Add codex-generated sinks for most DBs in the Java nightly source suite, using MaD columns and code context in the prompt

.github/actions/fetch-codeql/action.yml

@@ -19,6 +19,4 @@ runs:
         gh extension install github/gh-codeql
         gh codeql set-channel "$CHANNEL"
         gh codeql version
-        printf "CODEQL_FETCHED_CODEQL_PATH=" >> "${GITHUB_ENV}"
-        gh codeql version --format=json | jq -r .unpackedLocation >> "${GITHUB_ENV}"
         gh codeql version --format=json | jq -r .unpackedLocation >> "${GITHUB_PATH}"

.github/dependabot.yml

@@ -1,7 +1,19 @@
 version: 2
 updates:
   - package-ecosystem: "cargo"
-    directory: "ruby"
+    directory: "ruby/node-types"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "cargo"
+    directory: "ruby/generator"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "cargo"
+    directory: "ruby/extractor"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "cargo"
+    directory: "ruby/autobuilder"
     schedule:
       interval: "daily"
 

README.md

@@ -10,8 +10,6 @@ There is [extensive documentation](https://codeql.github.com/docs/) on getting s
 
 We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our [contributing guidelines](CONTRIBUTING.md). You can also consult our [style guides](https://github.com/github/codeql/tree/main/docs) to learn how to format your code for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.
 
-For information on contributing to CodeQL documentation, see the "[contributing guide](docs/codeql/CONTRIBUTING.md)" for docs.
-
 ## License
 
 The code in this repository is licensed under the [MIT License](LICENSE) by [GitHub](https://github.com).
@@ -29,4 +27,3 @@ You can install the [CodeQL for Visual Studio Code](https://marketplace.visualst
 ### Tasks
 
 The `.vscode/tasks.json` file defines custom tasks specific to working in this repository. To invoke one of these tasks, select the `Terminal | Run Task...` menu option, and then select the desired task from the dropdown. You can also invoke the `Tasks: Run Task` command from the command palette.
-fooasd

config/identical-files.json

@@ -29,7 +29,6 @@
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplForContentDataFlow.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl.qll",
     "go/ql/lib/semmle/go/dataflow/internal/DataFlowImpl2.qll",
-    "go/ql/lib/semmle/go/dataflow/internal/DataFlowImplForStringsNewReplacer.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
     "python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",

cpp/ql/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 0.5.1
-
-No user-facing changes.
-
 ## 0.5.0
 
 ### Breaking Changes

cpp/ql/lib/change-notes/released/0.5.1.md

@@ -1,3 +0,0 @@
-## 0.5.1
-
-No user-facing changes.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.1
+lastReleaseVersion: 0.5.0

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,16 +45,6 @@ module Consistency {
     ) {
       none()
     }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
   }
 
   private class RelevantNode extends Node {
@@ -256,7 +246,6 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -265,7 +254,6 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/FloatDelta.qll

@@ -1,29 +0,0 @@
-private import RangeAnalysisStage
-
-module FloatDelta implements DeltaSig {
-  class Delta = float;
-
-  bindingset[d]
-  bindingset[result]
-  float toFloat(Delta d) { result = d }
-
-  bindingset[d]
-  bindingset[result]
-  int toInt(Delta d) { result = d }
-
-  bindingset[n]
-  bindingset[result]
-  Delta fromInt(int n) { result = n }
-
-  bindingset[f]
-  Delta fromFloat(float f) {
-    result =
-      min(float diff, float res |
-        diff = (res - f) and res = f.ceil()
-        or
-        diff = (f - res) and res = f.floor()
-      |
-        res order by diff
-      )
-  }
-}

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/ModulusAnalysis.qll

@@ -14,328 +14,321 @@ private import ModulusAnalysisSpecific::Private
 private import experimental.semmle.code.cpp.semantic.Semantic
 private import ConstantAnalysis
 private import RangeUtils
-private import RangeAnalysisStage
 
-module ModulusAnalysis<DeltaSig D, BoundSig<D> Bounds, UtilSig<D> U> {
-  /**
-   * Holds if `e + delta` equals `v` at `pos`.
-   */
-  private predicate valueFlowStepSsa(SemSsaVariable v, SemSsaReadPosition pos, SemExpr e, int delta) {
-    U::semSsaUpdateStep(v, e, D::fromInt(delta)) and pos.hasReadOfVar(v)
-    or
-    exists(SemGuard guard, boolean testIsTrue |
-      pos.hasReadOfVar(v) and
-      guard = U::semEqFlowCond(v, e, D::fromInt(delta), true, testIsTrue) and
-      semGuardDirectlyControlsSsaRead(guard, pos, testIsTrue)
-    )
-  }
+/**
+ * Holds if `e + delta` equals `v` at `pos`.
+ */
+private predicate valueFlowStepSsa(SemSsaVariable v, SemSsaReadPosition pos, SemExpr e, int delta) {
+  semSsaUpdateStep(v, e, delta) and pos.hasReadOfVar(v)
+  or
+  exists(SemGuard guard, boolean testIsTrue |
+    pos.hasReadOfVar(v) and
+    guard = semEqFlowCond(v, e, delta, true, testIsTrue) and
+    semGuardDirectlyControlsSsaRead(guard, pos, testIsTrue)
+  )
+}
 
-  /**
-   * Holds if `add` is the addition of `larg` and `rarg`, neither of which are
-   * `ConstantIntegerExpr`s.
-   */
-  private predicate nonConstAddition(SemExpr add, SemExpr larg, SemExpr rarg) {
-    exists(SemAddExpr a | a = add |
-      larg = a.getLeftOperand() and
-      rarg = a.getRightOperand()
-    ) and
-    not larg instanceof SemConstantIntegerExpr and
-    not rarg instanceof SemConstantIntegerExpr
-  }
+/**
+ * Holds if `add` is the addition of `larg` and `rarg`, neither of which are
+ * `ConstantIntegerExpr`s.
+ */
+private predicate nonConstAddition(SemExpr add, SemExpr larg, SemExpr rarg) {
+  exists(SemAddExpr a | a = add |
+    larg = a.getLeftOperand() and
+    rarg = a.getRightOperand()
+  ) and
+  not larg instanceof SemConstantIntegerExpr and
+  not rarg instanceof SemConstantIntegerExpr
+}
 
-  /**
-   * Holds if `sub` is the subtraction of `larg` and `rarg`, where `rarg` is not
-   * a `ConstantIntegerExpr`.
-   */
-  private predicate nonConstSubtraction(SemExpr sub, SemExpr larg, SemExpr rarg) {
-    exists(SemSubExpr s | s = sub |
-      larg = s.getLeftOperand() and
-      rarg = s.getRightOperand()
-    ) and
-    not rarg instanceof SemConstantIntegerExpr
-  }
+/**
+ * Holds if `sub` is the subtraction of `larg` and `rarg`, where `rarg` is not
+ * a `ConstantIntegerExpr`.
+ */
+private predicate nonConstSubtraction(SemExpr sub, SemExpr larg, SemExpr rarg) {
+  exists(SemSubExpr s | s = sub |
+    larg = s.getLeftOperand() and
+    rarg = s.getRightOperand()
+  ) and
+  not rarg instanceof SemConstantIntegerExpr
+}
 
-  /** Gets an expression that is the remainder modulo `mod` of `arg`. */
-  private SemExpr modExpr(SemExpr arg, int mod) {
-    exists(SemRemExpr rem |
-      result = rem and
-      arg = rem.getLeftOperand() and
-      rem.getRightOperand().(SemConstantIntegerExpr).getIntValue() = mod and
-      mod >= 2
-    )
-    or
-    exists(SemConstantIntegerExpr c |
-      mod = 2.pow([1 .. 30]) and
-      c.getIntValue() = mod - 1 and
-      result.(SemBitAndExpr).hasOperands(arg, c)
-    )
-  }
+/** Gets an expression that is the remainder modulo `mod` of `arg`. */
+private SemExpr modExpr(SemExpr arg, int mod) {
+  exists(SemRemExpr rem |
+    result = rem and
+    arg = rem.getLeftOperand() and
+    rem.getRightOperand().(SemConstantIntegerExpr).getIntValue() = mod and
+    mod >= 2
+  )
+  or
+  exists(SemConstantIntegerExpr c |
+    mod = 2.pow([1 .. 30]) and
+    c.getIntValue() = mod - 1 and
+    result.(SemBitAndExpr).hasOperands(arg, c)
+  )
+}
 
-  /**
-   * Gets a guard that tests whether `v` is congruent with `val` modulo `mod` on
-   * its `testIsTrue` branch.
-   */
-  private SemGuard moduloCheck(SemSsaVariable v, int val, int mod, boolean testIsTrue) {
-    exists(SemExpr rem, SemConstantIntegerExpr c, int r, boolean polarity |
-      result.isEquality(rem, c, polarity) and
-      c.getIntValue() = r and
-      rem = modExpr(v.getAUse(), mod) and
-      (
-        testIsTrue = polarity and val = r
-        or
-        testIsTrue = polarity.booleanNot() and
-        mod = 2 and
-        val = 1 - r and
-        (r = 0 or r = 1)
-      )
-    )
-  }
-
-  /**
-   * Holds if a guard ensures that `v` at `pos` is congruent with `val` modulo `mod`.
-   */
-  private predicate moduloGuardedRead(SemSsaVariable v, SemSsaReadPosition pos, int val, int mod) {
-    exists(SemGuard guard, boolean testIsTrue |
-      pos.hasReadOfVar(v) and
-      guard = moduloCheck(v, val, mod, testIsTrue) and
-      semGuardControlsSsaRead(guard, pos, testIsTrue)
-    )
-  }
-
-  /** Holds if `factor` is a power of 2 that divides `mask`. */
-  bindingset[mask]
-  private predicate andmaskFactor(int mask, int factor) {
-    mask % factor = 0 and
-    factor = 2.pow([1 .. 30])
-  }
-
-  /** Holds if `e` is evenly divisible by `factor`. */
-  private predicate evenlyDivisibleExpr(SemExpr e, int factor) {
-    exists(SemConstantIntegerExpr c, int k | k = c.getIntValue() |
-      e.(SemMulExpr).getAnOperand() = c and factor = k.abs() and factor >= 2
+/**
+ * Gets a guard that tests whether `v` is congruent with `val` modulo `mod` on
+ * its `testIsTrue` branch.
+ */
+private SemGuard moduloCheck(SemSsaVariable v, int val, int mod, boolean testIsTrue) {
+  exists(SemExpr rem, SemConstantIntegerExpr c, int r, boolean polarity |
+    result.isEquality(rem, c, polarity) and
+    c.getIntValue() = r and
+    rem = modExpr(v.getAUse(), mod) and
+    (
+      testIsTrue = polarity and val = r
       or
-      e.(SemShiftLeftExpr).getRightOperand() = c and factor = 2.pow(k) and k > 0
-      or
-      e.(SemBitAndExpr).getAnOperand() = c and factor = max(int f | andmaskFactor(k, f))
+      testIsTrue = polarity.booleanNot() and
+      mod = 2 and
+      val = 1 - r and
+      (r = 0 or r = 1)
     )
-  }
+  )
+}
 
-  /**
-   * Holds if `rix` is the number of input edges to `phi`.
-   */
-  private predicate maxPhiInputRank(SemSsaPhiNode phi, int rix) {
-    rix = max(int r | rankedPhiInput(phi, _, _, r))
-  }
+/**
+ * Holds if a guard ensures that `v` at `pos` is congruent with `val` modulo `mod`.
+ */
+private predicate moduloGuardedRead(SemSsaVariable v, SemSsaReadPosition pos, int val, int mod) {
+  exists(SemGuard guard, boolean testIsTrue |
+    pos.hasReadOfVar(v) and
+    guard = moduloCheck(v, val, mod, testIsTrue) and
+    semGuardControlsSsaRead(guard, pos, testIsTrue)
+  )
+}
 
-  /**
-   * Gets the remainder of `val` modulo `mod`.
-   *
-   * For `mod = 0` the result equals `val` and for `mod > 1` the result is within
-   * the range `[0 .. mod-1]`.
-   */
-  bindingset[val, mod]
-  private int remainder(int val, int mod) {
-    mod = 0 and result = val
+/** Holds if `factor` is a power of 2 that divides `mask`. */
+bindingset[mask]
+private predicate andmaskFactor(int mask, int factor) {
+  mask % factor = 0 and
+  factor = 2.pow([1 .. 30])
+}
+
+/** Holds if `e` is evenly divisible by `factor`. */
+private predicate evenlyDivisibleExpr(SemExpr e, int factor) {
+  exists(SemConstantIntegerExpr c, int k | k = c.getIntValue() |
+    e.(SemMulExpr).getAnOperand() = c and factor = k.abs() and factor >= 2
     or
-    mod > 1 and result = ((val % mod) + mod) % mod
-  }
+    e.(SemShiftLeftExpr).getRightOperand() = c and factor = 2.pow(k) and k > 0
+    or
+    e.(SemBitAndExpr).getAnOperand() = c and factor = max(int f | andmaskFactor(k, f))
+  )
+}
 
-  /**
-   * Holds if `inp` is an input to `phi` and equals `phi` modulo `mod` along `edge`.
-   */
-  private predicate phiSelfModulus(
-    SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int mod
-  ) {
-    exists(Bounds::SemSsaBound phibound, int v, int m |
-      edge.phiInput(phi, inp) and
-      phibound.getAVariable() = phi and
-      ssaModulus(inp, edge, phibound, v, m) and
-      mod = m.gcd(v) and
-      mod != 1
-    )
-  }
+/**
+ * Holds if `rix` is the number of input edges to `phi`.
+ */
+private predicate maxPhiInputRank(SemSsaPhiNode phi, int rix) {
+  rix = max(int r | rankedPhiInput(phi, _, _, r))
+}
 
