Skip to content

Commit a3dbc5e

Browse files
committed
Fix TypeAssertionCheck to not block successor flow
By moving it from the expression evaluation to the type assertion evaluation we don't block flow to successor uses of the same variable.
1 parent c308978 commit a3dbc5e

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

+8-4
Original file line numberDiff line numberDiff line change
@@ -290,13 +290,17 @@ private predicate integerTypeBound(IntegerType it, int bitSize, int architecture
290290
* the type assertion succeeded. If it is not checked then there will be a
291291
* run-time panic if the type assertion fails, so we can assume it succeeded.
292292
*/
293-
class TypeAssertionCheck extends DataFlow::ExprNode, FlowStateTransformer {
293+
class TypeAssertionCheck extends DataFlow::InstructionNode, FlowStateTransformer {
294294
IntegerType it;
295295

296296
TypeAssertionCheck() {
297-
exists(TypeAssertExpr tae |
298-
this = DataFlow::exprNode(tae.getExpr()) and
299-
it = tae.getTypeExpr().getType().getUnderlyingType()
297+
exists(IR::Instruction evalAssert, TypeAssertExpr assert |
298+
it = assert.getTypeExpr().getType().getUnderlyingType() and
299+
evalAssert = IR::evalExprInstruction(assert)
300+
|
301+
if exists(IR::extractTupleElement(evalAssert, _))
302+
then this.asInstruction() = IR::extractTupleElement(evalAssert, 0)
303+
else this.asInstruction() = evalAssert
300304
)
301305
}
302306

0 commit comments

Comments
 (0)