/**
 * @name parameterCheck
 * @description description
 * @kind problem
 * @problem.severity error
 * @precision high
 * @id cpp/paracheck
 * @tags security
 */

 import cpp
 import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.security.Security
 import semmle.code.cpp.controlflow.Guards
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
     
 Expr getSinkExpr(FunctionCall fc)
 {
     //Change
 result = fc.getArgument(0) 
 }
 
 predicate isSinkFC(FunctionCall fc)
 {
     // Change
 fc.getTarget().hasName("SSL_CTX_set_options")
 }
 GuardCondition getGuard(FunctionCall fc) {
    isSinkFC(fc)
    and
     exists(Expr e, Variable a| e = getSinkExpr(fc)
     and a.getAnAccess() = e
     and exists(GuardCondition g, Expr ge| 
         a.getAnAccess() = ge
         and g.getASuccessor*() = fc
         and g.getAChild*() = ge
         and result = g
         )
     )
 }
 
 
 from FunctionCall target
 where
 // get target functioncall
 isSinkFC(target)
// filter fc (no guardCondition check like if(para != NULL) before calling the fc)
 and not exists(GuardCondition g| 
     g = getGuard(target)
     )
// only check local var
and exists(Expr e, LocalVariable a| e = getSinkExpr(target)
 and a.getAnAccess() = e.getAChild*()
)
// make sure the target parameter is not like: &var
and not exists(AddressOfExpr ae | 
    ae = getSinkExpr(target))
 select target, target.getLocation().toString()