-  /**
-   * Holds if `b + val` modulo `mod` is a candidate congruence class for `phi`.
-   */
-  private predicate phiModulusInit(SemSsaPhiNode phi, Bounds::SemBound b, int val, int mod) {
-    exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
-      edge.phiInput(phi, inp) and
-      ssaModulus(inp, edge, b, val, mod)
-    )
-  }
+/**
+ * Gets the remainder of `val` modulo `mod`.
+ *
+ * For `mod = 0` the result equals `val` and for `mod > 1` the result is within
+ * the range `[0 .. mod-1]`.
+ */
+bindingset[val, mod]
+private int remainder(int val, int mod) {
+  mod = 0 and result = val
+  or
+  mod > 1 and result = ((val % mod) + mod) % mod
+}
 
-  /**
-   * Holds if all inputs to `phi` numbered `1` to `rix` are equal to `b + val` modulo `mod`.
+/**
+ * Holds if `inp` is an input to `phi` and equals `phi` modulo `mod` along `edge`.
+ */
+private predicate phiSelfModulus(
+  SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int mod
+) {
+  exists(SemSsaBound phibound, int v, int m |
+    edge.phiInput(phi, inp) and
+    phibound.getAVariable() = phi and
+    ssaModulus(inp, edge, phibound, v, m) and
+    mod = m.gcd(v) and
+    mod != 1
+  )
+}
+
+/**
+ * Holds if `b + val` modulo `mod` is a candidate congruence class for `phi`.
+ */
+private predicate phiModulusInit(SemSsaPhiNode phi, SemBound b, int val, int mod) {
+  exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
+    edge.phiInput(phi, inp) and
+    ssaModulus(inp, edge, b, val, mod)
+  )
+}
+
+/**
+ * Holds if all inputs to `phi` numbered `1` to `rix` are equal to `b + val` modulo `mod`.
+ */
+pragma[nomagic]
+private predicate phiModulusRankStep(SemSsaPhiNode phi, SemBound b, int val, int mod, int rix) {
+  /*
+   * base case. If any phi input is equal to `b + val` modulo `mod`, that's a potential congruence
+   * class for the phi node.
    */
-  pragma[nomagic]
-  private predicate phiModulusRankStep(
-    SemSsaPhiNode phi, Bounds::SemBound b, int val, int mod, int rix
-  ) {
+
+  rix = 0 and
+  phiModulusInit(phi, b, val, mod)
+  or
+  exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int v1, int m1 |
+    mod != 1 and
+    val = remainder(v1, mod)
+  |
     /*
-     * base case. If any phi input is equal to `b + val` modulo `mod`, that's a potential congruence
-     * class for the phi node.
+     * Recursive case. If `inp` = `b + v2` mod `m2`, we combine that with the preceding potential
+     * congruence class `b + v1` mod `m1`. The result will be the congruence class of `v1` modulo
+     * the greatest common denominator of `m1`, `m2`, and `v1 - v2`.
      */
 
-    rix = 0 and
-    phiModulusInit(phi, b, val, mod)
-    or
-    exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int v1, int m1 |
-      mod != 1 and
-      val = remainder(v1, mod)
-    |
-      /*
-       * Recursive case. If `inp` = `b + v2` mod `m2`, we combine that with the preceding potential
-       * congruence class `b + v1` mod `m1`. The result will be the congruence class of `v1` modulo
-       * the greatest common denominator of `m1`, `m2`, and `v1 - v2`.
-       */
-
-      exists(int v2, int m2 |
-        rankedPhiInput(pragma[only_bind_out](phi), inp, edge, rix) and
-        phiModulusRankStep(phi, b, v1, m1, rix - 1) and
-        ssaModulus(inp, edge, b, v2, m2) and
-        mod = m1.gcd(m2).gcd(v1 - v2)
-      )
-      or
-      /*
-       * Recursive case. If `inp` = `phi` mod `m2`, we combine that with the preceding potential
-       * congruence class `b + v1` mod `m1`. The result will be a congruence class modulo the greatest
-       * common denominator of `m1` and `m2`.
-       */
-
-      exists(int m2 |
-        rankedPhiInput(phi, inp, edge, rix) and
-        phiModulusRankStep(phi, b, v1, m1, rix - 1) and
-        phiSelfModulus(phi, inp, edge, m2) and
-        mod = m1.gcd(m2)
-      )
+    exists(int v2, int m2 |
+      rankedPhiInput(pragma[only_bind_out](phi), inp, edge, rix) and
+      phiModulusRankStep(phi, b, v1, m1, rix - 1) and
+      ssaModulus(inp, edge, b, v2, m2) and
+      mod = m1.gcd(m2).gcd(v1 - v2)
     )
-  }
+    or
+    /*
+     * Recursive case. If `inp` = `phi` mod `m2`, we combine that with the preceding potential
+     * congruence class `b + v1` mod `m1`. The result will be a congruence class modulo the greatest
+     * common denominator of `m1` and `m2`.
+     */
 
-  /**
-   * Holds if `phi` is equal to `b + val` modulo `mod`.
-   */
-  private predicate phiModulus(SemSsaPhiNode phi, Bounds::SemBound b, int val, int mod) {
-    exists(int r |
-      maxPhiInputRank(phi, r) and
-      phiModulusRankStep(phi, b, val, mod, r)
+    exists(int m2 |
+      rankedPhiInput(phi, inp, edge, rix) and
+      phiModulusRankStep(phi, b, v1, m1, rix - 1) and
+      phiSelfModulus(phi, inp, edge, m2) and
+      mod = m1.gcd(m2)
     )
-  }
+  )
+}
 
-  /**
-   * Holds if `v` at `pos` is equal to `b + val` modulo `mod`.
-   */
-  private predicate ssaModulus(
-    SemSsaVariable v, SemSsaReadPosition pos, Bounds::SemBound b, int val, int mod
-  ) {
-    phiModulus(v, b, val, mod) and pos.hasReadOfVar(v)
+/**
+ * Holds if `phi` is equal to `b + val` modulo `mod`.
+ */
+private predicate phiModulus(SemSsaPhiNode phi, SemBound b, int val, int mod) {
+  exists(int r |
+    maxPhiInputRank(phi, r) and
+    phiModulusRankStep(phi, b, val, mod, r)
+  )
+}
+
+/**
+ * Holds if `v` at `pos` is equal to `b + val` modulo `mod`.
+ */
+private predicate ssaModulus(SemSsaVariable v, SemSsaReadPosition pos, SemBound b, int val, int mod) {
+  phiModulus(v, b, val, mod) and pos.hasReadOfVar(v)
+  or
+  b.(SemSsaBound).getAVariable() = v and pos.hasReadOfVar(v) and val = 0 and mod = 0
+  or
+  exists(SemExpr e, int val0, int delta |
+    semExprModulus(e, b, val0, mod) and
+    valueFlowStepSsa(v, pos, e, delta) and
+    val = remainder(val0 + delta, mod)
+  )
+  or
+  moduloGuardedRead(v, pos, val, mod) and b instanceof SemZeroBound
+}
+
+/**
+ * Holds if `e` is equal to `b + val` modulo `mod`.
+ *
+ * There are two cases for the modulus:
+ * - `mod = 0`: The equality `e = b + val` is an ordinary equality.
+ * - `mod > 1`: `val` lies within the range `[0 .. mod-1]`.
+ */
+cached
+predicate semExprModulus(SemExpr e, SemBound b, int val, int mod) {
+  not ignoreExprModulus(e) and
+  (
+    e = b.getExpr(val) and mod = 0
     or
-    b.(Bounds::SemSsaBound).getAVariable() = v and pos.hasReadOfVar(v) and val = 0 and mod = 0
+    evenlyDivisibleExpr(e, mod) and
+    val = 0 and
+    b instanceof SemZeroBound
     or
-    exists(SemExpr e, int val0, int delta |
-      semExprModulus(e, b, val0, mod) and
-      valueFlowStepSsa(v, pos, e, delta) and
+    exists(SemSsaVariable v, SemSsaReadPositionBlock bb |
+      ssaModulus(v, bb, b, val, mod) and
+      e = v.getAUse() and
+      bb.getAnExpr() = e
+    )
+    or
+    exists(SemExpr mid, int val0, int delta |
+      semExprModulus(mid, b, val0, mod) and
+      semValueFlowStep(e, mid, delta) and
       val = remainder(val0 + delta, mod)
     )
     or
-    moduloGuardedRead(v, pos, val, mod) and b instanceof Bounds::SemZeroBound
-  }
-
-  /**
-   * Holds if `e` is equal to `b + val` modulo `mod`.
-   *
-   * There are two cases for the modulus:
-   * - `mod = 0`: The equality `e = b + val` is an ordinary equality.
-   * - `mod > 1`: `val` lies within the range `[0 .. mod-1]`.
-   */
-  cached
-  predicate semExprModulus(SemExpr e, Bounds::SemBound b, int val, int mod) {
-    not ignoreExprModulus(e) and
-    (
-      e = b.getExpr(D::fromInt(val)) and mod = 0
-      or
-      evenlyDivisibleExpr(e, mod) and
-      val = 0 and
-      b instanceof Bounds::SemZeroBound
-      or
-      exists(SemSsaVariable v, SemSsaReadPositionBlock bb |
-        ssaModulus(v, bb, b, val, mod) and
-        e = v.getAUse() and
-        bb.getAnExpr() = e
-      )
-      or
-      exists(SemExpr mid, int val0, int delta |
-        semExprModulus(mid, b, val0, mod) and
-        U::semValueFlowStep(e, mid, D::fromInt(delta)) and
-        val = remainder(val0 + delta, mod)
-      )
-      or
-      exists(SemConditionalExpr cond, int v1, int v2, int m1, int m2 |
-        cond = e and
-        condExprBranchModulus(cond, true, b, v1, m1) and
-        condExprBranchModulus(cond, false, b, v2, m2) and
-        mod = m1.gcd(m2).gcd(v1 - v2) and
-        mod != 1 and
-        val = remainder(v1, mod)
-      )
-      or
-      exists(Bounds::SemBound b1, Bounds::SemBound b2, int v1, int v2, int m1, int m2 |
-        addModulus(e, true, b1, v1, m1) and
-        addModulus(e, false, b2, v2, m2) and
-        mod = m1.gcd(m2) and
-        mod != 1 and
-        val = remainder(v1 + v2, mod)
-      |
-        b = b1 and b2 instanceof Bounds::SemZeroBound
-        or
-        b = b2 and b1 instanceof Bounds::SemZeroBound
-      )
-      or
-      exists(int v1, int v2, int m1, int m2 |
-        subModulus(e, true, b, v1, m1) and
-        subModulus(e, false, any(Bounds::SemZeroBound zb), v2, m2) and
-        mod = m1.gcd(m2) and
-        mod != 1 and
-        val = remainder(v1 - v2, mod)
-      )
+    exists(SemConditionalExpr cond, int v1, int v2, int m1, int m2 |
+      cond = e and
+      condExprBranchModulus(cond, true, b, v1, m1) and
+      condExprBranchModulus(cond, false, b, v2, m2) and
+      mod = m1.gcd(m2).gcd(v1 - v2) and
+      mod != 1 and
+      val = remainder(v1, mod)
     )
-  }
-
-  private predicate condExprBranchModulus(
-    SemConditionalExpr cond, boolean branch, Bounds::SemBound b, int val, int mod
-  ) {
-    semExprModulus(cond.getBranchExpr(branch), b, val, mod)
-  }
-
-  private predicate addModulus(SemExpr add, boolean isLeft, Bounds::SemBound b, int val, int mod) {
-    exists(SemExpr larg, SemExpr rarg | nonConstAddition(add, larg, rarg) |
-      semExprModulus(larg, b, val, mod) and isLeft = true
+    or
+    exists(SemBound b1, SemBound b2, int v1, int v2, int m1, int m2 |
+      addModulus(e, true, b1, v1, m1) and
+      addModulus(e, false, b2, v2, m2) and
+      mod = m1.gcd(m2) and
+      mod != 1 and
+      val = remainder(v1 + v2, mod)
+    |
+      b = b1 and b2 instanceof SemZeroBound
       or
-      semExprModulus(rarg, b, val, mod) and isLeft = false
+      b = b2 and b1 instanceof SemZeroBound
     )
-  }
-
-  private predicate subModulus(SemExpr sub, boolean isLeft, Bounds::SemBound b, int val, int mod) {
-    exists(SemExpr larg, SemExpr rarg | nonConstSubtraction(sub, larg, rarg) |
-      semExprModulus(larg, b, val, mod) and isLeft = true
-      or
-      semExprModulus(rarg, b, val, mod) and isLeft = false
+    or
+    exists(int v1, int v2, int m1, int m2 |
+      subModulus(e, true, b, v1, m1) and
+      subModulus(e, false, any(SemZeroBound zb), v2, m2) and
+      mod = m1.gcd(m2) and
+      mod != 1 and
+      val = remainder(v1 - v2, mod)
+    )
+  )
+}
+
+private predicate condExprBranchModulus(
+  SemConditionalExpr cond, boolean branch, SemBound b, int val, int mod
+) {
+  semExprModulus(cond.getBranchExpr(branch), b, val, mod)
+}
+
+private predicate addModulus(SemExpr add, boolean isLeft, SemBound b, int val, int mod) {
+  exists(SemExpr larg, SemExpr rarg | nonConstAddition(add, larg, rarg) |
+    semExprModulus(larg, b, val, mod) and isLeft = true
+    or
+    semExprModulus(rarg, b, val, mod) and isLeft = false
+  )
+}
+
+private predicate subModulus(SemExpr sub, boolean isLeft, SemBound b, int val, int mod) {
+  exists(SemExpr larg, SemExpr rarg | nonConstSubtraction(sub, larg, rarg) |
+    semExprModulus(larg, b, val, mod) and isLeft = true
+    or
+    semExprModulus(rarg, b, val, mod) and isLeft = false
+  )
+}
+
+/**
+ * Holds if `inp` is an input to `phi` along `edge` and this input has index `r`
+ * in an arbitrary 1-based numbering of the input edges to `phi`.
+ */
+private predicate rankedPhiInput(
+  SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int r
+) {
+  edge.phiInput(phi, inp) and
+  edge =
+    rank[r](SemSsaReadPositionPhiInputEdge e |
+      e.phiInput(phi, _)
+    |
+      e order by e.getOrigBlock().getUniqueId()
     )
-  }
-
-  /**
-   * Holds if `inp` is an input to `phi` along `edge` and this input has index `r`
-   * in an arbitrary 1-based numbering of the input edges to `phi`.
-   */
-  private predicate rankedPhiInput(
-    SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, int r
-  ) {
-    edge.phiInput(phi, inp) and
-    edge =
-      rank[r](SemSsaReadPositionPhiInputEdge e |
-        e.phiInput(phi, _)
-      |
-        e order by e.getOrigBlock().getUniqueId()
-      )
-  }
 }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll

