hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 05:01:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into ir-support-for-assertions

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2026-01-21 13:56:30 +00:00
parent 11566ee256 6ae1ea73f7
commit e1089c8d89
686 changed files with 168224 additions and 73046 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
cpp/ql/lib/CHANGELOG.md
View File

@@ -1,3 +1,31 @@
## 7.0.0
### Breaking Changes
* The `_Decimal32`, `_Decimal64`, and `_Decimal128` types are no longer exposed as builtin types. Support for these gcc-specific types was incomplete, and are generally not used in C/C++ codebases.
### Deprecated APIs
* The `OverloadedArrayExpr::getArrayOffset/0` predicate has been deprecated. Use `OverloadedArrayExpr::getArrayOffset/1` and `OverloadedArrayExpr::getAnArrayOffset` instead.
### New Features
* Added subclasses of `BuiltInOperations` for the `__is_bitwise_cloneable`, `__is_invocable`, and `__is_nothrow_invocable` builtin operations.
* Added a `isThisAccess` predicate to `ParamAccessForType` that holds when the access is to the implicit object parameter.
* Predicates `getArrayOffset/1` and `getAnArrayOffset` have been added to the `OverloadedArrayExpr` class to support C++23 multidimensional subscript operators.
### Minor Analysis Improvements
* Some constants will now be represented by their unfolded expression trees. The `isConstant` predicate of `Expr` will no longer yield a result for those constants.
### Bug Fixes
* Fixed a bug in the `DataFlow::BarrierGuard<...>::getABarrierNode` predicate which caused the predicate to return `DataFlow::Node`s with incorrect indirections. If you use `getABarrierNode` to implement barriers in a dataflow/taint-tracking query it may result in more query results. You can use `DataFlow::BarrierGuard<...>::getAnIndirectBarrierNode` to remove those query results.
## 6.1.4
No user-facing changes.
## 6.1.3
No user-facing changes.

4
cpp/ql/lib/change-notes/2026-01-02-constant-folding.md
View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Some constants will now be represented by their unfolded expression trees. The `isConstant` predicate of `Expr` will no longer yield a result for those constants.

4
cpp/ql/lib/change-notes/2026-01-19-embed.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Added a subclass `Embed` of `PreprocessorDirective` for C23 and C++26 `#embed` preprocessor directives.

4
cpp/ql/lib/change-notes/2026-01-19-parameterized-barrier-guard.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Added modules `DataFlow::ParameterizedBarrierGuard` and `DataFlow::ParameterizedInstructionBarrierGuard`. These modules provide the same features as `DataFlow::BarrierGuard` and `DataFlow::InstructionBarrierGuard`, but allow for an additional parameter to support properly using them in dataflow configurations that uses flow states.

3
cpp/ql/lib/change-notes/released/6.1.4.md Normal file
View File

@@ -0,0 +1,3 @@
## 6.1.4
No user-facing changes.

23
cpp/ql/lib/change-notes/released/7.0.0.md Normal file
View File

@@ -0,0 +1,23 @@
## 7.0.0
### Breaking Changes
* The `_Decimal32`, `_Decimal64`, and `_Decimal128` types are no longer exposed as builtin types. Support for these gcc-specific types was incomplete, and are generally not used in C/C++ codebases.
### Deprecated APIs
* The `OverloadedArrayExpr::getArrayOffset/0` predicate has been deprecated. Use `OverloadedArrayExpr::getArrayOffset/1` and `OverloadedArrayExpr::getAnArrayOffset` instead.
### New Features
* Added subclasses of `BuiltInOperations` for the `__is_bitwise_cloneable`, `__is_invocable`, and `__is_nothrow_invocable` builtin operations.
* Added a `isThisAccess` predicate to `ParamAccessForType` that holds when the access is to the implicit object parameter.
* Predicates `getArrayOffset/1` and `getAnArrayOffset` have been added to the `OverloadedArrayExpr` class to support C++23 multidimensional subscript operators.
### Minor Analysis Improvements
* Some constants will now be represented by their unfolded expression trees. The `isConstant` predicate of `Expr` will no longer yield a result for those constants.
### Bug Fixes
* Fixed a bug in the `DataFlow::BarrierGuard<...>::getABarrierNode` predicate which caused the predicate to return `DataFlow::Node`s with incorrect indirections. If you use `getABarrierNode` to implement barriers in a dataflow/taint-tracking query it may result in more query results. You can use `DataFlow::BarrierGuard<...>::getAnIndirectBarrierNode` to remove those query results.

2
cpp/ql/lib/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 6.1.3
lastReleaseVersion: 7.0.0

2
cpp/ql/lib/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 6.1.4-dev
version: 7.0.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

24
cpp/ql/lib/semmle/code/cpp/Preprocessor.qll
View File

@@ -328,3 +328,27 @@ class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
class PreprocessorLine extends PreprocessorDirective, @ppd_line {
override string toString() { result = "#line " + this.getHead() }
}
/**
* A C23 or C++26 `#embed` preprocessor directive. For example, the following code
* contains one `Embed` directive:
* ```cpp
* char arr[] = {
* #embed "bin"
* };
* ```
*/
class Embed extends PreprocessorDirective, @ppd_embed {
override string toString() { result = "#embed " + this.getIncludeText() }
/**
* Gets the token which occurs after `#embed`, for example `"filename"`
* or `<filename>`.
*/
string getIncludeText() { result = this.getHead() }
/**
* Gets the file directly embedded by this `#embed`.
*/
File getEmbeddedFile() { embeds(underlyingElement(this), unresolveElement(result)) }
}

9
cpp/ql/lib/semmle/code/cpp/PrintAST.qll
View File

@@ -1050,10 +1050,10 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
expr.(Call).getQualifier() = ele and
pred = "getQualifier()"
or
// OverloadedArrayExpr::getArrayBase/0 and OverloadedArrayExpr::getArrayOffset/0 also consider arguments, and are already handled below.
// OverloadedArrayExpr::getArrayBase/0 and OverloadedArrayExpr::getArrayOffset/1 also consider arguments, and are already handled below.
exists(int n, Expr arg | expr.(Call).getArgument(n) = arg |
not expr.(OverloadedArrayExpr).getArrayBase() = arg and
not expr.(OverloadedArrayExpr).getArrayOffset() = arg and
not expr.(OverloadedArrayExpr).getAnArrayOffset() = arg and
arg = ele and
pred = "getArgument(" + n.toString() + ")"
)
@@ -1062,7 +1062,10 @@ private predicate namedExprChildPredicates(Expr expr, Element ele, string pred)
or
expr.(OverloadedArrayExpr).getArrayBase() = ele and pred = "getArrayBase()"
or
expr.(OverloadedArrayExpr).getArrayOffset() = ele and pred = "getArrayOffset()"
exists(int n |
expr.(OverloadedArrayExpr).getArrayOffset(n) = ele and
pred = "getArrayOffset(" + n.toString() + ")"
)
or
// OverloadedPointerDereferenceExpr::getExpr/0 also considers qualifiers, and is already handled above for all Call classes.
not expr.(OverloadedPointerDereferenceExpr).getQualifier() =

