PointerCPA handles structs and unions in a strange way
Currently, the PointerCPA
handles struct dereferences in a special way: potential pointers to struct instances point to the struct-type declaration.
This deviates from the intended behavior of the PointerCPA, that holds a map from pointers to potential pointee memory locations.
I'm not sure what the idea behind this was, but I would prefer the PointerCPA to just give no information (\top) if it is not sure what to point to. This way, no special handling would be necessary.
Edited by Philipp Wendler