@@ -1,24 +1,830 @@
-private import RangeAnalysisStage
-private import RangeAnalysisSpecific
-private import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
+/**
+ * Provides classes and predicates for range analysis.
+ *
+ * An inferred bound can either be a specific integer, the abstract value of an
+ * SSA variable, or the abstract value of an interesting expression. The latter
+ * category includes array lengths that are not SSA variables.
+ *
+ * If an inferred bound relies directly on a condition, then this condition is
+ * reported as the reason for the bound.
+ */
+
+/*
+ * This library tackles range analysis as a flow problem. Consider e.g.:
+ * ```
+ *   len = arr.length;
+ *   if (x < len) { ... y = x-1; ... y ... }
+ * ```
+ * In this case we would like to infer `y <= arr.length - 2`, and this is
+ * accomplished by tracking the bound through a sequence of steps:
+ * ```
+ *   arr.length --> len = .. --> x < len --> x-1 --> y = .. --> y
+ * ```
+ *
+ * In its simplest form the step relation `E1 --> E2` relates two expressions
+ * such that `E1 <= B` implies `E2 <= B` for any `B` (with a second separate
+ * step relation handling lower bounds). Examples of such steps include
+ * assignments `E2 = E1` and conditions `x <= E1` where `E2` is a use of `x`
+ * guarded by the condition.
+ *
+ * In order to handle subtractions and additions with constants, and strict
+ * comparisons, the step relation is augmented with an integer delta. With this
+ * generalization `E1 --(delta)--> E2` relates two expressions and an integer
+ * such that `E1 <= B` implies `E2 <= B + delta` for any `B`. This corresponds
+ * to the predicate `boundFlowStep`.
+ *
+ * The complete range analysis is then implemented as the transitive closure of
+ * the step relation summing the deltas along the way. If `E1` transitively
+ * steps to `E2`, `delta` is the sum of deltas along the path, and `B` is an
+ * interesting bound equal to the value of `E1` then `E2 <= B + delta`. This
+ * corresponds to the predicate `bounded`.
+ *
+ * Phi nodes need a little bit of extra handling. Consider `x0 = phi(x1, x2)`.
+ * There are essentially two cases:
+ * - If `x1 <= B + d1` and `x2 <= B + d2` then `x0 <= B + max(d1,d2)`.
+ * - If `x1 <= B + d1` and `x2 <= x0 + d2` with `d2 <= 0` then `x0 <= B + d1`.
+ * The first case is for whenever a bound can be proven without taking looping
+ * into account. The second case is relevant when `x2` comes from a back-edge
+ * where we can prove that the variable has been non-increasing through the
+ * loop-iteration as this means that any upper bound that holds prior to the
+ * loop also holds for the variable during the loop.
+ * This generalizes to a phi node with `n` inputs, so if
+ * `x0 = phi(x1, ..., xn)` and `xi <= B + delta` for one of the inputs, then we
+ * also have `x0 <= B + delta` if we can prove either:
+ * - `xj <= B + d` with `d <= delta` or
+ * - `xj <= x0 + d` with `d <= 0`
+ * for each input `xj`.
+ *
+ * As all inferred bounds can be related directly to a path in the source code
+ * the only source of non-termination is if successive redundant (and thereby
+ * increasingly worse) bounds are calculated along a loop in the source code.
+ * We prevent this by weakening the bound to a small finite set of bounds when
+ * a path follows a second back-edge (we postpone weakening till the second
+ * back-edge as a precise bound might require traversing a loop once).
+ */
+
+private import RangeAnalysisSpecific as Specific
 private import RangeUtils
-private import experimental.semmle.code.cpp.semantic.SemanticBound as SemanticBound
+private import SignAnalysisCommon
+private import ModulusAnalysis
+private import experimental.semmle.code.cpp.semantic.Semantic
+private import ConstantAnalysis
 
-module Bounds implements BoundSig<FloatDelta> {
-  class SemBound instanceof SemanticBound::SemBound {
-    string toString() { result = super.toString() }
-
-    SemExpr getExpr(float delta) { result = super.getExpr(delta) }
+cached
+private module RangeAnalysisCache {
+  cached
+  module RangeAnalysisPublic {
+    /**
+     * Holds if `b + delta` is a valid bound for `e`.
+     * - `upper = true`  : `e <= b + delta`
+     * - `upper = false` : `e >= b + delta`
+     *
+     * The reason for the bound is given by `reason` and may be either a condition
+     * or `NoReason` if the bound was proven directly without the use of a bounding
+     * condition.
+     */
+    cached
+    predicate semBounded(SemExpr e, SemBound b, int delta, boolean upper, SemReason reason) {
+      bounded(e, b, delta, upper, _, _, reason) and
+      bestBound(e, b, delta, upper)
+    }
   }
 
-  class SemZeroBound extends SemBound instanceof SemanticBound::SemZeroBound { }
-
-  class SemSsaBound extends SemBound instanceof SemanticBound::SemSsaBound {
-    SemSsaVariable getAVariable() { result = this.(SemanticBound::SemSsaBound).getAVariable() }
+  /**
+   * Holds if `guard = boundFlowCond(_, _, _, _, _) or guard = eqFlowCond(_, _, _, _, _)`.
+   */
+  cached
+  predicate possibleReason(SemGuard guard) {
+    guard = boundFlowCond(_, _, _, _, _) or guard = semEqFlowCond(_, _, _, _, _)
   }
 }
 
-private module CppRangeAnalysis =
-  RangeStage<FloatDelta, Bounds, CppLangImpl, RangeUtil<FloatDelta, CppLangImpl>>;
+private import RangeAnalysisCache
+import RangeAnalysisPublic
 