50
cpp/ql/lib/semmle/code/cpp/Type.qll
View File

@@ -802,15 +802,6 @@ private predicate floatingPointTypeMapping(
// _Complex __float128
kind = 39 and base = 2 and domain = TComplexDomain() and realKind = 38 and extended = false
or
// _Decimal32
kind = 40 and base = 10 and domain = TRealDomain() and realKind = 40 and extended = false
or
// _Decimal64
kind = 41 and base = 10 and domain = TRealDomain() and realKind = 41 and extended = false
or
// _Decimal128
kind = 42 and base = 10 and domain = TRealDomain() and realKind = 42 and extended = false
or
// _Float32
kind = 45 and base = 2 and domain = TRealDomain() and realKind = 45 and extended = false
or
@@ -871,9 +862,8 @@ private predicate floatingPointTypeMapping(
/**
* The C/C++ floating point types. See 4.5. This includes `float`, `double` and `long double`, the
* fixed-size floating-point types like `_Float32`, the extended-precision floating-point types like
* `_Float64x`, and the decimal floating-point types like `_Decimal32`. It also includes the complex
* and imaginary versions of all of these types.
* fixed-size floating-point types like `_Float32`, and the extended-precision floating-point types
* like `_Float64x`. It also includes the complex and imaginary versions of all of these types.
*/
class FloatingPointType extends ArithmeticType {
final int base;
@@ -991,42 +981,6 @@ class Float128Type extends RealNumberType, BinaryFloatingPointType {
override string getAPrimaryQlClass() { result = "Float128Type" }
}
/**
* The GNU C `_Decimal32` primitive type. This is not standard C/C++.
* ```
* _Decimal32 d32;
* ```
*/
class Decimal32Type extends RealNumberType, DecimalFloatingPointType {
Decimal32Type() { builtintypes(underlyingElement(this), _, 40, _, _, _) }
override string getAPrimaryQlClass() { result = "Decimal32Type" }
}
/**
* The GNU C `_Decimal64` primitive type. This is not standard C/C++.
* ```
* _Decimal64 d64;
* ```
*/
class Decimal64Type extends RealNumberType, DecimalFloatingPointType {
Decimal64Type() { builtintypes(underlyingElement(this), _, 41, _, _, _) }
override string getAPrimaryQlClass() { result = "Decimal64Type" }
}
/**
* The GNU C `_Decimal128` primitive type. This is not standard C/C++.
* ```
* _Decimal128 d128;
* ```
*/
class Decimal128Type extends RealNumberType, DecimalFloatingPointType {
Decimal128Type() { builtintypes(underlyingElement(this), _, 42, _, _, _) }
override string getAPrimaryQlClass() { result = "Decimal128Type" }
}
/**
* The C/C++ `void` type. See 4.7.
* ```

87
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
View File

@@ -95,6 +95,7 @@
import cpp
private import new.DataFlow
private import semmle.code.cpp.controlflow.IRGuards
private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
private import internal.FlowSummaryImpl
@@ -367,6 +368,8 @@ private predicate elementSpec(
) {
sourceModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
sinkModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
barrierModel(namespace, type, subtypes, name, signature, ext, _, _, _, _) or
barrierGuardModel(namespace, type, subtypes, name, signature, ext, _, _, _, _, _) or
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _, _)
}
@@ -1028,6 +1031,84 @@ private module Cached {
isSinkNode(n, kind, model) and n.asNode() = node
)
}
private newtype TKindModelPair =
TMkPair(string kind, string model) { isBarrierGuardNode(_, _, kind, model) }
private GuardValue convertAcceptingValue(Public::AcceptingValue av) {
av.isTrue() and result.asBooleanValue() = true
or
av.isFalse() and result.asBooleanValue() = false
or
// NOTE: The below cases don't contribute anything currently since the
// callers immediately use `.asBooleanValue()` to convert the `GuardValue`
// to a boolean. Once we're willing to accept the breaking change of
// converting the barrier guard API to use `GuardValue`s instead `Boolean`s
// we can remove this restriction.
av.isNoException() and result.getDualValue().isThrowsException()
or
av.isZero() and result.asIntValue() = 0
or
av.isNotZero() and result.getDualValue().asIntValue() = 0
or
av.isNull() and result.isNullValue()
or
av.isNotNull() and result.isNonNullValue()
}
private predicate barrierGuardChecks(IRGuardCondition g, Expr e, boolean gv, TKindModelPair kmp) {
exists(
SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
string kind, string model
|
isBarrierGuardNode(n, acceptingvalue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
n.asNode().(Private::ArgumentNode).getCall().asCallInstruction() = g
)
}
private newtype TKindModelPairIntPair =
MkKindModelPairIntPair(TKindModelPair pair, int indirectionIndex) {
indirectionIndex > 0 and
Private::nodeHasInstruction(_, _, indirectionIndex) and
exists(pair)
}
private predicate indirectBarrierGuardChecks(
IRGuardCondition g, Expr e, boolean gv, TKindModelPairIntPair kmp
) {
exists(
SourceSinkInterpretationInput::InterpretNode interpretNode,
Public::AcceptingValue acceptingvalue, string kind, string model, int indirectionIndex,
Private::ArgumentNode arg
|
isBarrierGuardNode(interpretNode, acceptingvalue, kind, model) and
arg = interpretNode.asNode() and
arg.asIndirectExpr(indirectionIndex) = e and
kmp = MkKindModelPairIntPair(TMkPair(kind, model), indirectionIndex) and
gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
arg.getCall().asCallInstruction() = g
)
}
/**
* Holds if `node` is specified as a barrier with the given kind in a MaD flow
* model.
*/
cached
predicate barrierNode(DataFlow::Node node, string kind, string model) {
exists(SourceSinkInterpretationInput::InterpretNode n |
isBarrierNode(n, kind, model) and n.asNode() = node
)
or
DataFlow::ParameterizedBarrierGuard<TKindModelPair, barrierGuardChecks/4>::getABarrierNode(TMkPair(kind,
model)) = node
or
DataFlow::ParameterizedBarrierGuard<TKindModelPairIntPair, indirectBarrierGuardChecks/4>::getAnIndirectBarrierNode(MkKindModelPairIntPair(TMkPair(kind,
model), _)) = node
}
}
import Cached
@@ -1044,6 +1125,12 @@ predicate sourceNode(DataFlow::Node node, string kind) { sourceNode(node, kind,
*/
predicate sinkNode(DataFlow::Node node, string kind) { sinkNode(node, kind, _) }
/**
* Holds if `node` is specified as a barrier with the given kind in a MaD flow
* model.
*/
predicate barrierNode(DataFlow::Node node, string kind) { barrierNode(node, kind, _) }
private predicate interpretSummary(
Function f, string input, string output, string kind, string provenance, string model
) {

19
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -149,16 +149,27 @@ module SourceSinkInterpretationInput implements
}
predicate barrierElement(
Element n, string output, string kind, Public::Provenance provenance, string model
Element e, string output, string kind, Public::Provenance provenance, string model
) {
none()
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
barrierModel(namespace, type, subtypes, name, signature, ext, output, kind, provenance, model) and
e = interpretElement(namespace, type, subtypes, name, signature, ext)
)
}
predicate barrierGuardElement(
Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
Public::Provenance provenance, string model
) {
none()
exists(
string package, string type, boolean subtypes, string name, string signature, string ext
|
barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
provenance, model) and
e = interpretElement(package, type, subtypes, name, signature, ext)
)
}
private newtype TInterpretNode =

5
cpp/ql/lib/semmle/code/cpp/exprs/Access.qll
View File

@@ -394,6 +394,11 @@ class FunctionAccess extends Access, @routineexpr {
*/
class ParamAccessForType extends Expr, @param_ref {
override string toString() { result = "param access" }
/**
* Holds if the accessed parameter is implicit object parameter of the function.
*/
predicate isThisAccess() { param_ref_to_this(underlyingElement(this)) }
}
/**

58
cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll
View File

@@ -1941,3 +1941,61 @@ class BuiltInOperationIsTriviallyRelocatable extends BuiltInOperation, @istrivia
override string getAPrimaryQlClass() { result = "BuiltInOperationIsTriviallyRelocatable" }
}
/**
* A C++ `__is_bitwise_cloneable` built-in operation.
*
* Returns `true` if an object of type `_Tp` is bitwise cloneable.
*
* ```
* template<typename _Tp>
* struct is_bitwise_cloneable
* : public integral_constant<bool, __is_bitwise_cloneable(_Tp)>
* {};
* ```
*/
class BuiltInOperationIsBitwiseCloneable extends BuiltInOperation, @isbitwisecloneable {
override string toString() { result = "__is_bitwise_cloneable" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsBitwiseCloneable" }
}
/**
* A C++ `__is_invocable` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if a function of type `_FTpn` can be invoked with arguments of
* type `_Tps`.
*
* ```
* template<typename _FTpn, typename... _Tps>
* struct is_invocable
* : public integral_constant<bool, __is_invocable(_FTpn, _Tps...)>
* {};
* ```
*/
class BuiltInOperationIsInvocable extends BuiltInOperation, @isinvocable {
override string toString() { result = "__is_invocable" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsInvocable" }
}
/**
* A C++ `__is_nothrow_invocable` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if a function of non-throwing type `_FTpn` can be invoked
* with arguments of type `_Tps`.
*
* ```
* template<typename _FTpn, typename... _Tps>
* struct is_nothrow_invocable
* : public integral_constant<bool, __is_nothrow_invocable(_FTpn, _Tps...)>
* {};
* ```
*/
class BuiltInOperationIsNothrowInvocable extends BuiltInOperation, @isnothrowinvocable {
override string toString() { result = "__is_nothrow_invocable" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsNothrowInvocable" }
}

17
cpp/ql/lib/semmle/code/cpp/exprs/Call.qll
View File

@@ -387,10 +387,23 @@ class OverloadedArrayExpr extends FunctionCall {
/**
* Gets the expression giving the index.
*
* DEPRECATED: Use getArrayOffset/1 instead.
*/
Expr getArrayOffset() {
if exists(this.getQualifier()) then result = this.getChild(0) else result = this.getChild(1)
deprecated Expr getArrayOffset() { result = this.getArrayOffset(0) }
/**
* Gets the expression giving the nth index.
*/
Expr getArrayOffset(int n) {
n >= 0 and
if exists(this.getQualifier()) then result = this.getChild(n) else result = this.getChild(n + 1)
}
/**
* Gets an expression giving an index.
*/
Expr getAnArrayOffset() { result = this.getArrayOffset(_) }
}
/**

173
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View File

@@ -156,7 +156,7 @@ class Node extends TIRDataFlowNode {
* If `isGLValue()` holds, then the type of this node
* should be thought of as "pointer to `getType()`".
*/
DataFlowType getType() { none() } // overridden in subclasses
Type getType() { none() } // overridden in subclasses
/** Gets the instruction corresponding to this node, if any. */
Instruction asInstruction() { result = this.(InstructionNode).getInstruction() }
@@ -541,7 +541,7 @@ class Node extends TIRDataFlowNode {
/**
* Gets an upper bound on the type of this node.
*/
DataFlowType getTypeBound() { result = this.getType() }
Type getTypeBound() { result = this.getType() }
/** Gets the location of this element. */
cached
@@ -585,7 +585,7 @@ private class Node0 extends Node, TNode0 {
override string toStringImpl() { result = node.toString() }
override DataFlowType getType() { result = node.getType() }
override Type getType() { result = node.getType() }
override predicate isGLValue() { node.isGLValue() }
}
@@ -704,7 +704,7 @@ class SsaSynthNode extends Node, TSsaSynthNode {
override Declaration getFunction() { result = node.getBasicBlock().getEnclosingFunction() }
override DataFlowType getType() { result = node.getSourceVariable().getType() }
override Type getType() { result = node.getSourceVariable().getType() }
override predicate isGLValue() { node.getSourceVariable().isGLValue() }
@@ -732,7 +732,7 @@ class SsaIteratorNode extends Node, TSsaIteratorNode {
override Declaration getFunction() { result = node.getFunction() }
override DataFlowType getType() { result = node.getType() }
override Type getType() { result = node.getType() }
final override Location getLocationImpl() { result = node.getLocation() }
@@ -792,7 +792,7 @@ class FinalGlobalValue extends Node, TFinalGlobalValue {
override Declaration getFunction() { result = globalUse.getIRFunction().getFunction() }
override DataFlowType getType() {
override Type getType() {
exists(int indirectionIndex |
indirectionIndex = globalUse.getIndirectionIndex() and
result = getTypeImpl(globalUse.getUnderlyingType(), indirectionIndex)
@@ -826,7 +826,7 @@ class InitialGlobalValue extends Node, TInitialGlobalValue {
final override predicate isGLValue() { globalDef.getIndirectionIndex() = 0 }
override DataFlowType getType() { result = globalDef.getUnderlyingType() }
override Type getType() { result = globalDef.getUnderlyingType() }
final override Location getLocationImpl() { result = globalDef.getLocation() }
@@ -853,7 +853,7 @@ class BodyLessParameterNodeImpl extends Node, TBodyLessParameterNodeImpl {
/** Gets the indirection index of this node. */
int getIndirectionIndex() { result = indirectionIndex }
override DataFlowType getType() {
override Type getType() {
result = getTypeImpl(p.getUnderlyingType(), this.getIndirectionIndex())
}
@@ -1117,8 +1117,8 @@ private module RawIndirectNodes {
override predicate isGLValue() { this.getOperand().isGLValue() }
override DataFlowType getType() {
exists(int sub, DataFlowType type, boolean isGLValue |
override Type getType() {
exists(int sub, Type type, boolean isGLValue |
type = getOperandType(this.getOperand(), isGLValue) and
if isGLValue = true then sub = 1 else sub = 0
|
@@ -1163,8 +1163,8 @@ private module RawIndirectNodes {
override predicate isGLValue() { this.getInstruction().isGLValue() }
override DataFlowType getType() {
exists(int sub, DataFlowType type, boolean isGLValue |
override Type getType() {
exists(int sub, Type type, boolean isGLValue |
