hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 20:26:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add predicate implementations we get for free from simple range analysis

Browse Source
This commit is contained in:
Jeroen Ketema
2023-03-10 14:31:15 +01:00
parent 0e45c9982b
commit faecf44870
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SimpleRangeAnalysis.qll
View File

@@ -80,7 +80,10 @@ predicate defMightOverflowPositively(RangeSsaDefinition def, StackVariable v) {
* Holds if the definition might overflow (either positively or * Holds if the definition might overflow (either positively or
* negatively). * negatively).
*/ */
predicate defMightOverflow(RangeSsaDefinition def, StackVariable v) { none() } predicate defMightOverflow(RangeSsaDefinition def, StackVariable v) {
defMightOverflowNegatively(def, v) or
defMightOverflowPositively(def, v)
}
/** /**
* Holds if the expression might overflow negatively. This predicate * Holds if the expression might overflow negatively. This predicate
@@ -95,7 +98,10 @@ predicate exprMightOverflowNegatively(Expr expr) { none() }
* `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
* due to the addition. * due to the addition.
*/ */
predicate convertedExprMightOverflowNegatively(Expr expr) { none() } predicate convertedExprMightOverflowNegatively(Expr expr) {
exprMightOverflowNegatively(expr) or
convertedExprMightOverflowNegatively(expr.getConversion())
}
/** /**
* Holds if the expression might overflow positively. This predicate * Holds if the expression might overflow positively. This predicate
@@ -110,11 +116,17 @@ predicate exprMightOverflowPositively(Expr expr) { none() }
* `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
* due to the addition. * due to the addition.
*/ */
predicate convertedExprMightOverflowPositively(Expr expr) { none() } predicate convertedExprMightOverflowPositively(Expr expr) {
exprMightOverflowPositively(expr) or
convertedExprMightOverflowPositively(expr.getConversion())
}
/** /**
* Holds if the expression might overflow (either positively or * Holds if the expression might overflow (either positively or
* negatively). The possibility that the expression might overflow * negatively). The possibility that the expression might overflow
* due to an implicit or explicit cast is also considered. * due to an implicit or explicit cast is also considered.
*/ */
predicate convertedExprMightOverflow(Expr expr) { none() } predicate convertedExprMightOverflow(Expr expr) {
convertedExprMightOverflowNegatively(expr) or
convertedExprMightOverflowPositively(expr)
}