-import CppRangeAnalysis
+/**
+ * Holds if `b + delta` is a valid bound for `e` and this is the best such delta.
+ * - `upper = true`  : `e <= b + delta`
+ * - `upper = false` : `e >= b + delta`
+ */
+private predicate bestBound(SemExpr e, SemBound b, int delta, boolean upper) {
+  delta = min(int d | bounded(e, b, d, upper, _, _, _)) and upper = true
+  or
+  delta = max(int d | bounded(e, b, d, upper, _, _, _)) and upper = false
+}
+
+/**
+ * Holds if `comp` corresponds to:
+ * - `upper = true`  : `v <= e + delta` or `v < e + delta`
+ * - `upper = false` : `v >= e + delta` or `v > e + delta`
+ */
+private predicate boundCondition(
+  SemRelationalExpr comp, SemSsaVariable v, SemExpr e, int delta, boolean upper
+) {
+  comp.getLesserOperand() = semSsaRead(v, delta) and e = comp.getGreaterOperand() and upper = true
+  or
+  comp.getGreaterOperand() = semSsaRead(v, delta) and e = comp.getLesserOperand() and upper = false
+  or
+  exists(SemSubExpr sub, SemConstantIntegerExpr c, int d |
+    // (v - d) - e < c
+    comp.getLesserOperand() = sub and
+    comp.getGreaterOperand() = c and
+    sub.getLeftOperand() = semSsaRead(v, d) and
+    sub.getRightOperand() = e and
+    upper = true and
+    delta = d + c.getIntValue()
+    or
+    // (v - d) - e > c
+    comp.getGreaterOperand() = sub and
+    comp.getLesserOperand() = c and
+    sub.getLeftOperand() = semSsaRead(v, d) and
+    sub.getRightOperand() = e and
+    upper = false and
+    delta = d + c.getIntValue()
+    or
+    // e - (v - d) < c
+    comp.getLesserOperand() = sub and
+    comp.getGreaterOperand() = c and
+    sub.getLeftOperand() = e and
+    sub.getRightOperand() = semSsaRead(v, d) and
+    upper = false and
+    delta = d - c.getIntValue()
+    or
+    // e - (v - d) > c
+    comp.getGreaterOperand() = sub and
+    comp.getLesserOperand() = c and
+    sub.getLeftOperand() = e and
+    sub.getRightOperand() = semSsaRead(v, d) and
+    upper = true and
+    delta = d - c.getIntValue()
+  )
+}
+
+/**
+ * Holds if `comp` is a comparison between `x` and `y` for which `y - x` has a
+ * fixed value modulo some `mod > 1`, such that the comparison can be
+ * strengthened by `strengthen` when evaluating to `testIsTrue`.
+ */
+private predicate modulusComparison(SemRelationalExpr comp, boolean testIsTrue, int strengthen) {
+  exists(
+    SemBound b, int v1, int v2, int mod1, int mod2, int mod, boolean resultIsStrict, int d, int k
+  |
+    // If `x <= y` and `x =(mod) b + v1` and `y =(mod) b + v2` then
+    // `0 <= y - x =(mod) v2 - v1`. By choosing `k =(mod) v2 - v1` with
+    // `0 <= k < mod` we get `k <= y - x`. If the resulting comparison is
+    // strict then the strengthening amount is instead `k - 1` modulo `mod`:
+    // `x < y` means `0 <= y - x - 1 =(mod) k - 1` so `k - 1 <= y - x - 1` and
+    // thus `k - 1 < y - x` with `0 <= k - 1 < mod`.
+    semExprModulus(comp.getLesserOperand(), b, v1, mod1) and
+    semExprModulus(comp.getGreaterOperand(), b, v2, mod2) and
+    mod = mod1.gcd(mod2) and
+    mod != 1 and
+    (testIsTrue = true or testIsTrue = false) and
+    (
+      if comp.isStrict()
+      then resultIsStrict = testIsTrue
+      else resultIsStrict = testIsTrue.booleanNot()
+    ) and
+    (
+      resultIsStrict = true and d = 1
+      or
+      resultIsStrict = false and d = 0
+    ) and
+    (
+      testIsTrue = true and k = v2 - v1
+      or
+      testIsTrue = false and k = v1 - v2
+    ) and
+    strengthen = (((k - d) % mod) + mod) % mod
+  )
+}
+
+/**
+ * Gets a condition that tests whether `v` is bounded by `e + delta`.
+ *
+ * If the condition evaluates to `testIsTrue`:
+ * - `upper = true`  : `v <= e + delta`
+ * - `upper = false` : `v >= e + delta`
+ */
+private SemGuard boundFlowCond(
+  SemSsaVariable v, SemExpr e, int delta, boolean upper, boolean testIsTrue
+) {
+  exists(
+    SemRelationalExpr comp, int d1, int d2, int d3, int strengthen, boolean compIsUpper,
+    boolean resultIsStrict
+  |
+    comp = result.asExpr() and
+    boundCondition(comp, v, e, d1, compIsUpper) and
+    (testIsTrue = true or testIsTrue = false) and
+    upper = compIsUpper.booleanXor(testIsTrue.booleanNot()) and
+    (
+      if comp.isStrict()
+      then resultIsStrict = testIsTrue
+      else resultIsStrict = testIsTrue.booleanNot()
+    ) and
+    (
+      if
+        getTrackedTypeForSsaVariable(v) instanceof SemIntegerType or
+        getTrackedTypeForSsaVariable(v) instanceof SemAddressType
+      then
+        upper = true and strengthen = -1
+        or
+        upper = false and strengthen = 1
+      else strengthen = 0
+    ) and
+    (
+      exists(int k | modulusComparison(comp, testIsTrue, k) and d2 = strengthen * k)
+      or
+      not modulusComparison(comp, testIsTrue, _) and d2 = 0
+    ) and
+    // A strict inequality `x < y` can be strengthened to `x <= y - 1`.
+    (
+      resultIsStrict = true and d3 = strengthen
+      or
+      resultIsStrict = false and d3 = 0
+    ) and
+    delta = d1 + d2 + d3
+  )
+  or
+  exists(boolean testIsTrue0 |
+    semImplies_v2(result, testIsTrue, boundFlowCond(v, e, delta, upper, testIsTrue0), testIsTrue0)
+  )
+  or
+  result = semEqFlowCond(v, e, delta, true, testIsTrue) and
+  (upper = true or upper = false)
+  or
+  // guard that tests whether `v2` is bounded by `e + delta + d1 - d2` and
+  // exists a guard `guardEq` such that `v = v2 - d1 + d2`.
+  exists(SemSsaVariable v2, SemGuard guardEq, boolean eqIsTrue, int d1, int d2 |
+    guardEq = semEqFlowCond(v, semSsaRead(v2, d1), d2, true, eqIsTrue) and
+    result = boundFlowCond(v2, e, delta + d1 - d2, upper, testIsTrue) and
+    // guardEq needs to control guard
+    guardEq.directlyControls(result.getBasicBlock(), eqIsTrue)
+  )
+}
+
+private newtype TSemReason =
+  TSemNoReason() or
+  TSemCondReason(SemGuard guard) { possibleReason(guard) }
+
+/**
+ * A reason for an inferred bound. This can either be `CondReason` if the bound
+ * is due to a specific condition, or `NoReason` if the bound is inferred
+ * without going through a bounding condition.
+ */
+abstract class SemReason extends TSemReason {
+  /** Gets a textual representation of this reason. */
+  abstract string toString();
+}
+
+/**
+ * A reason for an inferred bound that indicates that the bound is inferred
+ * without going through a bounding condition.
+ */
+class SemNoReason extends SemReason, TSemNoReason {
+  override string toString() { result = "NoReason" }
+}
+
+/** A reason for an inferred bound pointing to a condition. */
+class SemCondReason extends SemReason, TSemCondReason {
+  /** Gets the condition that is the reason for the bound. */
+  SemGuard getCond() { this = TSemCondReason(result) }
+
+  override string toString() { result = getCond().toString() }
+}
+
+/**
+ * Holds if `e + delta` is a valid bound for `v` at `pos`.
+ * - `upper = true`  : `v <= e + delta`
+ * - `upper = false` : `v >= e + delta`
+ */
+private predicate boundFlowStepSsa(
+  SemSsaVariable v, SemSsaReadPosition pos, SemExpr e, int delta, boolean upper, SemReason reason
+) {
+  semSsaUpdateStep(v, e, delta) and
+  pos.hasReadOfVar(v) and
+  (upper = true or upper = false) and
+  reason = TSemNoReason()
+  or
+  exists(SemGuard guard, boolean testIsTrue |
+    pos.hasReadOfVar(v) and
+    guard = boundFlowCond(v, e, delta, upper, testIsTrue) and
+    semGuardDirectlyControlsSsaRead(guard, pos, testIsTrue) and
+    reason = TSemCondReason(guard)
+  )
+}
+
+/** Holds if `v != e + delta` at `pos` and `v` is of integral type. */
+private predicate unequalFlowStepIntegralSsa(
+  SemSsaVariable v, SemSsaReadPosition pos, SemExpr e, int delta, SemReason reason
+) {
+  getTrackedTypeForSsaVariable(v) instanceof SemIntegerType and
+  exists(SemGuard guard, boolean testIsTrue |
+    pos.hasReadOfVar(v) and
+    guard = semEqFlowCond(v, e, delta, false, testIsTrue) and
+    semGuardDirectlyControlsSsaRead(guard, pos, testIsTrue) and
+    reason = TSemCondReason(guard)
+  )
+}
+
+/**
+ * An expression that does conversion, boxing, or unboxing
+ */
+private class ConvertOrBoxExpr extends SemUnaryExpr {
+  ConvertOrBoxExpr() {
+    this instanceof SemConvertExpr
+    or
+    this instanceof SemBoxExpr
+    or
+    this instanceof SemUnboxExpr
+  }
+}
+
+/**
+ * A cast that can be ignored for the purpose of range analysis.
+ */
+private class SafeCastExpr extends ConvertOrBoxExpr {
+  SafeCastExpr() {
+    conversionCannotOverflow(getTrackedType(pragma[only_bind_into](getOperand())),
+      getTrackedType(this))
+  }
+}
+
+/**
+ * Holds if `typ` is a small integral type with the given lower and upper bounds.
+ */
+private predicate typeBound(SemIntegerType typ, int lowerbound, int upperbound) {
+  exists(int bitSize | bitSize = typ.getByteSize() * 8 |
+    bitSize < 32 and
+    (
+      if typ.isSigned()
+      then (
+        upperbound = 1.bitShiftLeft(bitSize - 1) - 1 and
+        lowerbound = -upperbound - 1
+      ) else (
+        lowerbound = 0 and
+        upperbound = 1.bitShiftLeft(bitSize) - 1
+      )
+    )
+  )
+}
+
+/**
+ * A cast to a small integral type that may overflow or underflow.
+ */
+private class NarrowingCastExpr extends ConvertOrBoxExpr {
+  NarrowingCastExpr() {
+    not this instanceof SafeCastExpr and
+    typeBound(getTrackedType(this), _, _)
+  }
+
+  /** Gets the lower bound of the resulting type. */
+  int getLowerBound() { typeBound(getTrackedType(this), result, _) }
+
+  /** Gets the upper bound of the resulting type. */
+  int getUpperBound() { typeBound(getTrackedType(this), _, result) }
+}
+
+/** Holds if `e >= 1` as determined by sign analysis. */
+private predicate strictlyPositiveIntegralExpr(SemExpr e) {
+  semStrictlyPositive(e) and getTrackedType(e) instanceof SemIntegerType
+}
+
+/** Holds if `e <= -1` as determined by sign analysis. */
+private predicate strictlyNegativeIntegralExpr(SemExpr e) {
+  semStrictlyNegative(e) and getTrackedType(e) instanceof SemIntegerType
+}
+
+/**
+ * Holds if `e1 + delta` is a valid bound for `e2`.
+ * - `upper = true`  : `e2 <= e1 + delta`
+ * - `upper = false` : `e2 >= e1 + delta`
+ */
+private predicate boundFlowStep(SemExpr e2, SemExpr e1, int delta, boolean upper) {
+  semValueFlowStep(e2, e1, delta) and
+  (upper = true or upper = false)
+  or
+  e2.(SafeCastExpr).getOperand() = e1 and
+  delta = 0 and
+  (upper = true or upper = false)
+  or
+  exists(SemExpr x | e2.(SemAddExpr).hasOperands(e1, x) |
+    // `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
+    not x instanceof SemConstantIntegerExpr and
+    not e1 instanceof SemConstantIntegerExpr and
+    if strictlyPositiveIntegralExpr(x)
+    then upper = false and delta = 1
+    else
+      if semPositive(x)
+      then upper = false and delta = 0
+      else
+        if strictlyNegativeIntegralExpr(x)
+        then upper = true and delta = -1
+        else
+          if semNegative(x)
+          then upper = true and delta = 0
+          else none()
+  )
+  or
+  exists(SemExpr x, SemSubExpr sub |
+    e2 = sub and
+    sub.getLeftOperand() = e1 and
+    sub.getRightOperand() = x
+  |
+    // `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
+    not x instanceof SemConstantIntegerExpr and
+    if strictlyPositiveIntegralExpr(x)
+    then upper = true and delta = -1
+    else
+      if semPositive(x)
+      then upper = true and delta = 0
+      else
+        if strictlyNegativeIntegralExpr(x)
+        then upper = false and delta = 1
+        else
+          if semNegative(x)
+          then upper = false and delta = 0
+          else none()
+  )
+  or
+  e2.(SemRemExpr).getRightOperand() = e1 and
+  semPositive(e1) and
+  delta = -1 and
+  upper = true
+  or
+  e2.(SemRemExpr).getLeftOperand() = e1 and semPositive(e1) and delta = 0 and upper = true
+  or
+  e2.(SemBitAndExpr).getAnOperand() = e1 and
+  semPositive(e1) and
+  delta = 0 and
+  upper = true
+  or
+  e2.(SemBitOrExpr).getAnOperand() = e1 and
+  semPositive(e2) and
+  delta = 0 and
+  upper = false
+  or
+  Specific::hasBound(e2, e1, delta, upper)
+}
+
+/** Holds if `e2 = e1 * factor` and `factor > 0`. */
+private predicate boundFlowStepMul(SemExpr e2, SemExpr e1, int factor) {
+  exists(SemConstantIntegerExpr c, int k | k = c.getIntValue() and k > 0 |
+    e2.(SemMulExpr).hasOperands(e1, c) and factor = k
+    or
+    exists(SemShiftLeftExpr e |
+      e = e2 and e.getLeftOperand() = e1 and e.getRightOperand() = c and factor = 2.pow(k)
+    )
+  )
+}
+
+/**
+ * Holds if `e2 = e1 / factor` and `factor > 0`.
+ *
+ * This conflates division, right shift, and unsigned right shift and is
+ * therefore only valid for non-negative numbers.
+ */
+private predicate boundFlowStepDiv(SemExpr e2, SemExpr e1, int factor) {
+  exists(SemConstantIntegerExpr c, int k | k = c.getIntValue() and k > 0 |
+    exists(SemDivExpr e |
+      e = e2 and e.getLeftOperand() = e1 and e.getRightOperand() = c and factor = k
+    )
+    or
+    exists(SemShiftRightExpr e |
+      e = e2 and e.getLeftOperand() = e1 and e.getRightOperand() = c and factor = 2.pow(k)
+    )
+    or
+    exists(SemShiftRightUnsignedExpr e |
+      e = e2 and e.getLeftOperand() = e1 and e.getRightOperand() = c and factor = 2.pow(k)
+    )
+  )
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for `v` at `pos`.
+ * - `upper = true`  : `v <= b + delta`
+ * - `upper = false` : `v >= b + delta`
+ */
+private predicate boundedSsa(
+  SemSsaVariable v, SemSsaReadPosition pos, SemBound b, int delta, boolean upper,
+  boolean fromBackEdge, int origdelta, SemReason reason
+) {
+  exists(SemExpr mid, int d1, int d2, SemReason r1, SemReason r2 |
+    boundFlowStepSsa(v, pos, mid, d1, upper, r1) and
+    bounded(mid, b, d2, upper, fromBackEdge, origdelta, r2) and
+    // upper = true:  v <= mid + d1 <= b + d1 + d2 = b + delta
+    // upper = false: v >= mid + d1 >= b + d1 + d2 = b + delta
+    delta = d1 + d2 and
+    (if r1 instanceof SemNoReason then reason = r2 else reason = r1)
+  )
+  or
+  exists(int d, SemReason r1, SemReason r2 |
+    boundedSsa(v, pos, b, d, upper, fromBackEdge, origdelta, r2) or
+    boundedPhi(v, b, d, upper, fromBackEdge, origdelta, r2)
+  |
+    unequalIntegralSsa(v, pos, b, d, r1) and
+    (
+      upper = true and delta = d - 1
+      or
+      upper = false and delta = d + 1
+    ) and
+    (
+      reason = r1
+      or
+      reason = r2 and not r2 instanceof SemNoReason
+    )
+  )
+}
+
+/**
+ * Holds if `v != b + delta` at `pos` and `v` is of integral type.
+ */
+private predicate unequalIntegralSsa(
+  SemSsaVariable v, SemSsaReadPosition pos, SemBound b, int delta, SemReason reason
+) {
+  exists(SemExpr e, int d1, int d2 |
+    unequalFlowStepIntegralSsa(v, pos, e, d1, reason) and
+    boundedUpper(e, b, d1) and
+    boundedLower(e, b, d2) and
+    delta = d2 + d1
+  )
+}
+
+/**
+ * Holds if `b + delta` is an upper bound for `e`.
+ *
+ * This predicate only exists to prevent a bad standard order in `unequalIntegralSsa`.
+ */
+pragma[nomagic]
+private predicate boundedUpper(SemExpr e, SemBound b, int delta) {
+  bounded(e, b, delta, true, _, _, _)
+}
+
+/**
+ * Holds if `b + delta` is a lower bound for `e`.
+ *
+ * This predicate only exists to prevent a bad standard order in `unequalIntegralSsa`.
+ */
+pragma[nomagic]
+private predicate boundedLower(SemExpr e, SemBound b, int delta) {
+  bounded(e, b, delta, false, _, _, _)
+}
+
+/** Weakens a delta to lie in the range `[-1..1]`. */
+bindingset[delta, upper]
+private int weakenDelta(boolean upper, int delta) {
+  delta in [-1 .. 1] and result = delta
+  or
+  upper = true and result = -1 and delta < -1
+  or
+  upper = false and result = 1 and delta > 1
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for `inp` when used as an input to
+ * `phi` along `edge`.
+ * - `upper = true`  : `inp <= b + delta`
+ * - `upper = false` : `inp >= b + delta`
+ */
+private predicate boundedPhiInp(
+  SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, SemBound b, int delta,
+  boolean upper, boolean fromBackEdge, int origdelta, SemReason reason
+) {
+  edge.phiInput(phi, inp) and
+  exists(int d, boolean fromBackEdge0 |
+    boundedSsa(inp, edge, b, d, upper, fromBackEdge0, origdelta, reason)
+    or
+    boundedPhi(inp, b, d, upper, fromBackEdge0, origdelta, reason)
+    or
+    b.(SemSsaBound).getAVariable() = inp and
+    d = 0 and
+    (upper = true or upper = false) and
+    fromBackEdge0 = false and
+    origdelta = 0 and
+    reason = TSemNoReason()
+  |
+    if semBackEdge(phi, inp, edge)
+    then
+      fromBackEdge = true and
+      (
+        fromBackEdge0 = true and delta = weakenDelta(upper, d - origdelta) + origdelta
+        or
+        fromBackEdge0 = false and delta = d
+      )
+    else (
+      delta = d and fromBackEdge = fromBackEdge0
+    )
+  )
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for `inp` when used as an input to
+ * `phi` along `edge`.
+ * - `upper = true`  : `inp <= b + delta`
+ * - `upper = false` : `inp >= b + delta`
+ *
+ * Equivalent to `boundedPhiInp(phi, inp, edge, b, delta, upper, _, _, _)`.
+ */
+pragma[noinline]
+private predicate boundedPhiInp1(
+  SemSsaPhiNode phi, SemBound b, boolean upper, SemSsaVariable inp,
+  SemSsaReadPositionPhiInputEdge edge, int delta
+) {
+  boundedPhiInp(phi, inp, edge, b, delta, upper, _, _, _)
+}
+
+/**
+ * Holds if `phi` is a valid bound for `inp` when used as an input to `phi`
+ * along `edge`.
+ * - `upper = true`  : `inp <= phi`
+ * - `upper = false` : `inp >= phi`
+ */
+private predicate selfBoundedPhiInp(
+  SemSsaPhiNode phi, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge, boolean upper
+) {
+  exists(int d, SemSsaBound phibound |
+    phibound.getAVariable() = phi and
+    boundedPhiInp(phi, inp, edge, phibound, d, upper, _, _, _) and
+    (
+      upper = true and d <= 0
+      or
+      upper = false and d >= 0
+    )
+  )
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for some input, `inp`, to `phi`, and
+ * thus a candidate bound for `phi`.
+ * - `upper = true`  : `inp <= b + delta`
+ * - `upper = false` : `inp >= b + delta`
+ */
+pragma[noinline]
+private predicate boundedPhiCand(
+  SemSsaPhiNode phi, boolean upper, SemBound b, int delta, boolean fromBackEdge, int origdelta,
+  SemReason reason
+) {
+  boundedPhiInp(phi, _, _, b, delta, upper, fromBackEdge, origdelta, reason)
+}
+
+/**
+ * Holds if the candidate bound `b + delta` for `phi` is valid for the phi input
+ * `inp` along `edge`.
+ */
+private predicate boundedPhiCandValidForEdge(
+  SemSsaPhiNode phi, SemBound b, int delta, boolean upper, boolean fromBackEdge, int origdelta,
+  SemReason reason, SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge
+) {
+  boundedPhiCand(phi, upper, b, delta, fromBackEdge, origdelta, reason) and
+  (
+    exists(int d | boundedPhiInp1(phi, b, upper, inp, edge, d) | upper = true and d <= delta)
+    or
+    exists(int d | boundedPhiInp1(phi, b, upper, inp, edge, d) | upper = false and d >= delta)
+    or
+    selfBoundedPhiInp(phi, inp, edge, upper)
+  )
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for `phi`.
+ * - `upper = true`  : `phi <= b + delta`
+ * - `upper = false` : `phi >= b + delta`
+ */
+private predicate boundedPhi(
+  SemSsaPhiNode phi, SemBound b, int delta, boolean upper, boolean fromBackEdge, int origdelta,
+  SemReason reason
+) {
+  forex(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge | edge.phiInput(phi, inp) |
+    boundedPhiCandValidForEdge(phi, b, delta, upper, fromBackEdge, origdelta, reason, inp, edge)
+  )
+}
+
+/**
+ * Holds if `e` has an upper (for `upper = true`) or lower
+ * (for `upper = false`) bound of `b`.
+ */
+private predicate baseBound(SemExpr e, int b, boolean upper) {
+  Specific::hasConstantBound(e, b, upper)
+  or
+  upper = false and
+  b = 0 and
+  semPositive(e.(SemBitAndExpr).getAnOperand()) and
+  // REVIEW: We let the language opt out here to preserve original results.
+  not Specific::ignoreZeroLowerBound(e)
+}
+
+/**
+ * Holds if the value being cast has an upper (for `upper = true`) or lower
+ * (for `upper = false`) bound within the bounds of the resulting type.
+ * For `upper = true` this means that the cast will not overflow and for
+ * `upper = false` this means that the cast will not underflow.
+ */
+private predicate safeNarrowingCast(NarrowingCastExpr cast, boolean upper) {
+  exists(int bound | bounded(cast.getOperand(), any(SemZeroBound zb), bound, upper, _, _, _) |
+    upper = true and bound <= cast.getUpperBound()
+    or
+    upper = false and bound >= cast.getLowerBound()
+  )
+}
+
+pragma[noinline]
+private predicate boundedCastExpr(
+  NarrowingCastExpr cast, SemBound b, int delta, boolean upper, boolean fromBackEdge, int origdelta,
+  SemReason reason
+) {
+  bounded(cast.getOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
+}
+
+/**
+ * Holds if `b + delta` is a valid bound for `e`.
+ * - `upper = true`  : `e <= b + delta`
+ * - `upper = false` : `e >= b + delta`
+ */
+private predicate bounded(
+  SemExpr e, SemBound b, int delta, boolean upper, boolean fromBackEdge, int origdelta,
+  SemReason reason
+) {
+  not Specific::ignoreExprBound(e) and
+  (
+    e = b.getExpr(delta) and
+    (upper = true or upper = false) and
+    fromBackEdge = false and
+    origdelta = delta and
+    reason = TSemNoReason()
+    or
+    baseBound(e, delta, upper) and
+    b instanceof SemZeroBound and
+    fromBackEdge = false and
+    origdelta = delta and
+    reason = TSemNoReason()
+    or
+    exists(SemSsaVariable v, SemSsaReadPositionBlock bb |
+      boundedSsa(v, bb, b, delta, upper, fromBackEdge, origdelta, reason) and
+      e = v.getAUse() and
+      bb.getBlock() = e.getBasicBlock()
+    )
+    or
+    exists(SemExpr mid, int d1, int d2 |
+      boundFlowStep(e, mid, d1, upper) and
+      // Constants have easy, base-case bounds, so let's not infer any recursive bounds.
+      not e instanceof SemConstantIntegerExpr and
+      bounded(mid, b, d2, upper, fromBackEdge, origdelta, reason) and
+      // upper = true:  e <= mid + d1 <= b + d1 + d2 = b + delta
+      // upper = false: e >= mid + d1 >= b + d1 + d2 = b + delta
+      delta = d1 + d2
+    )
+    or
+    exists(SemSsaPhiNode phi |
+      boundedPhi(phi, b, delta, upper, fromBackEdge, origdelta, reason) and
+      e = phi.getAUse()
+    )
+    or
+    exists(SemExpr mid, int factor, int d |
+      boundFlowStepMul(e, mid, factor) and
+      not e instanceof SemConstantIntegerExpr and
+      bounded(mid, b, d, upper, fromBackEdge, origdelta, reason) and
+      b instanceof SemZeroBound and
+      delta = d * factor
+    )
+    or
+    exists(SemExpr mid, int factor, int d |
+      boundFlowStepDiv(e, mid, factor) and
+      not e instanceof SemConstantIntegerExpr and
+      bounded(mid, b, d, upper, fromBackEdge, origdelta, reason) and
+      b instanceof SemZeroBound and
+      d >= 0 and
+      delta = d / factor
+    )
+    or
+    exists(NarrowingCastExpr cast |
+      cast = e and
+      safeNarrowingCast(cast, upper.booleanNot()) and
+      boundedCastExpr(cast, b, delta, upper, fromBackEdge, origdelta, reason)
+    )
+    or
+    exists(
+      SemConditionalExpr cond, int d1, int d2, boolean fbe1, boolean fbe2, int od1, int od2,
+      SemReason r1, SemReason r2
+    |
+      cond = e and
+      boundedConditionalExpr(cond, b, upper, true, d1, fbe1, od1, r1) and
+      boundedConditionalExpr(cond, b, upper, false, d2, fbe2, od2, r2) and
+      (
+        delta = d1 and fromBackEdge = fbe1 and origdelta = od1 and reason = r1
+        or
+        delta = d2 and fromBackEdge = fbe2 and origdelta = od2 and reason = r2
+      )
+    |
+      upper = true and delta = d1.maximum(d2)
+      or
+      upper = false and delta = d1.minimum(d2)
+    )
+  )
+}
+
+private predicate boundedConditionalExpr(
+  SemConditionalExpr cond, SemBound b, boolean upper, boolean branch, int delta,
+  boolean fromBackEdge, int origdelta, SemReason reason
+) {
+  bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
+}