type = getInstructionType(this.getInstruction(), isGLValue) and
if isGLValue = true then sub = 1 else sub = 0
|
@@ -1263,7 +1263,7 @@ class FinalParameterNode extends Node, TFinalParameterNode {
result.asSourceCallable() = this.getFunction()
}
override DataFlowType getType() { result = getTypeImpl(p.getUnderlyingType(), indirectionIndex) }
override Type getType() { result = getTypeImpl(p.getUnderlyingType(), indirectionIndex) }
final override Location getLocationImpl() {
// Parameters can have multiple locations. When there's a unique location we use
@@ -1539,7 +1539,7 @@ abstract class PostUpdateNode extends Node {
*/
abstract Node getPreUpdateNode();
final override DataFlowType getType() { result = this.getPreUpdateNode().getType() }
final override Type getType() { result = this.getPreUpdateNode().getType() }
}
/**
@@ -1632,9 +1632,7 @@ class VariableNode extends Node, TGlobalLikeVariableNode {
result.asSourceCallable() = v
}
override DataFlowType getType() {
result = getTypeImpl(v.getUnderlyingType(), indirectionIndex - 1)
}
override Type getType() { result = getTypeImpl(v.getUnderlyingType(), indirectionIndex - 1) }
final override Location getLocationImpl() {
// Certain variables (such as parameters) can have multiple locations.
@@ -2419,6 +2417,19 @@ class ContentSet instanceof Content {
}
}
private signature class ParamSig;
private module WithParam<ParamSig P> {
/**
* Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
*
* The expression `e` is expected to be a syntactic part of the guard `g`.
* For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
* the argument `x`.
*/
signature predicate guardChecksSig(IRGuardCondition g, Expr e, boolean branch, P param);
}
/**
* Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
*
@@ -2440,7 +2451,7 @@ private predicate controls(IRGuardCondition g, Node n, boolean edge) {
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
* in data flow and taint tracking.
*/
module BarrierGuard<guardChecksSig/3 guardChecks> {
module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guardChecks> {
bindingset[value, n]
pragma[inline_late]
private predicate convertedExprHasValueNumber(ValueNumber value, Node n) {
@@ -2450,12 +2461,13 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
)
}
private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
guardChecks(g, n.asOperand().getDef().getConvertedResultExpression(), branch)
private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch, P p) {
guardChecks(g, n.asOperand().getDef().getConvertedResultExpression(), branch, p)
}
/**
* Gets an expression node that is safely guarded by the given guard check.
* Gets an expression node that is safely guarded by the given guard check
* when the parameter is `p`.
*
* For example, given the following code:
* ```cpp
@@ -2486,19 +2498,27 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
*
* NOTE: If an indirect expression is tracked, use `getAnIndirectBarrierNode` instead.
*/
Node getABarrierNode() {
Node getABarrierNode(P p) {
exists(IRGuardCondition g, ValueNumber value, boolean edge |
convertedExprHasValueNumber(value, result) and
guardChecks(g,
pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge) and
pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge, p) and
controls(g, result, edge)
)
or
result = SsaImpl::BarrierGuard<guardChecksNode/3>::getABarrierNode()
result = SsaImpl::BarrierGuard<P, guardChecksNode/4>::getABarrierNode(p)
}
/**
* Gets an indirect expression node that is safely guarded by the given guard check.
* Gets an expression node that is safely guarded by the given guard check.
*
* See `getABarrierNode/1` for examples.
*/
Node getABarrierNode() { result = getABarrierNode(_) }
/**
* Gets an indirect expression node that is safely guarded by the given
* guard check with parameter `p`.
*
* For example, given the following code:
* ```cpp
@@ -2530,6 +2550,13 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
*
* NOTE: If a non-indirect expression is tracked, use `getABarrierNode` instead.
*/
Node getAnIndirectBarrierNode(P p) { result = getAnIndirectBarrierNode(_, p) }
/**
* Gets an indirect expression node that is safely guarded by the given guard check.
*
* See `getAnIndirectBarrierNode/1` for examples.
*/
Node getAnIndirectBarrierNode() { result = getAnIndirectBarrierNode(_) }
bindingset[value, n]
@@ -2544,10 +2571,10 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
}
private predicate guardChecksIndirectNode(
IRGuardCondition g, Node n, boolean branch, int indirectionIndex
IRGuardCondition g, Node n, boolean branch, int indirectionIndex, P p
) {
guardChecks(g, n.asIndirectOperand(indirectionIndex).getDef().getConvertedResultExpression(),
branch)
branch, p)
}
/**
@@ -2584,19 +2611,44 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
*
* NOTE: If a non-indirect expression is tracked, use `getABarrierNode` instead.
*/
Node getAnIndirectBarrierNode(int indirectionIndex) {
Node getAnIndirectBarrierNode(int indirectionIndex, P p) {
exists(IRGuardCondition g, ValueNumber value, boolean edge |
indirectConvertedExprHasValueNumber(indirectionIndex, value, result) and
guardChecks(g,
pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge) and
pragma[only_bind_into](value.getAnInstruction().getConvertedResultExpression()), edge, p) and
controls(g, result, edge)
)
or
result =
SsaImpl::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
SsaImpl::BarrierGuardWithIntParam<P, guardChecksIndirectNode/5>::getABarrierNode(indirectionIndex,
p)
}
}
/**
* Provides a set of barrier nodes for a guard that validates an expression.
*
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
* in data flow and taint tracking.
*/
module BarrierGuard<guardChecksSig/3 guardChecks> {
private predicate guardChecks(IRGuardCondition g, Expr e, boolean branch, Unit unit) {
guardChecks(g, e, branch) and
exists(unit)
}
import ParameterizedBarrierGuard<Unit, guardChecks/4>
}
private module InstrWithParam<ParamSig P> {
/**
* Holds if the guard `g` validates the instruction `instr` upon evaluating to `branch`.
*/
signature predicate instructionGuardChecksSig(
IRGuardCondition g, Instruction instr, boolean branch, P p
);
}
/**
* Holds if the guard `g` validates the instruction `instr` upon evaluating to `branch`.
*/
@@ -2608,7 +2660,9 @@ signature predicate instructionGuardChecksSig(IRGuardCondition g, Instruction in
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
* in data flow and taint tracking.
*/
module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardChecks> {
module ParameterizedInstructionBarrierGuard<
ParamSig P, InstrWithParam<P>::instructionGuardChecksSig/4 instructionGuardChecks>
{
bindingset[value, n]
pragma[inline_late]
private predicate operandHasValueNumber(ValueNumber value, Node n) {
@@ -2618,21 +2672,27 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
)
}
private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
instructionGuardChecks(g, n.asOperand().getDef(), branch)
private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch, P p) {
instructionGuardChecks(g, n.asOperand().getDef(), branch, p)
}
/** Gets a node that is safely guarded by the given guard check. */
Node getABarrierNode() {
/**
* Gets a node that is safely guarded by the given guard check with
* parameter `p`.
*/
Node getABarrierNode(P p) {
exists(IRGuardCondition g, ValueNumber value, boolean edge |
instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge) and
instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge, p) and
operandHasValueNumber(value, result) and
controls(g, result, edge)
)
or
result = SsaImpl::BarrierGuard<guardChecksNode/3>::getABarrierNode()
result = SsaImpl::BarrierGuard<P, guardChecksNode/4>::getABarrierNode(p)
}
/** Gets a node that is safely guarded by the given guard check. */
Node getABarrierNode() { result = getABarrierNode(_) }
bindingset[value, n]
pragma[inline_late]
private predicate indirectOperandHasValueNumber(ValueNumber value, int indirectionIndex, Node n) {
@@ -2643,25 +2703,52 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
}
private predicate guardChecksIndirectNode(
IRGuardCondition g, Node n, boolean branch, int indirectionIndex
IRGuardCondition g, Node n, boolean branch, int indirectionIndex, P p
) {
instructionGuardChecks(g, n.asIndirectOperand(indirectionIndex).getDef(), branch)
instructionGuardChecks(g, n.asIndirectOperand(indirectionIndex).getDef(), branch, p)
}
/**
* Gets an indirect node with indirection index `indirectionIndex` that is
* safely guarded by the given guard check.
* safely guarded by the given guard check with parameter `p`.
*/
Node getAnIndirectBarrierNode(int indirectionIndex) {
Node getAnIndirectBarrierNode(int indirectionIndex, P p) {
exists(IRGuardCondition g, ValueNumber value, boolean edge |
instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge) and
instructionGuardChecks(g, pragma[only_bind_into](value.getAnInstruction()), edge, p) and
indirectOperandHasValueNumber(value, indirectionIndex, result) and
controls(g, result, edge)
)
or
result =
SsaImpl::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
SsaImpl::BarrierGuardWithIntParam<P, guardChecksIndirectNode/5>::getABarrierNode(indirectionIndex,
p)
}
/**
* Gets an indirect node that is safely guarded by the given guard check
* with parameter `p`.
*/
Node getAnIndirectBarrierNode(P p) { result = getAnIndirectBarrierNode(_, p) }
/** Gets an indirect node that is safely guarded by the given guard check. */
Node getAnIndirectBarrierNode() { result = getAnIndirectBarrierNode(_) }
}
/**
* Provides a set of barrier nodes for a guard that validates an instruction.
*
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
* in data flow and taint tracking.
*/
module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardChecks> {
private predicate instructionGuardChecks(
IRGuardCondition g, Instruction i, boolean branch, Unit unit
) {
instructionGuardChecks(g, i, branch) and
exists(unit)
}
import ParameterizedInstructionBarrierGuard<Unit, instructionGuardChecks/4>
}
/**

61
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll
View File

@@ -53,7 +53,7 @@ private module SourceVariables {
* the type of this source variable should be thought of as "pointer
* to `getType()`".
*/
DataFlowType getType() {
Type getType() {
if this.isGLValue()
then result = base.getType()
else result = getTypeImpl(base.getType(), ind - 1)
@@ -1035,13 +1035,23 @@ class SynthNode extends DataFlowIntegrationImpl::SsaNode {
SynthNode() { not this.asDefinition() instanceof SsaImpl::WriteDefinition }
}
signature predicate guardChecksNodeSig(IRGuards::IRGuardCondition g, Node e, boolean branch);
private signature class ParamSig;
signature predicate guardChecksNodeSig(
IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
);
private module ParamIntPair<ParamSig P> {
newtype TPair = MkPair(P p, int indirectionIndex) { nodeHasInstruction(_, _, indirectionIndex) }
}
module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
private module WithParam<ParamSig P> {
signature predicate guardChecksNodeSig(IRGuards::IRGuardCondition g, Node e, boolean gv, P param);
}
private module IntWithParam<ParamSig P> {
signature predicate guardChecksNodeSig(
IRGuards::IRGuardCondition g, Node e, boolean gv, int indirectionIndex, P param
);
}
module BarrierGuardWithIntParam<ParamSig P, IntWithParam<P>::guardChecksNodeSig/5 guardChecksNode> {
private predicate ssaDefReachesCertainUse(Definition def, UseImpl use) {
exists(SourceVariable v, IRBlock bb, int i |
use.hasIndexInBlock(bb, i, v) and
@@ -1052,34 +1062,44 @@ module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
private predicate guardChecksInstr(
IRGuards::Guards_v1::Guard g, IRGuards::GuardsInput::Expr instr, IRGuards::GuardValue gv,
int indirectionIndex
ParamIntPair<P>::TPair pair
) {
exists(Node node |
exists(Node node, int indirectionIndex, P p |
pair = ParamIntPair<P>::MkPair(p, indirectionIndex) and
nodeHasInstruction(node, instr, indirectionIndex) and
guardChecksNode(g, node, gv.asBooleanValue(), indirectionIndex)
guardChecksNode(g, node, gv.asBooleanValue(), indirectionIndex, p)
)
}
private predicate guardChecksWithWrappers(
DataFlowIntegrationInput::Guard g, SsaImpl::Definition def, IRGuards::GuardValue val,
int indirectionIndex
ParamIntPair<P>::MkPair pair
) {
IRGuards::Guards_v1::ParameterizedValidationWrapper<int, guardChecksInstr/4>::guardChecksDef(g,
def, val, indirectionIndex)
exists(Instruction e, int indirectionIndex |
IRGuards::Guards_v1::ParameterizedValidationWrapper<ParamIntPair<P>::TPair, guardChecksInstr/4>::guardChecks(g,
e, val, pair) and
pair = ParamIntPair<P>::MkPair(_, indirectionIndex)
|
indirectionIndex = 0 and
def.(Definition).getAUse().getDef() = e
or
def.(Definition).getAnIndirectUse(indirectionIndex).getDef() = e
)
}
Node getABarrierNode(int indirectionIndex) {
Node getABarrierNode(int indirectionIndex, P p) {
// Only get the SynthNodes from the shared implementation, as the ExprNodes cannot
// be matched on SourceVariable.
result.(SsaSynthNode).getSynthNode() =
DataFlowIntegrationImpl::BarrierGuardDefWithState<int, guardChecksWithWrappers/4>::getABarrierNode(indirectionIndex)
DataFlowIntegrationImpl::BarrierGuardDefWithState<ParamIntPair<P>::MkPair, guardChecksWithWrappers/4>::getABarrierNode(ParamIntPair<P>::MkPair(p,
indirectionIndex))
or
// Calculate the guarded UseImpls corresponding to ExprNodes directly.
exists(
DataFlowIntegrationInput::Guard g, IRGuards::GuardValue branch, Definition def, IRBlock bb
|
guardChecksWithWrappers(g, def, branch, indirectionIndex) and
exists(UseImpl use |
guardChecksWithWrappers(g, def, branch, ParamIntPair<P>::MkPair(p, indirectionIndex)) and
ssaDefReachesCertainUse(def, use) and
use.getBlock() = bb and
DataFlowIntegrationInput::guardControlsBlock(g, bb, branch) and
@@ -1089,15 +1109,16 @@ module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
}
}
module BarrierGuard<guardChecksNodeSig/3 guardChecksNode> {
