Check that the end the traces of inferBO and quandary issues match before matching them to form an quandaryBO issue

Reviewed By: mbouaziz

Differential Revision: D9973874

fbshipit-source-id: 2b7ee8556

infer/src/quandary/quandaryBO.ml

@@ -55,8 +55,20 @@ let update_issues all_issues =
         else (q_issues, iBO_issues) )
   in
   let matching_issues quandary_issue inferbo_issue =
+    let trace_end_match () =
+      let quandary_trace_end = List.last quandary_issue.Issue.err_data.loc_trace in
+      let inferbo_trace_end = List.last inferbo_issue.Issue.err_data.loc_trace in
+      match (quandary_trace_end, inferbo_trace_end) with
+      | Some quandary_trace_elem, Some inferbo_trace_elem ->
+          let q_loc = quandary_trace_elem.lt_loc in
+          let i_loc = inferbo_trace_elem.lt_loc in
+          SourceFile.equal q_loc.file i_loc.file && Int.equal q_loc.line i_loc.line
+      | _ ->
+          false
+    in
     SourceFile.equal quandary_issue.Issue.proc_location.file inferbo_issue.Issue.proc_location.file
     && Int.equal quandary_issue.Issue.proc_location.line inferbo_issue.Issue.proc_location.line
+    && trace_end_match ()
     && ( (is_quandary_alloc_issue quandary_issue && is_inferbo_alloc_issue inferbo_issue)
        || (is_quandary_access_issue quandary_issue && is_inferbo_access_issue inferbo_issue) )
   in

infer/tests/codetoanalyze/cpp/quandaryBO/tainted_index.cpp

@@ -7,6 +7,7 @@
 #include <stdlib.h>
 
 extern int __infer_taint_source();
+extern void __infer_taint_sink(int i);
 
 void basic_bad() {
   int arr[10];
@@ -22,11 +23,28 @@ void multi_level_sink_bad(int i) {
     arr[i] = 2;
 }
 
+struct arg {
+  int taint;
+  int bo;
+};
+
+arg multi_level_source_ok() {
+  return {.taint = __infer_taint_source(), .bo = 12};
+}
+
+void multi_level_sink_ok(int taint, int bo) {
+  __infer_taint_sink(taint);
+  int arr[10];
+  arr[bo] = 0;
+}
+
 void multi_level_bad() {
   int i = multi_level_source_bad();
   multi_level_sink_bad(i);
 }
 
+void multi_level_good() { int i = multi_level_source_bad(); }
+
 void memory_alloc_bad1_FN() { int arr[__infer_taint_source()]; }
 
 void memory_alloc_bad2() {