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisSpecific.qll

@@ -3,90 +3,86 @@
  */
 
 private import experimental.semmle.code.cpp.semantic.Semantic
-private import RangeAnalysisStage
-private import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
 
-module CppLangImpl implements LangSig<FloatDelta> {
-  /**
-   * Holds if the specified expression should be excluded from the result of `ssaRead()`.
-   *
-   * This predicate is to keep the results identical to the original Java implementation. It should be
-   * removed once we have the new implementation matching the old results exactly.
-   */
-  predicate ignoreSsaReadCopy(SemExpr e) { none() }
+/**
+ * Holds if the specified expression should be excluded from the result of `ssaRead()`.
+ *
+ * This predicate is to keep the results identical to the original Java implementation. It should be
+ * removed once we have the new implementation matching the old results exactly.
+ */
+predicate ignoreSsaReadCopy(SemExpr e) { none() }
 
-  /**
-   * Ignore the bound on this expression.
-   *
-   * This predicate is to keep the results identical to the original Java implementation. It should be
-   * removed once we have the new implementation matching the old results exactly.
-   */
-  predicate ignoreExprBound(SemExpr e) { none() }
+/**
+ * Ignore the bound on this expression.
+ *
+ * This predicate is to keep the results identical to the original Java implementation. It should be
+ * removed once we have the new implementation matching the old results exactly.
+ */
+predicate ignoreExprBound(SemExpr e) { none() }
 
-  /**
-   * Ignore any inferred zero lower bound on this expression.
-   *
-   * This predicate is to keep the results identical to the original Java implementation. It should be
-   * removed once we have the new implementation matching the old results exactly.
-   */
-  predicate ignoreZeroLowerBound(SemExpr e) { none() }
+/**
+ * Ignore any inferred zero lower bound on this expression.
+ *
+ * This predicate is to keep the results identical to the original Java implementation. It should be
+ * removed once we have the new implementation matching the old results exactly.
+ */
+predicate ignoreZeroLowerBound(SemExpr e) { none() }
 
-  /**
-   * Holds if the specified expression should be excluded from the result of `ssaRead()`.
-   *
-   * This predicate is to keep the results identical to the original Java implementation. It should be
-   * removed once we have the new implementation matching the old results exactly.
-   */
-  predicate ignoreSsaReadArithmeticExpr(SemExpr e) { none() }
+/**
+ * Holds if the specified expression should be excluded from the result of `ssaRead()`.
+ *
+ * This predicate is to keep the results identical to the original Java implementation. It should be
+ * removed once we have the new implementation matching the old results exactly.
+ */
+predicate ignoreSsaReadArithmeticExpr(SemExpr e) { none() }
 
-  /**
-   * Holds if the specified variable should be excluded from the result of `ssaRead()`.
-   *
-   * This predicate is to keep the results identical to the original Java implementation. It should be
-   * removed once we have the new implementation matching the old results exactly.
-   */
-  predicate ignoreSsaReadAssignment(SemSsaVariable v) { none() }
+/**
+ * Holds if the specified variable should be excluded from the result of `ssaRead()`.
+ *
+ * This predicate is to keep the results identical to the original Java implementation. It should be
+ * removed once we have the new implementation matching the old results exactly.
+ */
+predicate ignoreSsaReadAssignment(SemSsaVariable v) { none() }
 
-  /**
-   * Adds additional results to `ssaRead()` that are specific to Java.
-   *
-   * This predicate handles propagation of offsets for post-increment and post-decrement expressions
-   * in exactly the same way as the old Java implementation. Once the new implementation matches the
-   * old one, we should remove this predicate and propagate deltas for all similar patterns, whether
-   * or not they come from a post-increment/decrement expression.
-   */
-  SemExpr specificSsaRead(SemSsaVariable v, float delta) { none() }
+/**
+ * Adds additional results to `ssaRead()` that are specific to Java.
+ *
+ * This predicate handles propagation of offsets for post-increment and post-decrement expressions
+ * in exactly the same way as the old Java implementation. Once the new implementation matches the
+ * old one, we should remove this predicate and propagate deltas for all similar patterns, whether
+ * or not they come from a post-increment/decrement expression.
+ */
+SemExpr specificSsaRead(SemSsaVariable v, int delta) { none() }
 
-  /**
-   * Holds if `e >= bound` (if `upper = false`) or `e <= bound` (if `upper = true`).
-   */
-  predicate hasConstantBound(SemExpr e, float bound, boolean upper) { none() }
+/**
+ * Holds if `e >= bound` (if `upper = false`) or `e <= bound` (if `upper = true`).
+ */
+predicate hasConstantBound(SemExpr e, int bound, boolean upper) { none() }
 
-  /**
-   * Holds if `e >= bound + delta` (if `upper = false`) or `e <= bound + delta` (if `upper = true`).
-   */
-  predicate hasBound(SemExpr e, SemExpr bound, float delta, boolean upper) { none() }
+/**
+ * Holds if `e >= bound + delta` (if `upper = false`) or `e <= bound + delta` (if `upper = true`).
+ */
+predicate hasBound(SemExpr e, SemExpr bound, int delta, boolean upper) { none() }
 
