hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add a new consistency check for branching on non-boolean values.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2024-11-18 15:21:28 +00:00
parent e081b9a420
commit 493ea6da31
12 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll
View File

@@ -546,4 +546,26 @@ module InstructionConsistency {
"' has no associated variable, in function '$@'." and
irFunc = getInstructionIRFunction(instr, irFuncText)
}
query predicate nonBooleanOperand(
Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
) {
exists(Instruction unary |
unary = instr.(LogicalNotInstruction).getUnary() and
not unary.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Logical Not instruction " + instr.toString() +
" with non-Boolean operand, in function '$@'."
)
or
exists(Instruction cond |
cond = instr.(ConditionalBranchInstruction).getCondition() and
not cond.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Conditional branch instruction " + instr.toString() +
" with non-Boolean condition, in function '$@'."
)
}
}

22
cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll
View File

@@ -546,4 +546,26 @@ module InstructionConsistency {
"' has no associated variable, in function '$@'." and
irFunc = getInstructionIRFunction(instr, irFuncText)
}
query predicate nonBooleanOperand(
Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
) {
exists(Instruction unary |
unary = instr.(LogicalNotInstruction).getUnary() and
not unary.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Logical Not instruction " + instr.toString() +
" with non-Boolean operand, in function '$@'."
)
or
exists(Instruction cond |
cond = instr.(ConditionalBranchInstruction).getCondition() and
not cond.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Conditional branch instruction " + instr.toString() +
" with non-Boolean condition, in function '$@'."
)
}
}

22
cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll
View File

@@ -546,4 +546,26 @@ module InstructionConsistency {
"' has no associated variable, in function '$@'." and
irFunc = getInstructionIRFunction(instr, irFuncText)
}
query predicate nonBooleanOperand(
Instruction instr, string message, OptionalIRFunction irFunc, string irFuncText
) {
exists(Instruction unary |
unary = instr.(LogicalNotInstruction).getUnary() and
not unary.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Logical Not instruction " + instr.toString() +
" with non-Boolean operand, in function '$@'."
)
or
exists(Instruction cond |
cond = instr.(ConditionalBranchInstruction).getCondition() and
not cond.getResultIRType() instanceof IRBooleanType and
irFunc = getInstructionIRFunction(instr, irFuncText) and
message =
"Conditional branch instruction " + instr.toString() +
" with non-Boolean condition, in function '$@'."
)
}
}