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,21 @@ class Cfg extends TaintTracking::Configuration {
2727

2828
/** Holds if `source` is a call to `Endian::big()`. */
2929
override predicate isSource(DataFlow::Node source) {
30-
source.(CallInstruction).getCallTarget().(FunctionInstruction).getFunctionSymbol() instanceof
31-
EndianConvert
30+
source
31+
.asInstruction()
32+
.(CallInstruction)
33+
.getCallTarget()
34+
.(FunctionInstruction)
35+
.getFunctionSymbol() instanceof EndianConvert
3236
}
3337

3438
/** Hold if `sink` is a narrowing conversion. */
3539
override predicate isSink(DataFlow::Node sink) {
36-
sink.getResultSize() < sink.(ConvertInstruction).getUnary().getResultSize()
40+
sink.asInstruction().getResultSize() < sink
41+
.asInstruction()
42+
.(ConvertInstruction)
43+
.getUnary()
44+
.getResultSize()
3745
}
3846
}
3947

@@ -42,7 +50,7 @@ from
4250
Type inputType, Type outputType
4351
where
4452
cfg.hasFlowPath(source, sink) and
45-
conv = sink.getNode() and
53+
conv = sink.getNode().asInstruction() and
4654
inputType = conv.getUnary().getResultType() and
4755
outputType = conv.getResultType()
4856
select sink, source, sink,

0 commit comments

Comments
 (0)