File tree Expand file tree Collapse file tree
ql_demos/cpp/Facebook_Fizz_CVE-2019-3560 Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -27,13 +27,21 @@ class Cfg extends TaintTracking::Configuration {
2727
2828 /** Holds if `source` is a call to `Endian::big()`. */
2929 override predicate isSource ( DataFlow:: Node source ) {
30- source .( CallInstruction ) .getCallTarget ( ) .( FunctionInstruction ) .getFunctionSymbol ( ) instanceof
31- EndianConvert
30+ source
31+ .asInstruction ( )
32+ .( CallInstruction )
33+ .getCallTarget ( )
34+ .( FunctionInstruction )
35+ .getFunctionSymbol ( ) instanceof EndianConvert
3236 }
3337
3438 /** Hold if `sink` is a narrowing conversion. */
3539 override predicate isSink ( DataFlow:: Node sink ) {
36- sink .getResultSize ( ) < sink .( ConvertInstruction ) .getUnary ( ) .getResultSize ( )
40+ sink .asInstruction ( ) .getResultSize ( ) < sink
41+ .asInstruction ( )
42+ .( ConvertInstruction )
43+ .getUnary ( )
44+ .getResultSize ( )
3745 }
3846}
3947
4250 Type inputType , Type outputType
4351where
4452 cfg .hasFlowPath ( source , sink ) and
45- conv = sink .getNode ( ) and
53+ conv = sink .getNode ( ) . asInstruction ( ) and
4654 inputType = conv .getUnary ( ) .getResultType ( ) and
4755 outputType = conv .getResultType ( )
4856select sink , source , sink ,
You can’t perform that action at this time.
0 commit comments