Skip to content

Commit 7a3895d

Browse files
committed
Python: Fix points-to for a, b = some_unknown_object.
Also rewrites `multi_assignment_points_to` to be a bit more readable. I'm not entirely sure that we want an unknown instance of `object` rather than just `UnknownInternal`. The latter gets filtered out in the characteristic predicate for `Value`, though, so I opted for the slightly more permissive variant.
1 parent 24e9f65 commit 7a3895d

1 file changed

Lines changed: 12 additions & 4 deletions

File tree

python/ql/src/semmle/python/pointsto/PointsTo.qll

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -506,13 +506,21 @@ cached module PointsToInternal {
506506
value = sequence.getItem(index)
507507
}
508508

509-
pragma [noinline]
510-
private predicate multi_assignment_points_to(MultiAssignmentDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin) {
511-
exists(int index, ControlFlowNode lhs, ControlFlowNode rhs, SequenceObjectInternal sequence |
509+
pragma[noinline]
510+
private predicate multi_assignment_points_to(
511+
MultiAssignmentDefinition def, PointsToContext context, ObjectInternal value,
512+
ControlFlowNode origin
513+
) {
514+
exists(int index, ControlFlowNode lhs, ControlFlowNode rhs, ObjectInternal sequence |
512515
def.indexOf(index, lhs) and
513516
lhs.(DefinitionNode).getValue() = rhs and
514-
sequence_index_points_to(rhs, context, sequence, value, index) and
515517
origin = def.getDefiningNode()
518+
|
519+
sequence_index_points_to(rhs, context, sequence, value, index)
520+
or
521+
pointsTo(rhs, context, sequence, _) and
522+
sequence instanceof UnknownInstanceInternal and
523+
value = TUnknownInstance(ObjectInternal::builtin("object"))
516524
)
517525
}
518526

0 commit comments

Comments
 (0)