module BarrierGuard<ParamSig P, WithParam<P>::guardChecksNodeSig/4 guardChecksNode> {
private predicate guardChecksNode(
IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
IRGuards::IRGuardCondition g, Node e, boolean gv, int indirectionIndex, P p
) {
guardChecksNode(g, e, branch) and indirectionIndex = 0
indirectionIndex = 0 and
guardChecksNode(g, e, gv, p)
}
Node getABarrierNode() {
result = BarrierGuardWithIntParam<guardChecksNode/4>::getABarrierNode(0)
Node getABarrierNode(P p) {
result = BarrierGuardWithIntParam<P, guardChecksNode/5>::getABarrierNode(0, p)
}
}

48
cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
View File

@@ -1709,6 +1709,22 @@ predicate nonNanGuardedVariable(Expr guard, VariableAccess v, boolean branch) {
nanExcludingComparison(guard, branch)
}
/**
* Adjusts a lower bound to its meaning for integral types.
*
* Examples:
* `>= 3.0` becomes `3.0`
* ` > 3.0` becomes `4.0`
* `>= 3.5` becomes `4.0`
* ` > 3.5` becomes `4.0`
*/
bindingset[strictness, lb]
private float adjustLowerBoundIntegral(RelationStrictness strictness, float lb) {
if strictness = Nonstrict() and lb.floorFloat() = lb
then result = lb
else result = lb.floorFloat() + 1
}
/**
* If the guard is a comparison of the form `p*v + q <CMP> r`, then this
* predicate uses the bounds information for `r` to compute a lower bound
@@ -1720,15 +1736,29 @@ private predicate lowerBoundFromGuard(Expr guard, VariableAccess v, float lb, bo
|
if nonNanGuardedVariable(guard, v, branch)
then
if
strictness = Nonstrict() or
not getVariableRangeType(v.getTarget()) instanceof IntegralType
then lb = childLB
else lb = childLB + 1
if getVariableRangeType(v.getTarget()) instanceof IntegralType
then lb = adjustLowerBoundIntegral(strictness, childLB)
else lb = childLB
else lb = varMinVal(v.getTarget())
)
}
/**
* Adjusts an upper bound to its meaning for integral types.
*
* Examples:
* `<= 3.0` becomes `3.0`
* ` < 3.0` becomes `2.0`
* `<= 3.5` becomes `3.0`
* ` < 3.5` becomes `3.0`
*/
bindingset[strictness, ub]
private float adjustUpperBoundIntegral(RelationStrictness strictness, float ub) {
if strictness = Nonstrict() and ub.ceilFloat() = ub
then result = ub
else result = ub.ceilFloat() - 1
}
/**
* If the guard is a comparison of the form `p*v + q <CMP> r`, then this
* predicate uses the bounds information for `r` to compute a upper bound
@@ -1740,11 +1770,9 @@ private predicate upperBoundFromGuard(Expr guard, VariableAccess v, float ub, bo
|
if nonNanGuardedVariable(guard, v, branch)
then
if
strictness = Nonstrict() or
not getVariableRangeType(v.getTarget()) instanceof IntegralType
then ub = childUB
else ub = childUB - 1
if getVariableRangeType(v.getTarget()) instanceof IntegralType
then ub = adjustUpperBoundIntegral(strictness, childUB)
else ub = childUB
else ub = varMaxVal(v.getTarget())
)
}

26
cpp/ql/lib/semmlecode.cpp.dbscheme
View File

@@ -617,9 +617,9 @@ case @builtintype.kind of
| 37 = @signed_int128 // signed __int128
| 38 = @float128 // __float128
| 39 = @complex_float128 // _Complex __float128
| 40 = @decimal32 // _Decimal32
| 41 = @decimal64 // _Decimal64
| 42 = @decimal128 // _Decimal128
// ... 40 _Decimal32
// ... 41 _Decimal64
// ... 42 _Decimal128
| 43 = @char16_t
| 44 = @char32_t
| 45 = @std_float32 // _Float32
@@ -1902,6 +1902,9 @@ case @expr.kind of
| 391 = @nested_requirement
| 392 = @compound_requirement
| 393 = @concept_id
| 394 = @isinvocable
| 395 = @isnothrowinvocable
| 396 = @isbitwisecloneable
;
@var_args_expr = @vastartexpr
@@ -2018,6 +2021,9 @@ case @expr.kind of
| @istriviallyequalitycomparable
| @isscopedenum
| @istriviallyrelocatable
| @isinvocable
| @isnothrowinvocable
| @isbitwisecloneable
;
compound_requirement_is_noexcept(
@@ -2034,6 +2040,10 @@ new_array_allocated_type(
int type_id: @type ref
);
param_ref_to_this(
int expr: @param_ref ref
)
/**
* The field being initialized by an initializer expression within an aggregate
* initializer for a class/struct/union. Position is used to sort repeated initializers.
@@ -2343,6 +2353,7 @@ case @preprocdirect.kind of
| 14 = @ppd_ms_import
| 15 = @ppd_elifdef
| 16 = @ppd_elifndef
| 17 = @ppd_embed
| 18 = @ppd_warning
;
@@ -2369,6 +2380,11 @@ includes(
int included: @file ref
);
embeds(
unique int id: @ppd_embed ref,
int included: @file ref
);
link_targets(
int id: @link_target,
int binary: @file ref
@@ -2379,6 +2395,8 @@ link_parent(
int link_target : @link_target ref
);
/*- Database metadata -*/
/**
* The CLI will automatically emit applicable tuples for this table,
* such as `databaseMetadata("isOverlay", "true")` when building an
@@ -2389,6 +2407,8 @@ databaseMetadata(
string value: string ref
);
/*- Overlay support -*/
/**
* The CLI will automatically emit tuples for each new/modified/deleted file
* when building an overlay database.

7686
cpp/ql/lib/semmlecode.cpp.dbscheme.stats
View File

File diff suppressed because it is too large Load Diff

2479
cpp/ql/lib/upgrades/1402ab319d20cdc9289deb7bfc1c70f36be44d44/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2483
cpp/ql/lib/upgrades/1402ab319d20cdc9289deb7bfc1c70f36be44d44/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/1402ab319d20cdc9289deb7bfc1c70f36be44d44/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Sections for databaseMetadata and overlayChangedFiles
compatibility: full

2483
cpp/ql/lib/upgrades/83100310bf73eefc37c1d8d0ac98b2ca3019c7b6/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2489
cpp/ql/lib/upgrades/83100310bf73eefc37c1d8d0ac98b2ca3019c7b6/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/83100310bf73eefc37c1d8d0ac98b2ca3019c7b6/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Support embed preprocessor directive
compatibility: partial

11
cpp/ql/lib/upgrades/a42ce5fc943254097f85471b94ae2247e819104a/builtintypes.ql Normal file
View File

@@ -0,0 +1,11 @@
class BuiltinType extends @builtintype {
string toString() { none() }
}
predicate isDecimalBuiltinType(BuiltinType type) { builtintypes(type, _, [40, 41, 42], _, _, _) }
from BuiltinType type, string name, int kind, int kind_new, int size, int sign, int alignment
where
builtintypes(type, name, kind, size, sign, alignment) and
if isDecimalBuiltinType(type) then kind_new = 1 else kind_new = kind
select type, name, kind_new, size, sign, alignment

2469
cpp/ql/lib/upgrades/a42ce5fc943254097f85471b94ae2247e819104a/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2469
cpp/ql/lib/upgrades/a42ce5fc943254097f85471b94ae2247e819104a/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/ql/lib/upgrades/a42ce5fc943254097f85471b94ae2247e819104a/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Remove _Decimal{32,64,128} types
compatibility: partial
builtintypes.rel: run builtintypes.qlo

2469
cpp/ql/lib/upgrades/d2d611b3fdcc7c4fe370f0d115200a3aa6ad5837/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2479
cpp/ql/lib/upgrades/d2d611b3fdcc7c4fe370f0d115200a3aa6ad5837/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/d2d611b3fdcc7c4fe370f0d115200a3aa6ad5837/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Add new builtin operations and this parameter access table
compatibility: backwards

10
cpp/ql/src/CHANGELOG.md
View File

@@ -1,3 +1,13 @@
## 1.5.9
### Minor Analysis Improvements
* The `cpp/constant-comparison` query has been updated to not produce false positives for constants that are now represented by their unfolded expression trees.
## 1.5.8
No user-facing changes.
## 1.5.7
No user-facing changes.

3
cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
View File

@@ -122,7 +122,8 @@ module Config implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) {
// Block flow if the node is guarded by any <, <= or = operations.
node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode()
node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode() or
node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getAnIndirectBarrierNode()
}
predicate observeDiffInformedIncrementalMode() { any() }

3
cpp/ql/src/change-notes/released/1.5.8.md Normal file
View File

@@ -0,0 +1,3 @@
## 1.5.8
No user-facing changes.

7
cpp/ql/src/change-notes/2026-01-02-constant-comparison.md → cpp/ql/src/change-notes/released/1.5.9.md
View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 1.5.9
### Minor Analysis Improvements
* The `cpp/constant-comparison` query has been updated to not produce false positives for constants that are now represented by their unfolded expression trees.

2
cpp/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.5.7
lastReleaseVersion: 1.5.9

2
cpp/ql/src/jsf/lib/section_4_21_Operators/AV_Rule_166.qll
View File

@@ -13,7 +13,7 @@ class SizeofImpureExprOperator extends SizeofExprOperator {
not e.(OverloadedPointerDereferenceExpr).getExpr().isPure() and
not exists(OverloadedArrayExpr op | op = e |
op.getArrayBase().isPure() and
op.getArrayOffset().isPure()
forall(Expr offset | offset = op.getAnArrayOffset() | offset.isPure())
)
)
}

2
cpp/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.5.8-dev
version: 1.5.10-dev
groups:
- cpp
- queries

2
cpp/ql/src/utils/modelgenerator/internal/CaptureModels.qll
View File

@@ -78,7 +78,7 @@ module ModelGeneratorCommonInput implements ModelGeneratorCommonInputSig<Cpp::Lo
{
private module DataFlow = Df::DataFlow;
class Type = DataFlowPrivate::DataFlowType;
class Type = Cpp::Type;
// Note: This also includes `this`
class Parameter = DataFlow::ParameterNode;

10
cpp/ql/test/library-tests/builtins/type_traits/clang.cpp
View File

@@ -1,4 +1,4 @@
// semmle-extractor-options: --clang --clang_version 190000
// semmle-extractor-options: --clang --clang_version 210000
struct S {
void f() {}
@@ -121,3 +121,11 @@ bool b_is_scoped_enum2 = __is_scoped_enum(int);
bool b_is_trivially_relocatable1 = __is_trivially_relocatable(int);
bool b_is_trivially_relocatable2 = __is_trivially_relocatable(void);
struct S3{
S3(S3 &);
S3& operator=(S3&);
};
bool bok_is_bitwise_cloneable1 = __is_bitwise_cloneable(int);
bool bok_is_bitwise_cloneable2 = __is_bitwise_cloneable(S3);

14
cpp/ql/test/library-tests/builtins/type_traits/expr.expected
View File

@@ -165,6 +165,10 @@
| clang.cpp:122:36:122:66 | int | | <none> |
| clang.cpp:123:36:123:67 | __is_trivially_relocatable | void | 0 |
| clang.cpp:123:36:123:67 | void | | <none> |
| clang.cpp:130:34:130:60 | __is_bitwise_cloneable | int | 1 |
| clang.cpp:130:34:130:60 | int | | <none> |
| clang.cpp:131:34:131:59 | S3 | | <none> |
| clang.cpp:131:34:131:59 | __is_bitwise_cloneable | S3 | 0 |
| file://:0:0:0:0 | 0 | | 0 |
| file://:0:0:0:0 | 0 | | 0 |
| file://:0:0:0:0 | 1 | | 1 |
@@ -211,6 +215,16 @@
| gcc.cpp:29:45:29:93 | __reference_converts_from_temporary | int &&,int && | 0 |
| gcc.cpp:29:45:29:93 | int && | | <none> |
| gcc.cpp:29:45:29:93 | int && | | <none> |
| gcc.cpp:33:24:33:45 | __is_invocable | f_type | 1 |
| gcc.cpp:33:24:33:45 | f_type | | <none> |
| gcc.cpp:34:24:34:51 | __is_invocable | f_type,bool | 0 |
| gcc.cpp:34:24:34:51 | bool | | <none> |
| gcc.cpp:34:24:34:51 | f_type | | <none> |
| gcc.cpp:36:32:36:61 | __is_nothrow_invocable | f_type | 1 |
| gcc.cpp:36:32:36:61 | f_type | | <none> |
| gcc.cpp:37:32:37:67 | __is_nothrow_invocable | f_type,bool | 0 |
| gcc.cpp:37:32:37:67 | bool | | <none> |
| gcc.cpp:37:32:37:67 | f_type | | <none> |
| ms.cpp:38:41:38:45 | 0 | | 0 |
| ms.cpp:88:27:88:45 | __has_assign | empty | 0 |
| ms.cpp:88:27:88:45 | empty | | <none> |

10
cpp/ql/test/library-tests/builtins/type_traits/gcc.cpp
View File

@@ -1,4 +1,4 @@
// semmle-extractor-options: --gnu_version 130000
// semmle-extractor-options: --gnu_version 150000
__attribute__ ((aligned(8))) int v;
bool b_has_attribute1 = __builtin_has_attribute(v, aligned);
@@ -27,3 +27,11 @@ bool b_reference_constructs_from_temporary2 = __reference_constructs_from_tempor
bool b_reference_converts_from_temporary1 = __reference_converts_from_temporary(int&&, int);
bool b_reference_converts_from_temporary2 = __reference_converts_from_temporary(int&&, int&&);
using f_type = void(*)() noexcept;
bool b_is_invocable1 = __is_invocable(f_type);
bool b_is_invocable2 = __is_invocable(f_type, bool);
bool b_is_nothrow_invocable1 = __is_nothrow_invocable(f_type);
bool b_is_nothrow_invocable2 = __is_nothrow_invocable(f_type, bool);

5
cpp/ql/test/library-tests/builtins/types/types.c
View File

@@ -1,5 +0,0 @@
_Decimal32 d32;
_Decimal64 d64;
_Decimal128 d128;

7
cpp/ql/test/library-tests/builtins/types/types.expected
View File

@@ -1,7 +0,0 @@
| file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | unsigned int |
| file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | unsigned int |
| file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | void * |
| file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | void * |
| types.c:2:12:2:14 | d32 | file://:0:0:0:0 | _Decimal32 |
| types.c:3:12:3:14 | d64 | file://:0:0:0:0 | _Decimal64 |
| types.c:4:13:4:16 | d128 | file://:0:0:0:0 | _Decimal128 |

5
cpp/ql/test/library-tests/builtins/types/types.ql
View File

@@ -1,5 +0,0 @@
import cpp
from Variable v, Type t
where t = v.getType()
select v, t

42
cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.cpp
View File

@@ -4,6 +4,46 @@ void sink(int);
void testCheckArgument(int* p) {
if (checkArgument(p)) {
sink(*p); // $ barrier barrier=1
sink(*p); // $ indirect_barrier=int barrier=int*
}
}
void testCheckArgument(int p) {
if (checkArgument(&p)) {
sink(p); // $ barrier=glval<int> indirect_barrier=int
}
}
int* get_clean_value(int* x) { return x; }
bool is_clean_value(int*);
int* get_clean_pointer(int* x) { return x; }
bool is_clean_pointer(int*);
void sink(int*);
void test_mad(int x, int* p) {
{
if(is_clean_value(&x)) {
sink(x); // $ external=int
}
}
{
if(is_clean_value(p)) {
sink(*p); // $ external=int
}
}
{
if(is_clean_pointer(p)) {
sink(p); // $ external=int*
}
}
{
if(is_clean_pointer(&x)) {
sink(x); // $ external=glval<int>
}
}
}

13
cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.ext.yml Normal file