-  /**
-   * Holds if the value of `dest` is known to be `src + delta`.
-   */
-  predicate additionalValueFlowStep(SemExpr dest, SemExpr src, float delta) { none() }
+/**
+ * Holds if the value of `dest` is known to be `src + delta`.
+ */
+predicate additionalValueFlowStep(SemExpr dest, SemExpr src, int delta) { none() }
 
-  /**
-   * Gets the type that range analysis should use to track the result of the specified expression,
-   * if a type other than the original type of the expression is to be used.
-   *
-   * This predicate is commonly used in languages that support immutable "boxed" types that are
-   * actually references but whose values can be tracked as the type contained in the box.
-   */
-  SemType getAlternateType(SemExpr e) { none() }
+/**
+ * Gets the type that range analysis should use to track the result of the specified expression,
+ * if a type other than the original type of the expression is to be used.
+ *
+ * This predicate is commonly used in languages that support immutable "boxed" types that are
+ * actually references but whose values can be tracked as the type contained in the box.
+ */
+SemType getAlternateType(SemExpr e) { none() }
 
-  /**
-   * Gets the type that range analysis should use to track the result of the specified source
-   * variable, if a type other than the original type of the expression is to be used.
-   *
-   * This predicate is commonly used in languages that support immutable "boxed" types that are
-   * actually references but whose values can be tracked as the type contained in the box.
-   */
-  SemType getAlternateTypeForSsaVariable(SemSsaVariable var) { none() }
-}
+/**
+ * Gets the type that range analysis should use to track the result of the specified source
+ * variable, if a type other than the original type of the expression is to be used.
+ *
+ * This predicate is commonly used in languages that support immutable "boxed" types that are
+ * actually references but whose values can be tracked as the type contained in the box.
+ */
+SemType getAlternateTypeForSsaVariable(SemSsaVariable var) { none() }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeUtils.qll

@@ -3,138 +3,133 @@
  */
 
 private import experimental.semmle.code.cpp.semantic.Semantic
-private import RangeAnalysisSpecific
-private import RangeAnalysisStage as Range
+private import RangeAnalysisSpecific as Specific
 private import ConstantAnalysis
 
-module RangeUtil<Range::DeltaSig D, Range::LangSig<D> Lang> implements Range::UtilSig<D> {
-  /**
-   * Gets an expression that equals `v - d`.
-   */
-  SemExpr semSsaRead(SemSsaVariable v, D::Delta delta) {
-    // There are various language-specific extension points that can be removed once we no longer
-    // expect to match the original Java implementation's results exactly.
-    result = v.getAUse() and delta = D::fromInt(0)
-    or
-    exists(D::Delta d1, SemConstantIntegerExpr c |
-      result.(SemAddExpr).hasOperands(semSsaRead(v, d1), c) and
-      delta = D::fromFloat(D::toFloat(d1) - c.getIntValue()) and
-      not Lang::ignoreSsaReadArithmeticExpr(result)
-    )
-    or
-    exists(SemSubExpr sub, D::Delta d1, SemConstantIntegerExpr c |
-      result = sub and
-      sub.getLeftOperand() = semSsaRead(v, d1) and
-      sub.getRightOperand() = c and
-      delta = D::fromFloat(D::toFloat(d1) + c.getIntValue()) and
-      not Lang::ignoreSsaReadArithmeticExpr(result)
-    )
-    or
-    result = v.(SemSsaExplicitUpdate).getSourceExpr() and
-    delta = D::fromFloat(0) and
-    not Lang::ignoreSsaReadAssignment(v)
-    or
-    result = Lang::specificSsaRead(v, delta)
-    or
-    result.(SemCopyValueExpr).getOperand() = semSsaRead(v, delta) and
-    not Lang::ignoreSsaReadCopy(result)
-    or
-    result.(SemStoreExpr).getOperand() = semSsaRead(v, delta)
-  }
-
-  /**
-   * Gets a condition that tests whether `v` equals `e + delta`.
-   *
-   * If the condition evaluates to `testIsTrue`:
-   * - `isEq = true`  : `v == e + delta`
-   * - `isEq = false` : `v != e + delta`
-   */
-  SemGuard semEqFlowCond(
-    SemSsaVariable v, SemExpr e, D::Delta delta, boolean isEq, boolean testIsTrue
-  ) {
-    exists(boolean eqpolarity |
-      result.isEquality(semSsaRead(v, delta), e, eqpolarity) and
-      (testIsTrue = true or testIsTrue = false) and
-      eqpolarity.booleanXor(testIsTrue).booleanNot() = isEq
-    )
-    or
-    exists(boolean testIsTrue0 |
-      semImplies_v2(result, testIsTrue, semEqFlowCond(v, e, delta, isEq, testIsTrue0), testIsTrue0)
-    )
-  }
-
-  /**
-   * Holds if `v` is an `SsaExplicitUpdate` that equals `e + delta`.
-   */
-  predicate semSsaUpdateStep(SemSsaExplicitUpdate v, SemExpr e, D::Delta delta) {
-    exists(SemExpr defExpr | defExpr = v.getSourceExpr() |
-      defExpr.(SemCopyValueExpr).getOperand() = e and delta = D::fromFloat(0)
-      or
-      defExpr.(SemStoreExpr).getOperand() = e and delta = D::fromFloat(0)
-      or
-      defExpr.(SemAddOneExpr).getOperand() = e and delta = D::fromFloat(1)
-      or
-      defExpr.(SemSubOneExpr).getOperand() = e and delta = D::fromFloat(-1)
-      or
-      e = defExpr and
-      not (
-        defExpr instanceof SemCopyValueExpr or
-        defExpr instanceof SemStoreExpr or
-        defExpr instanceof SemAddOneExpr or
-        defExpr instanceof SemSubOneExpr
-      ) and
-      delta = D::fromFloat(0)
-    )
-  }
-
-  /**
-   * Holds if `e1 + delta` equals `e2`.
-   */
-  predicate semValueFlowStep(SemExpr e2, SemExpr e1, D::Delta delta) {
-    e2.(SemCopyValueExpr).getOperand() = e1 and delta = D::fromFloat(0)
-    or
-    e2.(SemStoreExpr).getOperand() = e1 and delta = D::fromFloat(0)
-    or
-    e2.(SemAddOneExpr).getOperand() = e1 and delta = D::fromFloat(1)
-    or
-    e2.(SemSubOneExpr).getOperand() = e1 and delta = D::fromFloat(-1)
-    or
-    Lang::additionalValueFlowStep(e2, e1, delta)
-    or
-    exists(SemExpr x | e2.(SemAddExpr).hasOperands(e1, x) |
-      D::fromInt(x.(SemConstantIntegerExpr).getIntValue()) = delta
-    )
-    or
-    exists(SemExpr x, SemSubExpr sub |
-      e2 = sub and
-      sub.getLeftOperand() = e1 and
-      sub.getRightOperand() = x
-    |
-      D::fromInt(-x.(SemConstantIntegerExpr).getIntValue()) = delta
-    )
-  }
-
-  /**
-   * Gets the type used to track the specified expression's range information.
-   *
-   * Usually, this just `e.getSemType()`, but the language can override this to track immutable boxed
-   * primitive types as the underlying primitive type.
-   */
-  SemType getTrackedType(SemExpr e) {
-    result = Lang::getAlternateType(e)
-    or
-    not exists(Lang::getAlternateType(e)) and result = e.getSemType()
-  }
-
-  /**
-   * Gets the type used to track the specified source variable's range information.
-   *
-   * Usually, this just `e.getType()`, but the language can override this to track immutable boxed
-   * primitive types as the underlying primitive type.
-   */
-  SemType getTrackedTypeForSsaVariable(SemSsaVariable var) {
-    result = Lang::getAlternateTypeForSsaVariable(var)
-    or
-    not exists(Lang::getAlternateTypeForSsaVariable(var)) and result = var.getType()
-  }
+/**
+ * Gets an expression that equals `v - d`.
+ */
+SemExpr semSsaRead(SemSsaVariable v, int delta) {
+  // There are various language-specific extension points that can be removed once we no longer
+  // expect to match the original Java implementation's results exactly.
+  result = v.getAUse() and delta = 0
+  or
+  exists(int d1, SemConstantIntegerExpr c |
+    result.(SemAddExpr).hasOperands(semSsaRead(v, d1), c) and
+    delta = d1 - c.getIntValue() and
+    not Specific::ignoreSsaReadArithmeticExpr(result)
+  )
+  or
+  exists(SemSubExpr sub, int d1, SemConstantIntegerExpr c |
+    result = sub and
+    sub.getLeftOperand() = semSsaRead(v, d1) and
+    sub.getRightOperand() = c and
+    delta = d1 + c.getIntValue() and
+    not Specific::ignoreSsaReadArithmeticExpr(result)
+  )
+  or
+  result = v.(SemSsaExplicitUpdate).getSourceExpr() and
+  delta = 0 and
+  not Specific::ignoreSsaReadAssignment(v)
+  or
+  result = Specific::specificSsaRead(v, delta)
+  or
+  result.(SemCopyValueExpr).getOperand() = semSsaRead(v, delta) and
+  not Specific::ignoreSsaReadCopy(result)
+  or
+  result.(SemStoreExpr).getOperand() = semSsaRead(v, delta)
+}
+
+/**
+ * Gets a condition that tests whether `v` equals `e + delta`.
+ *
+ * If the condition evaluates to `testIsTrue`:
+ * - `isEq = true`  : `v == e + delta`
+ * - `isEq = false` : `v != e + delta`
+ */
+SemGuard semEqFlowCond(SemSsaVariable v, SemExpr e, int delta, boolean isEq, boolean testIsTrue) {
+  exists(boolean eqpolarity |
+    result.isEquality(semSsaRead(v, delta), e, eqpolarity) and
+    (testIsTrue = true or testIsTrue = false) and
+    eqpolarity.booleanXor(testIsTrue).booleanNot() = isEq
+  )
+  or
+  exists(boolean testIsTrue0 |
+    semImplies_v2(result, testIsTrue, semEqFlowCond(v, e, delta, isEq, testIsTrue0), testIsTrue0)
+  )
+}
+
+/**
+ * Holds if `v` is an `SsaExplicitUpdate` that equals `e + delta`.
+ */
+predicate semSsaUpdateStep(SemSsaExplicitUpdate v, SemExpr e, int delta) {
+  exists(SemExpr defExpr | defExpr = v.getSourceExpr() |
+    defExpr.(SemCopyValueExpr).getOperand() = e and delta = 0
+    or
+    defExpr.(SemStoreExpr).getOperand() = e and delta = 0
+    or
+    defExpr.(SemAddOneExpr).getOperand() = e and delta = 1
+    or
+    defExpr.(SemSubOneExpr).getOperand() = e and delta = -1
+    or
+    e = defExpr and
+    not (
+      defExpr instanceof SemCopyValueExpr or
+      defExpr instanceof SemStoreExpr or
+      defExpr instanceof SemAddOneExpr or
+      defExpr instanceof SemSubOneExpr
+    ) and
+    delta = 0
+  )
+}
+
+/**
+ * Holds if `e1 + delta` equals `e2`.
+ */
+predicate semValueFlowStep(SemExpr e2, SemExpr e1, int delta) {
+  e2.(SemCopyValueExpr).getOperand() = e1 and delta = 0
+  or
+  e2.(SemStoreExpr).getOperand() = e1 and delta = 0
+  or
+  e2.(SemAddOneExpr).getOperand() = e1 and delta = 1
+  or
+  e2.(SemSubOneExpr).getOperand() = e1 and delta = -1
+  or
+  Specific::additionalValueFlowStep(e2, e1, delta)
+  or
+  exists(SemExpr x | e2.(SemAddExpr).hasOperands(e1, x) |
+    x.(SemConstantIntegerExpr).getIntValue() = delta
+  )
+  or
+  exists(SemExpr x, SemSubExpr sub |
+    e2 = sub and
+    sub.getLeftOperand() = e1 and
+    sub.getRightOperand() = x
+  |
+    x.(SemConstantIntegerExpr).getIntValue() = -delta
+  )
+}
+
+/**
+ * Gets the type used to track the specified expression's range information.
+ *
+ * Usually, this just `e.getSemType()`, but the language can override this to track immutable boxed
+ * primitive types as the underlying primitive type.
+ */
+SemType getTrackedType(SemExpr e) {
+  result = Specific::getAlternateType(e)
+  or
+  not exists(Specific::getAlternateType(e)) and result = e.getSemType()
+}
+
+/**
+ * Gets the type used to track the specified source variable's range information.
+ *
+ * Usually, this just `e.getType()`, but the language can override this to track immutable boxed
+ * primitive types as the underlying primitive type.
+ */
+SemType getTrackedTypeForSsaVariable(SemSsaVariable var) {
+  result = Specific::getAlternateTypeForSsaVariable(var)
+  or
+  not exists(Specific::getAlternateTypeForSsaVariable(var)) and result = var.getType()
 }

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SignAnalysisCommon.qll

@@ -6,494 +6,488 @@
  * three-valued domain `{negative, zero, positive}`.
  */
 
-private import RangeAnalysisStage
 private import SignAnalysisSpecific as Specific
 private import experimental.semmle.code.cpp.semantic.Semantic
 private import ConstantAnalysis
 private import RangeUtils
 private import Sign
 
