hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

[CPP-434] Improved query and test suite.

Browse Source
This commit is contained in:
Ziemowit Laski
2019-10-10 18:11:35 -07:00
parent 1ab965761b
commit 33cd6de729
2 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
View File

@@ -14,12 +14,17 @@
import cpp
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
private predicate isSignedWithoutUnsignedCast(Expr e) {
e.getType().getUnspecifiedType().(IntegralType).isSigned() and
not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
}
from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
where
ro.getAnOperand() = add and
add.getAnOperand() = va1 and
ro.getAnOperand() = va2 and
globalValueNumber(va1) = globalValueNumber(va2) and
add.getFullyConverted().getType().getUnspecifiedType().(IntegralType).isSigned() and
not add.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
isSignedWithoutUnsignedCast(add) and
isSignedWithoutUnsignedCast(va2)
select ro, "Testing for signed overflow may produce undefined results."

19
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
View File

@@ -83,3 +83,22 @@ bool func1(se *so) {
bool checkOverflow3(unsigned int a, unsigned short b) {
return (a + b < a); // GOOD
}
struct C {
unsigned int length;
};
int checkOverflow4(unsigned int ioff, C c) {
// not deleted by gcc or clang
if ((int)(ioff + c.length) < (int)ioff) return 0; // GOOD
return 1;
}
#define AV_INPUT_BUFFER_PADDING_SIZE 64
int overflow12(int codecdata_length) {
if(codecdata_length + AV_INPUT_BUFFER_PADDING_SIZE <= (unsigned)codecdata_length) { // GOOD
return -1;
}
return 1;
}