View File

@@ -0,0 +1,13 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: barrierModel
data:
- ["", "", False, "get_clean_pointer", "", "", "ReturnValue", "test-barrier", "manual"]
- ["", "", False, "get_clean_data", "", "", "ReturnValue[*]", "test-barrier", "manual"]
- addsTo:
pack: codeql/cpp-all
extensible: barrierGuardModel
data:
- ["", "", False, "is_clean_value", "", "", "Argument[*0]", "true", "test-barrier", "manual"]
- ["", "", False, "is_clean_pointer", "", "", "Argument[0]", "true", "test-barrier", "manual"]

38
cpp/ql/test/library-tests/dataflow/ir-barrier-guards/test.ql
View File

@@ -2,6 +2,7 @@ import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.controlflow.IRGuards
import utils.test.InlineExpectationsTest
import semmle.code.cpp.dataflow.ExternalFlow
predicate instructionGuardChecks(IRGuardCondition gc, Instruction checked, boolean branch) {
exists(CallInstruction call |
@@ -13,26 +14,41 @@ predicate instructionGuardChecks(IRGuardCondition gc, Instruction checked, boole
module BarrierGuard = DataFlow::InstructionBarrierGuard<instructionGuardChecks/3>;
predicate indirectBarrierGuard(DataFlow::Node node, int indirectionIndex) {
node = BarrierGuard::getAnIndirectBarrierNode(indirectionIndex)
predicate indirectBarrierGuard(DataFlow::Node node, string s) {
node = BarrierGuard::getAnIndirectBarrierNode(_) and
if node.isGLValue()
then s = "glval<" + node.getType().toString().replaceAll(" ", "") + ">"
else s = node.getType().toString().replaceAll(" ", "")
}
predicate barrierGuard(DataFlow::Node node) { node = BarrierGuard::getABarrierNode() }
predicate barrierGuard(DataFlow::Node node, string s) {
node = BarrierGuard::getABarrierNode() and
if node.isGLValue()
then s = "glval<" + node.getType().toString().replaceAll(" ", "") + ">"
else s = node.getType().toString().replaceAll(" ", "")
}
predicate externalBarrierGuard(DataFlow::Node node, string s) {
barrierNode(node, "test-barrier") and
if node.isGLValue()
then s = "glval<" + node.getType().toString().replaceAll(" ", "") + ">"
else s = node.getType().toString().replaceAll(" ", "")
}
module Test implements TestSig {
string getARelevantTag() { result = "barrier" }
string getARelevantTag() { result = ["barrier", "indirect_barrier", "external"] }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(DataFlow::Node node |
barrierGuard(node) and
value = ""
indirectBarrierGuard(node, value) and
tag = "indirect_barrier"
or
exists(int indirectionIndex |
indirectBarrierGuard(node, indirectionIndex) and
value = indirectionIndex.toString()
)
barrierGuard(node, value) and
tag = "barrier"
or
externalBarrierGuard(node, value) and
tag = "external"
|
tag = "barrier" and
element = node.toString() and
location = node.getLocation()
)

5
cpp/ql/test/library-tests/friends/loop/friends.expected
View File

@@ -1,9 +1,14 @@
| file://:0:0:0:0 | E<C>'s friend | loop.cpp:5:26:5:26 | E<D> |
| file://:0:0:0:0 | E<C>'s friend | loop.cpp:5:26:5:26 | E<T> |
| file://:0:0:0:0 | E<C>'s friend | loop.cpp:10:26:10:26 | F<D> |
| file://:0:0:0:0 | E<C>'s friend | loop.cpp:10:26:10:26 | F<T> |
| file://:0:0:0:0 | E<D>'s friend | loop.cpp:5:26:5:26 | E<C> |
| file://:0:0:0:0 | E<D>'s friend | loop.cpp:5:26:5:26 | E<T> |
| file://:0:0:0:0 | E<D>'s friend | loop.cpp:10:26:10:26 | F<D> |
| file://:0:0:0:0 | E<D>'s friend | loop.cpp:10:26:10:26 | F<T> |
| file://:0:0:0:0 | F<D>'s friend | loop.cpp:5:26:5:26 | E<C> |
| file://:0:0:0:0 | F<D>'s friend | loop.cpp:5:26:5:26 | E<D> |
| file://:0:0:0:0 | F<D>'s friend | loop.cpp:5:26:5:26 | E<T> |
| loop.cpp:6:5:6:5 | E<T>'s friend | loop.cpp:5:26:5:26 | E<T> |
| loop.cpp:7:5:7:5 | E<T>'s friend | loop.cpp:7:36:7:36 | F<U> |
| loop.cpp:11:5:11:5 | F<T>'s friend | loop.cpp:11:36:11:36 | E<U> |

2
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -24309,7 +24309,7 @@ ir.cpp:
# 2727| getArrayBase(): [VariableAccess] x
# 2727| Type = [SpecifiedType] const WithBracketOperator
# 2727| ValueCategory = lvalue
# 2727| getArrayOffset(): [VariableAccess] i
# 2727| getArrayOffset(0): [VariableAccess] i
# 2727| Type = [IntType] int
# 2727| ValueCategory = prvalue(load)
# 2727| getExpr().getFullyConverted(): [ReferenceDereferenceExpr] (reference dereference)

2
cpp/ql/test/library-tests/literals/literals/literals.c
View File

@@ -1,6 +1,4 @@
double dd = 1.0d;
double dD = 1.0D;
double df = 1.0f;
double dF = 1.0F;
double di = 1.0i;

10
cpp/ql/test/library-tests/literals/literals/literals.expected
View File

@@ -1,14 +1,12 @@
| literals.c:2:13:2:16 | 1.0 |
| literals.c:3:13:3:16 | 1.0 |
| literals.c:4:13:4:16 | 1.0 |
| literals.c:5:13:5:16 | 1.0 |
| literals.c:4:13:4:16 | (0.0,1.0i) |
| literals.c:5:13:5:16 | (0.0,1.0i) |
| literals.c:6:13:6:16 | (0.0,1.0i) |
| literals.c:7:13:7:16 | (0.0,1.0i) |
| literals.c:8:13:8:16 | (0.0,1.0i) |
| literals.c:9:13:9:16 | (0.0,1.0i) |
| literals.c:8:13:8:16 | 1.0 |
| literals.c:9:13:9:16 | 1.0 |
| literals.c:10:13:10:16 | 1.0 |
| literals.c:11:13:11:16 | 1.0 |
| literals.c:12:13:12:16 | 1.0 |
| literals.c:13:13:13:16 | 1.0 |
| literals.c:14:13:14:16 | 1.0 |
| literals.c:15:13:15:16 | 1.0 |

1285
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected
View File

File diff suppressed because it is too large Load Diff

6900
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/nrOfBounds.expected
View File

File diff suppressed because it is too large Load Diff

295
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryLower.expected
View File

@@ -1,148 +1,153 @@
| test.c:154:10:154:40 | ... ? ... : ... | -1.0 | 1.0 | -1.0 |
| test.c:367:8:367:23 | ... ? ... : ... | 0.0 | 0.0 | 10.0 |
| test.c:368:8:368:24 | ... ? ... : ... | 0.0 | 10.0 | 0.0 |
| test.c:376:10:376:15 | ... ? ... : ... | 0.0 | 0.0 | 5.0 |
| test.c:377:10:377:17 | ... ? ... : ... | 0.0 | 0.0 | 500.0 |
| test.c:378:10:378:21 | ... ? ... : ... | 1.0 | 1.0 | 500.0 |
| test.c:379:10:379:36 | ... ? ... : ... | 0.0 | 1.0 | 5.0 |
| test.c:380:10:380:38 | ... ? ... : ... | 0.0 | 1.0 | 500.0 |
| test.c:381:10:381:39 | ... ? ... : ... | 1.0 | 1.0 | 500.0 |
| test.c:389:8:389:24 | ... ? ... : ... | 101.0 | 101.0 | 110.0 |
| test.c:390:8:390:25 | ... ? ... : ... | 101.0 | 110.0 | 101.0 |
| test.c:395:10:395:21 | ... ? ... : ... | 0.0 | 0.0 | 5.0 |
| test.c:396:10:396:21 | ... ? ... : ... | 100.0 | 100.0 | 5.0 |
| test.c:397:10:397:38 | ... ? ... : ... | 0.0 | 100.0 | 5.0 |
| test.c:404:14:404:108 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.40496805 |
| test.c:404:18:404:95 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.21540225 |
| test.c:404:22:404:82 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.39206458 |
| test.c:404:26:404:69 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.35279203 |
| test.c:404:30:404:56 | ... ? ... : ... | 0.14333887 | 0.47438827 | 0.14333887 |
| test.c:405:14:405:108 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.5297741 |
| test.c:405:18:405:95 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.59270465 |
| test.c:405:22:405:82 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.32661893 |
| test.c:405:26:405:69 | ... ? ... : ... | 0.22247853 | 0.34183348 | 0.22247853 |
| test.c:405:30:405:56 | ... ? ... : ... | 0.34183348 | 0.34183348 | 0.3533464 |
| test.c:406:14:406:108 | ... ? ... : ... | 0.05121256 | 0.05121256 | 0.67981451 |
| test.c:406:18:406:95 | ... ? ... : ... | 0.05121256 | 0.05121256 | 0.79310745 |
| test.c:406:22:406:82 | ... ? ... : ... | 0.05121256 | 0.31235514 | 0.05121256 |
| test.c:406:26:406:69 | ... ? ... : ... | 0.31235514 | 0.31478084 | 0.31235514 |
| test.c:406:30:406:56 | ... ? ... : ... | 0.31478084 | 0.77429603 | 0.31478084 |
| test.c:407:14:407:108 | ... ? ... : ... | 0.36976948 | 0.36976948 | 0.83866835 |
| test.c:407:18:407:95 | ... ? ... : ... | 0.36976948 | 0.44729556 | 0.36976948 |
| test.c:407:22:407:82 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.59952732 |
| test.c:407:26:407:69 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.98997262 |
| test.c:407:30:407:56 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.80599202 |
| test.c:408:14:408:108 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.68734874 |
| test.c:408:18:408:95 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.72485966 |
| test.c:408:22:408:82 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.21778426 |
| test.c:408:26:408:69 | ... ? ... : ... | 0.10597712 | 0.49311828 | 0.10597712 |
| test.c:408:30:408:56 | ... ? ... : ... | 0.49311828 | 0.49311828 | 0.90389911 |
| test.c:409:14:409:108 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.58440865 |
| test.c:409:18:409:95 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.34808892 |
| test.c:409:22:409:82 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.76164052 |
| test.c:409:26:409:69 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.11884576 |
| test.c:409:30:409:56 | ... ? ... : ... | 0.1078665 | 0.47452848 | 0.1078665 |
| test.c:410:14:410:108 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.36232384 |
| test.c:410:18:410:95 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.85235179 |
| test.c:410:22:410:82 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.12516558 |
| test.c:410:26:410:69 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.95823075 |
| test.c:410:30:410:56 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.82905046 |
| test.c:411:14:411:108 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.84331272 |
| test.c:411:18:411:95 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.48640909 |
| test.c:411:22:411:82 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.45041108 |
| test.c:411:26:411:69 | ... ? ... : ... | 0.14963485 | 0.32876044 | 0.14963485 |
| test.c:411:30:411:56 | ... ? ... : ... | 0.32876044 | 0.38708626 | 0.32876044 |
| test.c:412:14:412:108 | ... ? ... : ... | 0.05328182 | 0.14800508 | 0.05328182 |
| test.c:412:18:412:95 | ... ? ... : ... | 0.14800508 | 0.14800508 | 0.37428143 |
| test.c:412:22:412:82 | ... ? ... : ... | 0.14800508 | 0.15755063 | 0.14800508 |
| test.c:412:26:412:69 | ... ? ... : ... | 0.15755063 | 0.15755063 | 0.26428481 |
| test.c:412:30:412:56 | ... ? ... : ... | 0.15755063 | 0.15755063 | 0.77086833 |
| test.c:413:14:413:108 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.69072144 |
| test.c:413:18:413:95 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.39468857 |
| test.c:413:22:413:82 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.55679274 |
| test.c:413:26:413:69 | ... ? ... : ... | 0.27643238 | 0.41736536 | 0.27643238 |
| test.c:413:30:413:56 | ... ? ... : ... | 0.41736536 | 0.41736536 | 0.76826628 |
| test.c:414:14:414:108 | ... ? ... : ... | 0.2051911 | 0.2051911 | 0.81372798 |
| test.c:414:18:414:95 | ... ? ... : ... | 0.2051911 | 0.2051911 | 0.88745559 |
| test.c:414:22:414:82 | ... ? ... : ... | 0.2051911 | 0.29904824 | 0.2051911 |
| test.c:414:26:414:69 | ... ? ... : ... | 0.29904824 | 0.29904824 | 0.76242583 |
| test.c:414:30:414:56 | ... ? ... : ... | 0.29904824 | 0.88955345 | 0.29904824 |
| test.c:415:14:415:108 | ... ? ... : ... | 0.13204114 | 0.13204114 | 0.42762647 |
| test.c:415:18:415:95 | ... ? ... : ... | 0.13204114 | 0.13204114 | 0.52031241 |
| test.c:415:22:415:82 | ... ? ... : ... | 0.13204114 | 0.42186276 | 0.13204114 |
| test.c:415:26:415:69 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.44996679 |
| test.c:415:30:415:56 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.53843358 |
| test.c:457:4:631:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:457:5:459:49 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:460:6:542:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:461:8:479:41 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:464:10:468:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:464:31:464:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:466:13:468:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:473:12:478:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:474:12:474:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:476:15:478:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:480:6:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:483:8:487:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:483:29:483:77 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:485:11:487:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:488:6:488:54 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:492:10:496:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:492:31:492:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:494:13:496:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:497:9:499:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:501:10:520:43 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:504:12:509:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:505:12:505:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:507:15:509:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:514:14:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:515:14:515:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:517:17:519:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:521:9:542:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:524:14:529:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:525:14:525:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:527:17:529:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:530:12:530:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:534:12:539:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:535:12:535:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:537:15:539:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:540:11:542:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:543:9:545:51 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:546:9:631:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:547:14:566:47 