-module SignAnalysis<DeltaSig D, UtilSig<D> Utils> {
-  /**
-   * An SSA definition for which the analysis can compute the sign.
-   *
-   * The actual computation of the sign is done in an override of the `getSign()` predicate. The
-   * charpred of any subclass must _not_ invoke `getSign()`, directly or indirectly. This ensures
-   * that the charpred does not introduce negative recursion. The `getSign()` predicate may be
-   * recursive.
-   */
-  abstract private class SignDef instanceof SemSsaVariable {
-    final string toString() { result = super.toString() }
+/**
+ * An SSA definition for which the analysis can compute the sign.
+ *
+ * The actual computation of the sign is done in an override of the `getSign()` predicate. The
+ * charpred of any subclass must _not_ invoke `getSign()`, directly or indirectly. This ensures
+ * that the charpred does not introduce negative recursion. The `getSign()` predicate may be
+ * recursive.
+ */
+abstract private class SignDef instanceof SemSsaVariable {
+  final string toString() { result = super.toString() }
 
-    /** Gets the possible signs of this SSA definition. */
-    abstract Sign getSign();
-  }
+  /** Gets the possible signs of this SSA definition. */
+  abstract Sign getSign();
+}
 
-  /** An SSA definition whose sign is computed based on standard flow. */
-  abstract private class FlowSignDef extends SignDef {
-    abstract override Sign getSign();
-  }
+/** An SSA definition whose sign is computed based on standard flow. */
+abstract private class FlowSignDef extends SignDef {
+  abstract override Sign getSign();
+}
 
-  /** An SSA definition whose sign is determined by the sign of that definitions source expression. */
-  private class ExplicitSignDef extends FlowSignDef instanceof SemSsaExplicitUpdate {
-    final override Sign getSign() { result = semExprSign(super.getSourceExpr()) }
-  }
+/** An SSA definition whose sign is determined by the sign of that definitions source expression. */
+private class ExplicitSignDef extends FlowSignDef instanceof SemSsaExplicitUpdate {
+  final override Sign getSign() { result = semExprSign(super.getSourceExpr()) }
+}
 
