hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Fix range analysis bug where int was assumed.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2019-11-15 15:08:14 +01:00
parent f813e06680
commit 81a90943c0
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
java/ql/src/semmle/code/java/dataflow/RangeAnalysis.qll
View File

@@ -375,6 +375,16 @@ private class NarrowingCastExpr extends CastExpr {
int getUpperBound() { typeBound(getType(), _, result) }
}
/** Holds if `e >= 1` as determined by sign analysis. */
private predicate strictlyPositiveIntegralExpr(Expr e) {
strictlyPositive(e) and e.getType() instanceof IntegralType
}
/** Holds if `e <= -1` as determined by sign analysis. */
private predicate strictlyNegativeIntegralExpr(Expr e) {
strictlyNegative(e) and e.getType() instanceof IntegralType
}
/**
* Holds if `e1 + delta` is a valid bound for `e2`.
* - `upper = true` : `e2 <= e1 + delta`
@@ -400,13 +410,13 @@ private predicate boundFlowStep(Expr e2, Expr e1, int delta, boolean upper) {
// `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
not x instanceof ConstantIntegerExpr and
not e1 instanceof ConstantIntegerExpr and
if strictlyPositive(x)
if strictlyPositiveIntegralExpr(x)
then upper = false and delta = 1
else
if positive(x)
then upper = false and delta = 0
else
if strictlyNegative(x)
if strictlyNegativeIntegralExpr(x)
then upper = true and delta = -1
else
if negative(x)
@@ -429,13 +439,13 @@ private predicate boundFlowStep(Expr e2, Expr e1, int delta, boolean upper) {
|
// `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
not x instanceof ConstantIntegerExpr and
if strictlyPositive(x)
if strictlyPositiveIntegralExpr(x)
then upper = true and delta = -1
else
if positive(x)
then upper = true and delta = 0
else
if strictlyNegative(x)
if strictlyNegativeIntegralExpr(x)
then upper = false and delta = 1
else
if negative(x)