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:550:16:555:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:551:16:551:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:553:19:555:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:560:18:565:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:561:18:561:66 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:563:21:565:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:567:12:588:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:570:14:575:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:571:14:571:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:573:17:575:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:576:12:576:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:580:16:585:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:581:16:581:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:583:19:585:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:586:15:588:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:590:12:609:45 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:593:14:598:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:594:14:594:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:596:17:598:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:603:16:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:604:16:604:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:606:19:608:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:610:11:631:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:613:16:618:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:614:16:614:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:616:19:618:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:619:14:619:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:623:14:628:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:624:14:624:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:626:17:628:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:629:13:631:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:657:20:657:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
| test.c:869:5:869:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
| test.c:870:5:870:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
| test.c:348:22:348:44 | ... ? ... : ... | 0.0 | 0.0 | 2.0 |
| test.c:349:20:349:43 | ... ? ... : ... | 0.0 | 0.0 | 2.0 |
| test.c:350:22:350:44 | ... ? ... : ... | 0.0 | 0.0 | 2.0 |
| test.c:351:22:351:44 | ... ? ... : ... | 0.0 | 0.0 | 2.0 |
| test.c:352:22:352:45 | ... ? ... : ... | 2.0 | 8.0 | 2.0 |
| test.c:378:8:378:23 | ... ? ... : ... | 0.0 | 0.0 | 10.0 |
| test.c:379:8:379:24 | ... ? ... : ... | 0.0 | 10.0 | 0.0 |
| test.c:387:10:387:15 | ... ? ... : ... | 0.0 | 0.0 | 5.0 |
| test.c:388:10:388:17 | ... ? ... : ... | 0.0 | 0.0 | 500.0 |
| test.c:389:10:389:21 | ... ? ... : ... | 1.0 | 1.0 | 500.0 |
| test.c:390:10:390:36 | ... ? ... : ... | 0.0 | 1.0 | 5.0 |
| test.c:391:10:391:38 | ... ? ... : ... | 0.0 | 1.0 | 500.0 |
| test.c:392:10:392:39 | ... ? ... : ... | 1.0 | 1.0 | 500.0 |
| test.c:400:8:400:24 | ... ? ... : ... | 101.0 | 101.0 | 110.0 |
| test.c:401:8:401:25 | ... ? ... : ... | 101.0 | 110.0 | 101.0 |
| test.c:406:10:406:21 | ... ? ... : ... | 0.0 | 0.0 | 5.0 |
| test.c:407:10:407:21 | ... ? ... : ... | 100.0 | 100.0 | 5.0 |
| test.c:408:10:408:38 | ... ? ... : ... | 0.0 | 100.0 | 5.0 |
| test.c:415:14:415:108 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.40496805 |
| test.c:415:18:415:95 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.21540225 |
| test.c:415:22:415:82 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.39206458 |
| test.c:415:26:415:69 | ... ? ... : ... | 0.14333887 | 0.14333887 | 0.35279203 |
| test.c:415:30:415:56 | ... ? ... : ... | 0.14333887 | 0.47438827 | 0.14333887 |
| test.c:416:14:416:108 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.5297741 |
| test.c:416:18:416:95 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.59270465 |
| test.c:416:22:416:82 | ... ? ... : ... | 0.22247853 | 0.22247853 | 0.32661893 |
| test.c:416:26:416:69 | ... ? ... : ... | 0.22247853 | 0.34183348 | 0.22247853 |
| test.c:416:30:416:56 | ... ? ... : ... | 0.34183348 | 0.34183348 | 0.3533464 |
| test.c:417:14:417:108 | ... ? ... : ... | 0.05121256 | 0.05121256 | 0.67981451 |
| test.c:417:18:417:95 | ... ? ... : ... | 0.05121256 | 0.05121256 | 0.79310745 |
| test.c:417:22:417:82 | ... ? ... : ... | 0.05121256 | 0.31235514 | 0.05121256 |
| test.c:417:26:417:69 | ... ? ... : ... | 0.31235514 | 0.31478084 | 0.31235514 |
| test.c:417:30:417:56 | ... ? ... : ... | 0.31478084 | 0.77429603 | 0.31478084 |
| test.c:418:14:418:108 | ... ? ... : ... | 0.36976948 | 0.36976948 | 0.83866835 |
| test.c:418:18:418:95 | ... ? ... : ... | 0.36976948 | 0.44729556 | 0.36976948 |
| test.c:418:22:418:82 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.59952732 |
| test.c:418:26:418:69 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.98997262 |
| test.c:418:30:418:56 | ... ? ... : ... | 0.44729556 | 0.44729556 | 0.80599202 |
| test.c:419:14:419:108 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.68734874 |
| test.c:419:18:419:95 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.72485966 |
| test.c:419:22:419:82 | ... ? ... : ... | 0.10597712 | 0.10597712 | 0.21778426 |
| test.c:419:26:419:69 | ... ? ... : ... | 0.10597712 | 0.49311828 | 0.10597712 |
| test.c:419:30:419:56 | ... ? ... : ... | 0.49311828 | 0.49311828 | 0.90389911 |
| test.c:420:14:420:108 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.58440865 |
| test.c:420:18:420:95 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.34808892 |
| test.c:420:22:420:82 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.76164052 |
| test.c:420:26:420:69 | ... ? ... : ... | 0.1078665 | 0.1078665 | 0.11884576 |
| test.c:420:30:420:56 | ... ? ... : ... | 0.1078665 | 0.47452848 | 0.1078665 |
| test.c:421:14:421:108 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.36232384 |
| test.c:421:18:421:95 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.85235179 |
| test.c:421:22:421:82 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.12516558 |
| test.c:421:26:421:69 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.95823075 |
| test.c:421:30:421:56 | ... ? ... : ... | 0.02524326 | 0.02524326 | 0.82905046 |
| test.c:422:14:422:108 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.84331272 |
| test.c:422:18:422:95 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.48640909 |
| test.c:422:22:422:82 | ... ? ... : ... | 0.14963485 | 0.14963485 | 0.45041108 |
| test.c:422:26:422:69 | ... ? ... : ... | 0.14963485 | 0.32876044 | 0.14963485 |
| test.c:422:30:422:56 | ... ? ... : ... | 0.32876044 | 0.38708626 | 0.32876044 |
| test.c:423:14:423:108 | ... ? ... : ... | 0.05328182 | 0.14800508 | 0.05328182 |
| test.c:423:18:423:95 | ... ? ... : ... | 0.14800508 | 0.14800508 | 0.37428143 |
| test.c:423:22:423:82 | ... ? ... : ... | 0.14800508 | 0.15755063 | 0.14800508 |
| test.c:423:26:423:69 | ... ? ... : ... | 0.15755063 | 0.15755063 | 0.26428481 |
| test.c:423:30:423:56 | ... ? ... : ... | 0.15755063 | 0.15755063 | 0.77086833 |
| test.c:424:14:424:108 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.69072144 |
| test.c:424:18:424:95 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.39468857 |
| test.c:424:22:424:82 | ... ? ... : ... | 0.27643238 | 0.27643238 | 0.55679274 |
| test.c:424:26:424:69 | ... ? ... : ... | 0.27643238 | 0.41736536 | 0.27643238 |
| test.c:424:30:424:56 | ... ? ... : ... | 0.41736536 | 0.41736536 | 0.76826628 |
| test.c:425:14:425:108 | ... ? ... : ... | 0.2051911 | 0.2051911 | 0.81372798 |
| test.c:425:18:425:95 | ... ? ... : ... | 0.2051911 | 0.2051911 | 0.88745559 |
| test.c:425:22:425:82 | ... ? ... : ... | 0.2051911 | 0.29904824 | 0.2051911 |
| test.c:425:26:425:69 | ... ? ... : ... | 0.29904824 | 0.29904824 | 0.76242583 |
| test.c:425:30:425:56 | ... ? ... : ... | 0.29904824 | 0.88955345 | 0.29904824 |
| test.c:426:14:426:108 | ... ? ... : ... | 0.13204114 | 0.13204114 | 0.42762647 |
| test.c:426:18:426:95 | ... ? ... : ... | 0.13204114 | 0.13204114 | 0.52031241 |
| test.c:426:22:426:82 | ... ? ... : ... | 0.13204114 | 0.42186276 | 0.13204114 |
| test.c:426:26:426:69 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.44996679 |
| test.c:426:30:426:56 | ... ? ... : ... | 0.42186276 | 0.42186276 | 0.53843358 |
| test.c:468:4:642:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:468:5:470:49 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:471:6:553:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:472:8:490:41 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:475:10:479:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:475:31:475:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:477:13:479:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:484:12:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:485:12:485:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:487:15:489:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:491:6:510:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:494:8:498:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:494:29:494:77 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:496:11:498:19 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:499:6:499:54 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:503:10:507:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:503:31:503:79 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:505:13:507:21 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:508:9:510:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:512:10:531:43 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:515:12:520:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:516:12:516:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:518:15:520:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:525:14:530:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:526:14:526:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:528:17:530:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:532:9:553:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:535:14:540:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:536:14:536:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:538:17:540:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:541:12:541:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:545:12:550:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:546:12:546:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:548:15:550:23 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:551:11:553:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:554:9:556:51 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:557:9:642:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:558:14:577:47 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:561:16:566:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:562:16:562:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:564:19:566:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:571:18:576:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:572:18:572:66 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:574:21:576:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:578:12:599:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:581:14:586:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:582:14:582:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:584:17:586:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:587:12:587:60 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:591:16:596:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:592:16:592:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:594:19:596:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:597:15:599:29 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:601:12:620:45 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:604:14:609:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:605:14:605:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:607:17:609:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:614:16:619:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:615:16:615:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:617:19:619:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:621:11:642:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:624:16:629:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:625:16:625:64 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:627:19:629:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:630:14:630:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:634:14:639:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:635:14:635:62 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:637:17:639:25 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:640:13:642:27 | ... ? ... : ... | 0.0 | 0.0 | 0.0 |
| test.c:668:20:668:36 | ... ? ... : ... | 0.0 | 0.0 | 100.0 |
| test.c:880:5:880:14 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
| test.c:881:5:881:14 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |
| test.cpp:121:3:121:12 | ... ? ... : ... | 0.0 | 1.0 | 0.0 |
| test.cpp:122:3:122:12 | ... ? ... : ... | 0.0 | 0.0 | 1.0 |

295
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/ternaryUpper.expected
View File

@@ -1,148 +1,153 @@
| test.c:154:10:154:40 | ... ? ... : ... | 2.147483647E9 | 2.147483647E9 | -1.0 |
| test.c:367:8:367:23 | ... ? ... : ... | 99.0 | 99.0 | 10.0 |
| test.c:368:8:368:24 | ... ? ... : ... | 99.0 | 10.0 | 99.0 |
| test.c:376:10:376:15 | ... ? ... : ... | 299.0 | 299.0 | 5.0 |
| test.c:377:10:377:17 | ... ? ... : ... | 500.0 | 299.0 | 500.0 |
| test.c:378:10:378:21 | ... ? ... : ... | 300.0 | 300.0 | 500.0 |
| test.c:379:10:379:36 | ... ? ... : ... | 255.0 | 300.0 | 5.0 |
