diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ExprNodes.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ExprNodes.qll index 927d2ea90288..bc433942506b 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ExprNodes.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ExprNodes.qll @@ -263,7 +263,9 @@ private module Cached { exists(CallInstruction call | call.getStaticCallTarget() instanceof Constructor and e = getConvertedResultExpression(call, n) and - call.getThisArgumentOperand() = node.getAddressOperand() + call.getThisArgumentOperand() = node.getAddressOperand() and + // Indirection index 0 is the `this` pointer, and 1 is the constructed object + node.getIndirectionIndex() = 1 ) } diff --git a/cpp/ql/test/library-tests/dataflow/asExpr/test.cpp b/cpp/ql/test/library-tests/dataflow/asExpr/test.cpp index 8df12588fa59..56cbfa3a8151 100644 --- a/cpp/ql/test/library-tests/dataflow/asExpr/test.cpp +++ b/cpp/ql/test/library-tests/dataflow/asExpr/test.cpp @@ -55,3 +55,12 @@ void test_postfix_crement(int *p, int q) { int *p2 = (int*)(p++); // $ asExpr="... ++" asIndirectExpr="... ++" asExpr="p(... ++)" asIndirectExpr="p(*... ++)" int q2 = (int)(q++); // $ asExpr="... ++" asExpr="q(... ++)" } + +struct C { + C(); +}; + +void test_constructor_calls() { + C c; // $ asExpr="call to C" + C *p = new C; // $ asExpr="call to C" asExpr=new asIndirectExpr=new +}