hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20523 from smowton/smowton/fix/mistyped-exp-fp

Browse Source 
Go: mistyped-exponentiation: notice constants with likely-bitmask values
This commit is contained in:
Owen Mansel-Chan
2025-09-26 16:02:30 +01:00
committed by GitHub
parent a0b533bd40 f5f61193a0
commit 18a1075e70
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
go/ql/src/InconsistentCode/MistypedExponentiation.ql
View File

@@ -13,12 +13,16 @@
import go import go
private Expr getConstantInitialiser(Expr e) {
exists(DeclaredConstant c | e = c.getAReference() | result = c.getInit())
}
/** Holds if `e` is not 0 and is either an octal or hexadecimal literal, or the number one. */ /** Holds if `e` is not 0 and is either an octal or hexadecimal literal, or the number one. */
predicate maybeXorBitPattern(Expr e) { predicate maybeXorBitPattern(Expr e) {
// 0 makes no sense as an xor bit pattern // 0 makes no sense as an xor bit pattern
not e.getNumericValue() = 0 and not e.getNumericValue() = 0 and
// include octal and hex literals // include octal and hex literals
e.(IntLit).getText().matches("0%") [e, getConstantInitialiser(e)].(IntLit).getText().matches("0%")
or or
e.getNumericValue() = 1 e.getNumericValue() = 1
} }

7
go/ql/test/query-tests/InconsistentCode/MistypedExponentiation/main.go
View File

@@ -22,6 +22,13 @@ func main() {
mask := (((1 << 10) - 1) ^ 7) // OK mask := (((1 << 10) - 1) ^ 7) // OK
const (
c1 = 0x1234
c2 = 0x5678
)
fmt.Println(c1 ^ c2) // OK
// This is not ok, but isn't detected because the multiplication binds tighter // This is not ok, but isn't detected because the multiplication binds tighter
// than the xor operator and so the query doesn't see a constant on the left // than the xor operator and so the query doesn't see a constant on the left
// hand side of ^. // hand side of ^.