| test.c:380:10:380:38 | ... ? ... : ... | 500.0 | 300.0 | 500.0 |
| test.c:381:10:381:39 | ... ? ... : ... | 300.0 | 300.0 | 500.0 |
| test.c:389:8:389:24 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 110.0 |
| test.c:390:8:390:25 | ... ? ... : ... | 4.294967295E9 | 110.0 | 4.294967295E9 |
| test.c:395:10:395:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 5.0 |
| test.c:396:10:396:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 5.0 |
| test.c:397:10:397:38 | ... ? ... : ... | 255.0 | 4.294967295E9 | 5.0 |
| test.c:404:14:404:108 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.40496805 |
| test.c:404:18:404:95 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.21540225 |
| test.c:404:22:404:82 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.39206458 |
| test.c:404:26:404:69 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.35279203 |
| test.c:404:30:404:56 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.14333887 |
| test.c:405:14:405:108 | ... ? ... : ... | 0.59270465 | 0.59270465 | 0.5297741 |
| test.c:405:18:405:95 | ... ? ... : ... | 0.59270465 | 0.3533464 | 0.59270465 |
| test.c:405:22:405:82 | ... ? ... : ... | 0.3533464 | 0.3533464 | 0.32661893 |
| test.c:405:26:405:69 | ... ? ... : ... | 0.3533464 | 0.3533464 | 0.22247853 |
| test.c:405:30:405:56 | ... ? ... : ... | 0.3533464 | 0.34183348 | 0.3533464 |
| test.c:406:14:406:108 | ... ? ... : ... | 0.79310745 | 0.79310745 | 0.67981451 |
| test.c:406:18:406:95 | ... ? ... : ... | 0.79310745 | 0.77429603 | 0.79310745 |
| test.c:406:22:406:82 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.05121256 |
| test.c:406:26:406:69 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.31235514 |
| test.c:406:30:406:56 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.31478084 |
| test.c:407:14:407:108 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.83866835 |
| test.c:407:18:407:95 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.36976948 |
| test.c:407:22:407:82 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.59952732 |
| test.c:407:26:407:69 | ... ? ... : ... | 0.98997262 | 0.80599202 | 0.98997262 |
| test.c:407:30:407:56 | ... ? ... : ... | 0.80599202 | 0.44729556 | 0.80599202 |
| test.c:408:14:408:108 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.68734874 |
| test.c:408:18:408:95 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.72485966 |
| test.c:408:22:408:82 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.21778426 |
| test.c:408:26:408:69 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.10597712 |
| test.c:408:30:408:56 | ... ? ... : ... | 0.90389911 | 0.49311828 | 0.90389911 |
| test.c:409:14:409:108 | ... ? ... : ... | 0.76164052 | 0.76164052 | 0.58440865 |
| test.c:409:18:409:95 | ... ? ... : ... | 0.76164052 | 0.76164052 | 0.34808892 |
| test.c:409:22:409:82 | ... ? ... : ... | 0.76164052 | 0.47452848 | 0.76164052 |
| test.c:409:26:409:69 | ... ? ... : ... | 0.47452848 | 0.47452848 | 0.11884576 |
| test.c:409:30:409:56 | ... ? ... : ... | 0.47452848 | 0.47452848 | 0.1078665 |
| test.c:410:14:410:108 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.36232384 |
| test.c:410:18:410:95 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.85235179 |
| test.c:410:22:410:82 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.12516558 |
| test.c:410:26:410:69 | ... ? ... : ... | 0.95823075 | 0.82905046 | 0.95823075 |
| test.c:410:30:410:56 | ... ? ... : ... | 0.82905046 | 0.02524326 | 0.82905046 |
| test.c:411:14:411:108 | ... ? ... : ... | 0.84331272 | 0.48640909 | 0.84331272 |
| test.c:411:18:411:95 | ... ? ... : ... | 0.48640909 | 0.45041108 | 0.48640909 |
| test.c:411:22:411:82 | ... ? ... : ... | 0.45041108 | 0.38708626 | 0.45041108 |
| test.c:411:26:411:69 | ... ? ... : ... | 0.38708626 | 0.38708626 | 0.14963485 |
| test.c:411:30:411:56 | ... ? ... : ... | 0.38708626 | 0.38708626 | 0.32876044 |
| test.c:412:14:412:108 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.05328182 |
| test.c:412:18:412:95 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.37428143 |
| test.c:412:22:412:82 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.14800508 |
| test.c:412:26:412:69 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.26428481 |
| test.c:412:30:412:56 | ... ? ... : ... | 0.77086833 | 0.15755063 | 0.77086833 |
| test.c:413:14:413:108 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.69072144 |
| test.c:413:18:413:95 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.39468857 |
| test.c:413:22:413:82 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.55679274 |
| test.c:413:26:413:69 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.27643238 |
| test.c:413:30:413:56 | ... ? ... : ... | 0.76826628 | 0.41736536 | 0.76826628 |
| test.c:414:14:414:108 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.81372798 |
| test.c:414:18:414:95 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.88745559 |
| test.c:414:22:414:82 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.2051911 |
| test.c:414:26:414:69 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.76242583 |
| test.c:414:30:414:56 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.29904824 |
| test.c:415:14:415:108 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.42762647 |
| test.c:415:18:415:95 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.52031241 |
| test.c:415:22:415:82 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.13204114 |
| test.c:415:26:415:69 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.44996679 |
| test.c:415:30:415:56 | ... ? ... : ... | 0.53843358 | 0.42186276 | 0.53843358 |
| test.c:457:4:631:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:457:5:459:49 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:460:6:542:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:461:8:479:41 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:464:10:468:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:464:31:464:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:466:13:468:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:473:12:478:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:474:12:474:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:476:15:478:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:480:6:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:483:8:487:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:483:29:483:77 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:485:11:487:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:488:6:488:54 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:492:10:496:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:492:31:492:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:494:13:496:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:497:9:499:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:501:10:520:43 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:504:12:509:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:505:12:505:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:507:15:509:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:514:14:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:515:14:515:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:517:17:519:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:521:9:542:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:524:14:529:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:525:14:525:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:527:17:529:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:530:12:530:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:534:12:539:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:535:12:535:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:537:15:539:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:540:11:542:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:543:9:545:51 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:546:9:631:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:547:14:566:47 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:550:16:555:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:551:16:551:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:553:19:555:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:560:18:565:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:561:18:561:66 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:563:21:565:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:567:12:588:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:570:14:575:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:571:14:571:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:573:17:575:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:576:12:576:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:580:16:585:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:581:16:581:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:583:19:585:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:586:15:588:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:590:12:609:45 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:593:14:598:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:594:14:594:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:596:17:598:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:603:16:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:604:16:604:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:606:19:608:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:610:11:631:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:613:16:618:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:614:16:614:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:616:19:618:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:619:14:619:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:623:14:628:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:624:14:624:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:626:17:628:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:629:13:631:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:657:20:657:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
| test.c:869:5:869:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
| test.c:870:5:870:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
| test.c:348:22:348:44 | ... ? ... : ... | 2.147483647E9 | 2.147483647E9 | 2.0 |
| test.c:349:20:349:43 | ... ? ... : ... | 2.147483647E9 | 2.147483647E9 | 2.0 |
| test.c:350:22:350:44 | ... ? ... : ... | 1.431655764E9 | 1.431655764E9 | 2.0 |
| test.c:351:22:351:44 | ... ? ... : ... | 2.147483647E9 | 2.147483647E9 | 2.0 |
| test.c:352:22:352:45 | ... ? ... : ... | 2.147483647E9 | 2.147483647E9 | 2.0 |
| test.c:378:8:378:23 | ... ? ... : ... | 99.0 | 99.0 | 10.0 |
| test.c:379:8:379:24 | ... ? ... : ... | 99.0 | 10.0 | 99.0 |
| test.c:387:10:387:15 | ... ? ... : ... | 299.0 | 299.0 | 5.0 |
| test.c:388:10:388:17 | ... ? ... : ... | 500.0 | 299.0 | 500.0 |
| test.c:389:10:389:21 | ... ? ... : ... | 300.0 | 300.0 | 500.0 |
| test.c:390:10:390:36 | ... ? ... : ... | 255.0 | 300.0 | 5.0 |
| test.c:391:10:391:38 | ... ? ... : ... | 500.0 | 300.0 | 500.0 |
| test.c:392:10:392:39 | ... ? ... : ... | 300.0 | 300.0 | 500.0 |
| test.c:400:8:400:24 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 110.0 |
| test.c:401:8:401:25 | ... ? ... : ... | 4.294967295E9 | 110.0 | 4.294967295E9 |
| test.c:406:10:406:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 5.0 |
| test.c:407:10:407:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 5.0 |
| test.c:408:10:408:38 | ... ? ... : ... | 255.0 | 4.294967295E9 | 5.0 |
| test.c:415:14:415:108 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.40496805 |
| test.c:415:18:415:95 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.21540225 |
| test.c:415:22:415:82 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.39206458 |
| test.c:415:26:415:69 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.35279203 |
| test.c:415:30:415:56 | ... ? ... : ... | 0.47438827 | 0.47438827 | 0.14333887 |
| test.c:416:14:416:108 | ... ? ... : ... | 0.59270465 | 0.59270465 | 0.5297741 |
| test.c:416:18:416:95 | ... ? ... : ... | 0.59270465 | 0.3533464 | 0.59270465 |
| test.c:416:22:416:82 | ... ? ... : ... | 0.3533464 | 0.3533464 | 0.32661893 |
| test.c:416:26:416:69 | ... ? ... : ... | 0.3533464 | 0.3533464 | 0.22247853 |
| test.c:416:30:416:56 | ... ? ... : ... | 0.3533464 | 0.34183348 | 0.3533464 |
| test.c:417:14:417:108 | ... ? ... : ... | 0.79310745 | 0.79310745 | 0.67981451 |
| test.c:417:18:417:95 | ... ? ... : ... | 0.79310745 | 0.77429603 | 0.79310745 |
| test.c:417:22:417:82 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.05121256 |
| test.c:417:26:417:69 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.31235514 |
| test.c:417:30:417:56 | ... ? ... : ... | 0.77429603 | 0.77429603 | 0.31478084 |
| test.c:418:14:418:108 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.83866835 |
| test.c:418:18:418:95 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.36976948 |
| test.c:418:22:418:82 | ... ? ... : ... | 0.98997262 | 0.98997262 | 0.59952732 |
| test.c:418:26:418:69 | ... ? ... : ... | 0.98997262 | 0.80599202 | 0.98997262 |
| test.c:418:30:418:56 | ... ? ... : ... | 0.80599202 | 0.44729556 | 0.80599202 |
| test.c:419:14:419:108 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.68734874 |
| test.c:419:18:419:95 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.72485966 |
| test.c:419:22:419:82 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.21778426 |
| test.c:419:26:419:69 | ... ? ... : ... | 0.90389911 | 0.90389911 | 0.10597712 |
| test.c:419:30:419:56 | ... ? ... : ... | 0.90389911 | 0.49311828 | 0.90389911 |
| test.c:420:14:420:108 | ... ? ... : ... | 0.76164052 | 0.76164052 | 0.58440865 |
| test.c:420:18:420:95 | ... ? ... : ... | 0.76164052 | 0.76164052 | 0.34808892 |
| test.c:420:22:420:82 | ... ? ... : ... | 0.76164052 | 0.47452848 | 0.76164052 |
| test.c:420:26:420:69 | ... ? ... : ... | 0.47452848 | 0.47452848 | 0.11884576 |
| test.c:420:30:420:56 | ... ? ... : ... | 0.47452848 | 0.47452848 | 0.1078665 |
| test.c:421:14:421:108 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.36232384 |
| test.c:421:18:421:95 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.85235179 |
| test.c:421:22:421:82 | ... ? ... : ... | 0.95823075 | 0.95823075 | 0.12516558 |
| test.c:421:26:421:69 | ... ? ... : ... | 0.95823075 | 0.82905046 | 0.95823075 |
| test.c:421:30:421:56 | ... ? ... : ... | 0.82905046 | 0.02524326 | 0.82905046 |
| test.c:422:14:422:108 | ... ? ... : ... | 0.84331272 | 0.48640909 | 0.84331272 |
| test.c:422:18:422:95 | ... ? ... : ... | 0.48640909 | 0.45041108 | 0.48640909 |
| test.c:422:22:422:82 | ... ? ... : ... | 0.45041108 | 0.38708626 | 0.45041108 |
| test.c:422:26:422:69 | ... ? ... : ... | 0.38708626 | 0.38708626 | 0.14963485 |
| test.c:422:30:422:56 | ... ? ... : ... | 0.38708626 | 0.38708626 | 0.32876044 |
| test.c:423:14:423:108 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.05328182 |
| test.c:423:18:423:95 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.37428143 |
| test.c:423:22:423:82 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.14800508 |
| test.c:423:26:423:69 | ... ? ... : ... | 0.77086833 | 0.77086833 | 0.26428481 |
| test.c:423:30:423:56 | ... ? ... : ... | 0.77086833 | 0.15755063 | 0.77086833 |
| test.c:424:14:424:108 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.69072144 |
| test.c:424:18:424:95 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.39468857 |
| test.c:424:22:424:82 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.55679274 |
| test.c:424:26:424:69 | ... ? ... : ... | 0.76826628 | 0.76826628 | 0.27643238 |
| test.c:424:30:424:56 | ... ? ... : ... | 0.76826628 | 0.41736536 | 0.76826628 |
| test.c:425:14:425:108 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.81372798 |
| test.c:425:18:425:95 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.88745559 |
| test.c:425:22:425:82 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.2051911 |
| test.c:425:26:425:69 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.76242583 |
| test.c:425:30:425:56 | ... ? ... : ... | 0.88955345 | 0.88955345 | 0.29904824 |
| test.c:426:14:426:108 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.42762647 |
| test.c:426:18:426:95 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.52031241 |
| test.c:426:22:426:82 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.13204114 |
| test.c:426:26:426:69 | ... ? ... : ... | 0.53843358 | 0.53843358 | 0.44996679 |
| test.c:426:30:426:56 | ... ? ... : ... | 0.53843358 | 0.42186276 | 0.53843358 |
| test.c:468:4:642:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:468:5:470:49 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:471:6:553:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:472:8:490:41 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:475:10:479:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:475:31:475:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:477:13:479:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:484:12:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:485:12:485:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:487:15:489:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:491:6:510:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:494:8:498:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:494:29:494:77 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:496:11:498:19 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:499:6:499:54 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:503:10:507:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:503:31:503:79 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:505:13:507:21 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:508:9:510:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:512:10:531:43 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:515:12:520:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:516:12:516:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:518:15:520:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:525:14:530:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:526:14:526:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:528:17:530:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:532:9:553:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:535:14:540:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:536:14:536:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:538:17:540:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:541:12:541:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:545:12:550:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:546:12:546:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:548:15:550:23 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:551:11:553:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:554:9:556:51 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:557:9:642:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:558:14:577:47 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:561:16:566:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:562:16:562:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:564:19:566:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:571:18:576:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:572:18:572:66 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:574:21:576:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:578:12:599:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:581:14:586:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:582:14:582:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:584:17:586:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:587:12:587:60 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:591:16:596:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:592:16:592:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:594:19:596:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:597:15:599:29 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:601:12:620:45 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:604:14:609:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:605:14:605:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:607:17:609:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:614:16:619:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:615:16:615:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:617:19:619:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:621:11:642:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:624:16:629:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:625:16:625:64 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:627:19:629:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:630:14:630:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:634:14:639:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:635:14:635:62 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:637:17:639:25 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:640:13:642:27 | ... ? ... : ... | 4.294967295E9 | 4.294967295E9 | 4.294967295E9 |
| test.c:668:20:668:36 | ... ? ... : ... | 100.0 | 99.0 | 100.0 |
| test.c:880:5:880:14 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
| test.c:881:5:881:14 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |
| test.cpp:121:3:121:12 | ... ? ... : ... | 32767.0 | 32767.0 | 0.0 |
| test.cpp:122:3:122:12 | ... ? ... : ... | 32767.0 | 0.0 | 32767.0 |

11
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c
View File

@@ -343,6 +343,17 @@ unsigned long long test_shift(unsigned long long a) {
return shifted;
}
// Tests for bounds on integers derived from inequalities.
unsigned int test_inequality_integer(unsigned int e) {
unsigned int bi1 = (2 * e + 1) > 0 ? e : 2;
signed int bi2 = (2 * e + 1) >= 0 ? e : 2;
unsigned int bi3 = (3 * e + 2) > 0 ? e : 2;
unsigned int bi4 = (2 * e + 1) > 0 ? e : 2;
unsigned int bi5 = (2 * e + 1) > 16 ? e : 2;
return bi1 + bi2 + bi3 + bi4 + bi5;
}
int test16(int x) {
int d, i = 0;
if (x < 0) {

1283
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected
View File

File diff suppressed because it is too large Load Diff

69
cpp/ql/test/library-tests/subscript_operator/PrintAST.expected Normal file
View File

@@ -0,0 +1,69 @@
#-----| [CopyAssignmentOperator] __va_list_tag& __va_list_tag::operator=(__va_list_tag const&)
#-----| <params>:
#-----| getParameter(0): [Parameter] (unnamed parameter 0)
#-----| Type = [LValueReferenceType] const __va_list_tag &
#-----| [MoveAssignmentOperator] __va_list_tag& __va_list_tag::operator=(__va_list_tag&&)
#-----| <params>:
#-----| getParameter(0): [Parameter] (unnamed parameter 0)
#-----| Type = [RValueReferenceType] __va_list_tag &&
test.cpp:
# 3| [CopyAssignmentOperator] S& S::operator=(S const&)
# 3| <params>:
#-----| getParameter(0): [Parameter] (unnamed parameter 0)
#-----| Type = [LValueReferenceType] const S &
# 3| [MoveAssignmentOperator] S& S::operator=(S&&)
# 3| <params>:
#-----| getParameter(0): [Parameter] (unnamed parameter 0)
#-----| Type = [RValueReferenceType] S &&
# 5| [MemberFunction] int S::operator[](int, int)
# 5| <params>:
# 5| getParameter(0): [Parameter] i
# 5| Type = [IntType] int
# 5| getParameter(1): [Parameter] j
# 5| Type = [IntType] int
# 5| getEntryPoint(): [BlockStmt] { ... }
# 6| getStmt(0): [ReturnStmt] return ...
# 6| getExpr(): [ArrayExpr] access to array
# 6| Type = [IntType] int
# 6| ValueCategory = prvalue(load)
# 6| getArrayBase(): [ArrayExpr] access to array
# 6| Type = [ArrayType] int[2]
# 6| ValueCategory = lvalue
# 6| getArrayBase(): [ImplicitThisFieldAccess,PointerFieldAccess] xs
# 6| Type = [ArrayType] int[2][2]
# 6| ValueCategory = lvalue
# 6| getQualifier(): [ThisExpr] this
# 6| Type = [PointerType] S *
# 6| ValueCategory = prvalue(load)
# 6| getArrayOffset(): [VariableAccess] i
# 6| Type = [IntType] int
# 6| ValueCategory = prvalue(load)
#-----| getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
#-----| Type = [PointerType] int(*)[2]
#-----| ValueCategory = prvalue
# 6| getArrayOffset(): [VariableAccess] j
# 6| Type = [IntType] int
# 6| ValueCategory = prvalue(load)
# 6| getArrayBase().getFullyConverted(): [ArrayToPointerConversion] array to pointer conversion
# 6| Type = [IntPointerType] int *
# 6| ValueCategory = prvalue
# 10| [TopLevelFunction] int foo(S)
# 10| <params>:
# 10| getParameter(0): [Parameter] s
# 10| Type = [Struct] S
# 10| getEntryPoint(): [BlockStmt] { ... }
# 11| getStmt(0): [ReturnStmt] return ...
# 11| getExpr(): [OverloadedArrayExpr] call to operator[]
# 11| Type = [IntType] int
# 11| ValueCategory = prvalue
# 11| getArrayBase(): [VariableAccess] s
# 11| Type = [Struct] S
# 11| ValueCategory = lvalue
# 11| getArrayOffset(0): [Literal] 1
# 11| Type = [IntType] int
# 11| Value = [Literal] 1
# 11| ValueCategory = prvalue
# 11| getArrayOffset(1): [Literal] 2
# 11| Type = [IntType] int
# 11| Value = [Literal] 2
# 11| ValueCategory = prvalue

1
cpp/ql/test/library-tests/subscript_operator/PrintAST.qlref Normal file
View File

@@ -0,0 +1 @@
semmle/code/cpp/PrintAST.ql

12
cpp/ql/test/library-tests/subscript_operator/test.cpp Normal file
View File

@@ -0,0 +1,12 @@
// semmle-extractor-options: -std=c++23
struct S {
int xs[2][2];
int operator[](int i, int j) {
return xs[i][j];
}
};
int foo(S s) {
return s[1, 2];
}

3
cpp/ql/test/library-tests/templates/type_instantiations/types.expected
View File

@@ -12,9 +12,6 @@
| file://:0:0:0:0 | _Complex float |
| file://:0:0:0:0 | _Complex long double |
| file://:0:0:0:0 | _Complex std::float16_t |
| file://:0:0:0:0 | _Decimal32 |
| file://:0:0:0:0 | _Decimal64 |
| file://:0:0:0:0 | _Decimal128 |
| file://:0:0:0:0 | _Float16 |
| file://:0:0:0:0 | _Float32 |
| file://:0:0:0:0 | _Float32x |

3
cpp/ql/test/library-tests/type_sizes/type_sizes.expected
View File

@@ -32,9 +32,6 @@
| file://:0:0:0:0 | _Complex float | 8 |
| file://:0:0:0:0 | _Complex long double | 32 |
| file://:0:0:0:0 | _Complex std::float16_t | 4 |
| file://:0:0:0:0 | _Decimal32 | 4 |
| file://:0:0:0:0 | _Decimal64 | 8 |
| file://:0:0:0:0 | _Decimal128 | 16 |
| file://:0:0:0:0 | _Float16 | 2 |
| file://:0:0:0:0 | _Float32 | 4 |
| file://:0:0:0:0 | _Float32x | 8 |

3
cpp/ql/test/library-tests/unspecified_type/types/unspecified_type.expected
View File

@@ -14,9 +14,6 @@
| file://:0:0:0:0 | _Complex float | _Complex float |
| file://:0:0:0:0 | _Complex long double | _Complex long double |
| file://:0:0:0:0 | _Complex std::float16_t | _Complex std::float16_t |
| file://:0:0:0:0 | _Decimal32 | _Decimal32 |
| file://:0:0:0:0 | _Decimal64 | _Decimal64 |
| file://:0:0:0:0 | _Decimal128 | _Decimal128 |
| file://:0:0:0:0 | _Float16 | _Float16 |
| file://:0:0:0:0 | _Float32 | _Float32 |
| file://:0:0:0:0 | _Float32x | _Float32x |

3
cpp/ql/test/library-tests/variables/variables/types.expected
View File

@@ -13,9 +13,6 @@
| _Complex float | BinaryFloatingPointType, ComplexNumberType, GuardConditionImpl | | | | |
| _Complex long double | BinaryFloatingPointType, ComplexNumberType, GuardConditionImpl | | | | |
| _Complex std::float16_t | BinaryFloatingPointType, ComplexNumberType, GuardConditionImpl | | | | |
| _Decimal32 | Decimal32Type, GuardConditionImpl | | | | |
| _Decimal64 | Decimal64Type, GuardConditionImpl | | | | |
| _Decimal128 | Decimal128Type, GuardConditionImpl | | | | |
| _Float16 | BinaryFloatingPointType, GuardConditionImpl, RealNumberType | | | | |
| _Float32 | BinaryFloatingPointType, GuardConditionImpl, RealNumberType | | | | |
| _Float32x | BinaryFloatingPointType, GuardConditionImpl, RealNumberType | | | | |