-  /** An SSA Phi definition, whose sign is the union of the signs of its inputs. */
-  private class PhiSignDef extends FlowSignDef instanceof SemSsaPhiNode {
-    final override Sign getSign() {
-      exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
-        edge.phiInput(this, inp) and
-        result = semSsaSign(inp, edge)
-      )
-    }
-  }
-
-  /** An SSA definition whose sign is computed by a language-specific implementation. */
-  abstract class CustomSignDef extends SignDef {
-    abstract override Sign getSign();
-  }
-
-  /**
-   * An expression for which the analysis can compute the sign.
-   *
-   * The actual computation of the sign is done in an override of the `getSign()` predicate. The
-   * charpred of any subclass must _not_ invoke `getSign()`, directly or indirectly. This ensures
-   * that the charpred does not introduce negative recursion. The `getSign()` predicate may be
-   * recursive.
-   *
-   * Concrete implementations extend one of the following subclasses:
-   * - `ConstantSignExpr`, for expressions with a compile-time constant value.
-   * - `FlowSignExpr`, for expressions whose sign can be computed from the signs of their operands.
-   * - `CustomsignExpr`, for expressions whose sign can be computed by a language-specific
-   *   implementation.
-   *
-   * If the same expression matches more than one of the above subclasses, the sign is computed as
-   * follows:
-   * - The sign of a `ConstantSignExpr` is computed solely from `ConstantSignExpr.getSign()`,
-   *   regardless of any other subclasses.
-   * - If a non-`ConstantSignExpr` expression matches exactly one of `FlowSignExpr` or
-   *   `CustomSignExpr`, the sign is computed by that class' `getSign()` predicate.
-   * - If a non-`ConstantSignExpr` expression matches both `FlowSignExpr` and `CustomSignExpr`, the
-   *   sign is the _intersection_ of the signs of those two classes' `getSign()` predicates. Thus,
-   *   both classes have the opportunity to _restrict_ the set of possible signs, not to generate new
-   *   possible signs.
-   * - If an expression does not match any of the three subclasses, then it can have any sign.
-   *
-   * Note that the `getSign()` predicate is introduced only in subclasses of `SignExpr`.
-   */
-  abstract class SignExpr instanceof SemExpr {
-    SignExpr() { not Specific::ignoreExprSign(this) }
-
-    final string toString() { result = super.toString() }
-
-    abstract Sign getSign();
-  }
-
-  /** An expression whose sign is determined by its constant numeric value. */
-  private class ConstantSignExpr extends SignExpr {
-    ConstantSignExpr() {
-      this instanceof SemConstantIntegerExpr or
-      exists(this.(SemNumericLiteralExpr).getApproximateFloatValue())
-    }
-
-    final override Sign getSign() {
-      exists(int i | this.(SemConstantIntegerExpr).getIntValue() = i |
-        i < 0 and result = TNeg()
-        or
-        i = 0 and result = TZero()
-        or
-        i > 0 and result = TPos()
-      )
-      or
-      not exists(this.(SemConstantIntegerExpr).getIntValue()) and
-      exists(float f | f = this.(SemNumericLiteralExpr).getApproximateFloatValue() |
-        f < 0 and result = TNeg()
-        or
-        f = 0 and result = TZero()
-        or
-        f > 0 and result = TPos()
-      )
-    }
-  }
-
-  abstract private class NonConstantSignExpr extends SignExpr {
-    NonConstantSignExpr() { not this instanceof ConstantSignExpr }
-
-    final override Sign getSign() {
-      // The result is the _intersection_ of the signs computed from flow and by the language.
-      (result = this.(FlowSignExpr).getSignRestriction() or not this instanceof FlowSignExpr) and
-      (result = this.(CustomSignExpr).getSignRestriction() or not this instanceof CustomSignExpr)
-    }
-  }
-
-  /** An expression whose sign is computed from the signs of its operands. */
-  abstract private class FlowSignExpr extends NonConstantSignExpr {
-    abstract Sign getSignRestriction();
-  }
-
-  /** An expression whose sign is computed by a language-specific implementation. */
-  abstract class CustomSignExpr extends NonConstantSignExpr {
-    abstract Sign getSignRestriction();
-  }
-
-  /** An expression whose sign is unknown. */
-  private class UnknownSignExpr extends SignExpr {
-    UnknownSignExpr() {
-      not this instanceof FlowSignExpr and
-      not this instanceof CustomSignExpr and
-      not this instanceof ConstantSignExpr and
-      (
-        // Only track numeric types.
-        Utils::getTrackedType(this) instanceof SemNumericType
-        or
-        // Unless the language says to track this expression anyway.
-        Specific::trackUnknownNonNumericExpr(this)
-      )
-    }
-
-    final override Sign getSign() { semAnySign(result) }
-  }
-
-  /**
-   * A `Load` expression whose sign is computed from the sign of its SSA definition, restricted by
-   * inference from any intervening guards.
-   */
-  class UseSignExpr extends FlowSignExpr {
-    SemSsaVariable v;
-
-    UseSignExpr() { v.getAUse() = this }
-
-    override Sign getSignRestriction() {
-      // Propagate via SSA
-      // Propagate the sign from the def of `v`, incorporating any inference from guards.
-      result = semSsaSign(v, any(SemSsaReadPositionBlock bb | bb.getAnExpr() = this))
-      or
-      // No block for this read. Just use the sign of the def.
-      // REVIEW: How can this happen?
-      not exists(SemSsaReadPositionBlock bb | bb.getAnExpr() = this) and
-      result = semSsaDefSign(v)
-    }
-  }
-
-  /** A binary expression whose sign is computed from the signs of its operands. */
-  private class BinarySignExpr extends FlowSignExpr {
-    SemBinaryExpr binary;
-
-    BinarySignExpr() { binary = this }
-
-    override Sign getSignRestriction() {
-      exists(SemExpr left, SemExpr right |
-        binaryExprOperands(binary, left, right) and
-        result =
-          semExprSign(pragma[only_bind_out](left))
-              .applyBinaryOp(semExprSign(pragma[only_bind_out](right)), binary.getOpcode())
-      )
-      or
-      exists(SemDivExpr div | div = binary |
-        result = semExprSign(div.getLeftOperand()) and
-        result != TZero() and
-        div.getRightOperand().(SemFloatingPointLiteralExpr).getFloatValue() = 0
-      )
-    }
-  }
-
-  pragma[nomagic]
-  private predicate binaryExprOperands(SemBinaryExpr binary, SemExpr left, SemExpr right) {
-    binary.getLeftOperand() = left and binary.getRightOperand() = right
-  }
-
-  /**
-   * A `Convert`, `Box`, or `Unbox` expression.
-   */
-  private class SemCastExpr instanceof SemUnaryExpr {
-    string toString() { result = super.toString() }
-
-    SemCastExpr() {
-      this instanceof SemConvertExpr
-      or
-      this instanceof SemBoxExpr
-      or
-      this instanceof SemUnboxExpr
-    }
-  }
-
-  /** A unary expression whose sign is computed from the sign of its operand. */
-  private class UnarySignExpr extends FlowSignExpr {
-    SemUnaryExpr unary;
-
-    UnarySignExpr() { unary = this and not this instanceof SemCastExpr }
-
-    override Sign getSignRestriction() {
-      result =
-        semExprSign(pragma[only_bind_out](unary.getOperand())).applyUnaryOp(unary.getOpcode())
-    }
-  }
-
-  /**
-   * A `Convert`, `Box`, or `Unbox` expression, whose sign is computed based on
-   * the sign of its operand and the source and destination types.
-   */
-  abstract private class CastSignExpr extends FlowSignExpr {
-    SemUnaryExpr cast;
-
-    CastSignExpr() { cast = this and cast instanceof SemCastExpr }
-
-    override Sign getSignRestriction() { result = semExprSign(cast.getOperand()) }
-  }
-
-  /**
-   * A `Convert` expression.
-   */
-  private class ConvertSignExpr extends CastSignExpr {
-    override SemConvertExpr cast;
-  }
-
-  /**
-   * A `Box` expression.
-   */
-  private class BoxSignExpr extends CastSignExpr {
-    override SemBoxExpr cast;
-  }
-
-  /**
-   * An `Unbox` expression.
-   */
-  private class UnboxSignExpr extends CastSignExpr {
-    override SemUnboxExpr cast;
-
-    UnboxSignExpr() {
-      exists(SemType fromType | fromType = Utils::getTrackedType(cast.getOperand()) |
-        // Only numeric source types are handled here.
-        fromType instanceof SemNumericType
-      )
-    }
-  }
-
-  private predicate unknownSign(SemExpr e) { e instanceof UnknownSignExpr }
-
-  /**
-   * Holds if `lowerbound` is a lower bound for `v` at `pos`. This is restricted
-   * to only include bounds for which we might determine a sign.
-   */
-  private predicate lowerBound(
-    SemExpr lowerbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isStrict
-  ) {
-    exists(boolean testIsTrue, SemRelationalExpr comp |
-      pos.hasReadOfVar(v) and
-      semGuardControlsSsaRead(semGetComparisonGuard(comp), pos, testIsTrue) and
-      not unknownSign(lowerbound)
-    |
-      testIsTrue = true and
-      comp.getLesserOperand() = lowerbound and
-      comp.getGreaterOperand() = Utils::semSsaRead(v, D::fromInt(0)) and
-      (if comp.isStrict() then isStrict = true else isStrict = false)
-      or
-      testIsTrue = false and
-      comp.getGreaterOperand() = lowerbound and
-      comp.getLesserOperand() = Utils::semSsaRead(v, D::fromInt(0)) and
-      (if comp.isStrict() then isStrict = false else isStrict = true)
+/** An SSA Phi definition, whose sign is the union of the signs of its inputs. */
+private class PhiSignDef extends FlowSignDef instanceof SemSsaPhiNode {
+  final override Sign getSign() {
+    exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
+      edge.phiInput(this, inp) and
+      result = semSsaSign(inp, edge)
     )
   }
-
-  /**
-   * Holds if `upperbound` is an upper bound for `v` at `pos`. This is restricted
-   * to only include bounds for which we might determine a sign.
-   */
-  private predicate upperBound(
-    SemExpr upperbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isStrict
-  ) {
-    exists(boolean testIsTrue, SemRelationalExpr comp |
-      pos.hasReadOfVar(v) and
-      semGuardControlsSsaRead(semGetComparisonGuard(comp), pos, testIsTrue) and
-      not unknownSign(upperbound)
-    |
-      testIsTrue = true and
-      comp.getGreaterOperand() = upperbound and
-      comp.getLesserOperand() = Utils::semSsaRead(v, D::fromInt(0)) and
-      (if comp.isStrict() then isStrict = true else isStrict = false)
-      or
-      testIsTrue = false and
-      comp.getLesserOperand() = upperbound and
-      comp.getGreaterOperand() = Utils::semSsaRead(v, D::fromInt(0)) and
-      (if comp.isStrict() then isStrict = false else isStrict = true)
-    )
-  }
-
-  /**
-   * Holds if `eqbound` is an equality/inequality for `v` at `pos`. This is
-   * restricted to only include bounds for which we might determine a sign. The
-   * boolean `isEq` gives the polarity:
-   *  - `isEq = true` : `v = eqbound`
-   *  - `isEq = false` : `v != eqbound`
-   */
-  private predicate eqBound(SemExpr eqbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isEq) {
-    exists(SemGuard guard, boolean testIsTrue, boolean polarity |
-      pos.hasReadOfVar(v) and
-      semGuardControlsSsaRead(guard, pos, testIsTrue) and
-      guard.isEquality(eqbound, Utils::semSsaRead(v, D::fromInt(0)), polarity) and
-      isEq = polarity.booleanXor(testIsTrue).booleanNot() and
-      not unknownSign(eqbound)
-    )
-  }
-
-  /**
-   * Holds if `bound` is a bound for `v` at `pos` that needs to be positive in
-   * order for `v` to be positive.
-   */
-  private predicate posBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    upperBound(bound, v, pos, _) or
-    eqBound(bound, v, pos, true)
-  }
-
-  /**
-   * Holds if `bound` is a bound for `v` at `pos` that needs to be negative in
-   * order for `v` to be negative.
-   */
-  private predicate negBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    lowerBound(bound, v, pos, _) or
-    eqBound(bound, v, pos, true)
-  }
-
-  /**
-   * Holds if `bound` is a bound for `v` at `pos` that can restrict whether `v`
-   * can be zero.
-   */
-  private predicate zeroBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    lowerBound(bound, v, pos, _) or
-    upperBound(bound, v, pos, _) or
-    eqBound(bound, v, pos, _)
-  }
-
-  /** Holds if `bound` allows `v` to be positive at `pos`. */
-  private predicate posBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    posBound(bound, v, pos) and TPos() = semExprSign(bound)
-  }
-
-  /** Holds if `bound` allows `v` to be negative at `pos`. */
-  private predicate negBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    negBound(bound, v, pos) and TNeg() = semExprSign(bound)
-  }
-
-  /** Holds if `bound` allows `v` to be zero at `pos`. */
-  private predicate zeroBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
-    lowerBound(bound, v, pos, _) and TNeg() = semExprSign(bound)
-    or
-    lowerBound(bound, v, pos, false) and TZero() = semExprSign(bound)
-    or
-    upperBound(bound, v, pos, _) and TPos() = semExprSign(bound)
-    or
-    upperBound(bound, v, pos, false) and TZero() = semExprSign(bound)
-    or
-    eqBound(bound, v, pos, true) and TZero() = semExprSign(bound)
-    or
-    eqBound(bound, v, pos, false) and TZero() != semExprSign(bound)
-  }
-
-  /**
-   * Holds if there is a bound that might restrict whether `v` has the sign `s`
-   * at `pos`.
-   */
-  private predicate hasGuard(SemSsaVariable v, SemSsaReadPosition pos, Sign s) {
-    s = TPos() and posBound(_, v, pos)
-    or
-    s = TNeg() and negBound(_, v, pos)
-    or
-    s = TZero() and zeroBound(_, v, pos)
-  }
-
-  /**
-   * Gets a possible sign of `v` at `pos` based on its definition, where the sign
-   * might be ruled out by a guard.
-   */
-  pragma[noinline]
-  private Sign guardedSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
-    result = semSsaDefSign(v) and
-    pos.hasReadOfVar(v) and
-    hasGuard(v, pos, result)
-  }
-
-  /**
-   * Gets a possible sign of `v` at `pos` based on its definition, where no guard
-   * can rule it out.
-   */
-  pragma[noinline]
-  private Sign unguardedSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
-    result = semSsaDefSign(v) and
-    pos.hasReadOfVar(v) and
-    not hasGuard(v, pos, result)
-  }
-
-  /**
-   * Gets a possible sign of `v` at read position `pos`, where a guard could have
-   * ruled out the sign but does not.
-   * This does not check that the definition of `v` also allows the sign.
-   */
-  private Sign guardedSsaSignOk(SemSsaVariable v, SemSsaReadPosition pos) {
-    result = TPos() and
-    forex(SemExpr bound | posBound(bound, v, pos) | posBoundOk(bound, v, pos))
-    or
-    result = TNeg() and
-    forex(SemExpr bound | negBound(bound, v, pos) | negBoundOk(bound, v, pos))
-    or
-    result = TZero() and
-    forex(SemExpr bound | zeroBound(bound, v, pos) | zeroBoundOk(bound, v, pos))
-  }
-
-  /** Gets a possible sign for `v` at `pos`. */
-  private Sign semSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
-    result = unguardedSsaSign(v, pos)
-    or
-    result = guardedSsaSign(v, pos) and
-    result = guardedSsaSignOk(v, pos)
-  }
-
-  /** Gets a possible sign for `v`. */
-  pragma[nomagic]
-  Sign semSsaDefSign(SemSsaVariable v) { result = v.(SignDef).getSign() }
-
-  /** Gets a possible sign for `e`. */
-  cached
-  Sign semExprSign(SemExpr e) {
-    exists(Sign s | s = e.(SignExpr).getSign() |
-      if
-        Utils::getTrackedType(e) instanceof SemUnsignedIntegerType and
-        s = TNeg() and
-        not Specific::ignoreTypeRestrictions(e)
-      then result = TPos()
-      else result = s
-    )
-  }
-
-  /**
-   * Dummy predicate that holds for any sign. This is added to improve readability
-   * of cases where the sign is unrestricted.
-   */
-  predicate semAnySign(Sign s) { any() }
-
-  /** Holds if `e` can be positive and cannot be negative. */
-  predicate semPositive(SemExpr e) {
-    semExprSign(e) = TPos() and
-    not semExprSign(e) = TNeg()
-  }
-
-  /** Holds if `e` can be negative and cannot be positive. */
-  predicate semNegative(SemExpr e) {
-    semExprSign(e) = TNeg() and
-    not semExprSign(e) = TPos()
-  }
-
-  /** Holds if `e` is strictly positive. */
-  predicate semStrictlyPositive(SemExpr e) {
-    semExprSign(e) = TPos() and
-    not semExprSign(e) = TNeg() and
-    not semExprSign(e) = TZero()
-  }
-
-  /** Holds if `e` is strictly negative. */
-  predicate semStrictlyNegative(SemExpr e) {
-    semExprSign(e) = TNeg() and
-    not semExprSign(e) = TPos() and
-    not semExprSign(e) = TZero()
-  }
+}
+
+/** An SSA definition whose sign is computed by a language-specific implementation. */
+abstract class CustomSignDef extends SignDef {
+  abstract override Sign getSign();
+}
+
+/**
+ * An expression for which the analysis can compute the sign.
+ *
+ * The actual computation of the sign is done in an override of the `getSign()` predicate. The
+ * charpred of any subclass must _not_ invoke `getSign()`, directly or indirectly. This ensures
+ * that the charpred does not introduce negative recursion. The `getSign()` predicate may be
+ * recursive.
+ *
+ * Concrete implementations extend one of the following subclasses:
+ * - `ConstantSignExpr`, for expressions with a compile-time constant value.
+ * - `FlowSignExpr`, for expressions whose sign can be computed from the signs of their operands.
+ * - `CustomsignExpr`, for expressions whose sign can be computed by a language-specific
+ *   implementation.
+ *
+ * If the same expression matches more than one of the above subclasses, the sign is computed as
+ * follows:
+ * - The sign of a `ConstantSignExpr` is computed solely from `ConstantSignExpr.getSign()`,
+ *   regardless of any other subclasses.
+ * - If a non-`ConstantSignExpr` expression matches exactly one of `FlowSignExpr` or
+ *   `CustomSignExpr`, the sign is computed by that class' `getSign()` predicate.
+ * - If a non-`ConstantSignExpr` expression matches both `FlowSignExpr` and `CustomSignExpr`, the
+ *   sign is the _intersection_ of the signs of those two classes' `getSign()` predicates. Thus,
+ *   both classes have the opportunity to _restrict_ the set of possible signs, not to generate new
+ *   possible signs.
+ * - If an expression does not match any of the three subclasses, then it can have any sign.
+ *
+ * Note that the `getSign()` predicate is introduced only in subclasses of `SignExpr`.
+ */
+abstract class SignExpr instanceof SemExpr {
+  SignExpr() { not Specific::ignoreExprSign(this) }
+
+  final string toString() { result = super.toString() }
+
+  abstract Sign getSign();
+}
+
+/** An expression whose sign is determined by its constant numeric value. */
+private class ConstantSignExpr extends SignExpr {
+  ConstantSignExpr() {
+    this instanceof SemConstantIntegerExpr or
+    exists(this.(SemNumericLiteralExpr).getApproximateFloatValue())
+  }
+
+  final override Sign getSign() {
+    exists(int i | this.(SemConstantIntegerExpr).getIntValue() = i |
+      i < 0 and result = TNeg()
+      or
+      i = 0 and result = TZero()
+      or
+      i > 0 and result = TPos()
+    )
+    or
+    not exists(this.(SemConstantIntegerExpr).getIntValue()) and
+    exists(float f | f = this.(SemNumericLiteralExpr).getApproximateFloatValue() |
+      f < 0 and result = TNeg()
+      or
+      f = 0 and result = TZero()
+      or
+      f > 0 and result = TPos()
+    )
+  }
+}
+
+abstract private class NonConstantSignExpr extends SignExpr {
+  NonConstantSignExpr() { not this instanceof ConstantSignExpr }
+
+  final override Sign getSign() {
+    // The result is the _intersection_ of the signs computed from flow and by the language.
+    (result = this.(FlowSignExpr).getSignRestriction() or not this instanceof FlowSignExpr) and
+    (result = this.(CustomSignExpr).getSignRestriction() or not this instanceof CustomSignExpr)
+  }
+}
+
+/** An expression whose sign is computed from the signs of its operands. */
+abstract private class FlowSignExpr extends NonConstantSignExpr {
+  abstract Sign getSignRestriction();
+}
+
+/** An expression whose sign is computed by a language-specific implementation. */
+abstract class CustomSignExpr extends NonConstantSignExpr {
+  abstract Sign getSignRestriction();
+}
+
+/** An expression whose sign is unknown. */
+private class UnknownSignExpr extends SignExpr {
+  UnknownSignExpr() {
+    not this instanceof FlowSignExpr and
+    not this instanceof CustomSignExpr and
+    not this instanceof ConstantSignExpr and
+    (
+      // Only track numeric types.
+      getTrackedType(this) instanceof SemNumericType
+      or
+      // Unless the language says to track this expression anyway.
+      Specific::trackUnknownNonNumericExpr(this)
+    )
+  }
+
+  final override Sign getSign() { semAnySign(result) }
+}
+
+/**
+ * A `Load` expression whose sign is computed from the sign of its SSA definition, restricted by
+ * inference from any intervening guards.
+ */
+class UseSignExpr extends FlowSignExpr {
+  SemSsaVariable v;
+
+  UseSignExpr() { v.getAUse() = this }
+
+  override Sign getSignRestriction() {
+    // Propagate via SSA
+    // Propagate the sign from the def of `v`, incorporating any inference from guards.
+    result = semSsaSign(v, any(SemSsaReadPositionBlock bb | bb.getAnExpr() = this))
+    or
+    // No block for this read. Just use the sign of the def.
+    // REVIEW: How can this happen?
+    not exists(SemSsaReadPositionBlock bb | bb.getAnExpr() = this) and
+    result = semSsaDefSign(v)
+  }
+}
+
+/** A binary expression whose sign is computed from the signs of its operands. */
+private class BinarySignExpr extends FlowSignExpr {
+  SemBinaryExpr binary;
+
+  BinarySignExpr() { binary = this }
+
+  override Sign getSignRestriction() {
+    exists(SemExpr left, SemExpr right |
+      binaryExprOperands(binary, left, right) and
+      result =
+        semExprSign(pragma[only_bind_out](left))
+            .applyBinaryOp(semExprSign(pragma[only_bind_out](right)), binary.getOpcode())
+    )
+    or
+    exists(SemDivExpr div | div = binary |
+      result = semExprSign(div.getLeftOperand()) and
+      result != TZero() and
+      div.getRightOperand().(SemFloatingPointLiteralExpr).getFloatValue() = 0
+    )
+  }
+}
+
+pragma[nomagic]
+private predicate binaryExprOperands(SemBinaryExpr binary, SemExpr left, SemExpr right) {
+  binary.getLeftOperand() = left and binary.getRightOperand() = right
+}
+
+/**
+ * A `Convert`, `Box`, or `Unbox` expression.
+ */
+private class SemCastExpr extends SemUnaryExpr {
+  SemCastExpr() {
+    this instanceof SemConvertExpr
+    or
+    this instanceof SemBoxExpr
+    or
+    this instanceof SemUnboxExpr
+  }
+}
+
+/** A unary expression whose sign is computed from the sign of its operand. */
+private class UnarySignExpr extends FlowSignExpr {
+  SemUnaryExpr unary;
+
+  UnarySignExpr() { unary = this and not this instanceof SemCastExpr }
+
+  override Sign getSignRestriction() {
+    result = semExprSign(pragma[only_bind_out](unary.getOperand())).applyUnaryOp(unary.getOpcode())
+  }
+}
+
+/**
+ * A `Convert`, `Box`, or `Unbox` expression, whose sign is computed based on
+ * the sign of its operand and the source and destination types.
+ */
+abstract private class CastSignExpr extends FlowSignExpr {
+  SemUnaryExpr cast;
+
+  CastSignExpr() { cast = this and cast instanceof SemCastExpr }
+
+  override Sign getSignRestriction() { result = semExprSign(cast.getOperand()) }
+}
+
+/**
+ * A `Convert` expression.
+ */
+private class ConvertSignExpr extends CastSignExpr {
+  override SemConvertExpr cast;
+}
+
+/**
+ * A `Box` expression.
+ */
+private class BoxSignExpr extends CastSignExpr {
+  override SemBoxExpr cast;
+}
+
+/**
+ * An `Unbox` expression.
+ */
+private class UnboxSignExpr extends CastSignExpr {
+  override SemUnboxExpr cast;
+
+  UnboxSignExpr() {
+    exists(SemType fromType | fromType = getTrackedType(cast.getOperand()) |
+      // Only numeric source types are handled here.
+      fromType instanceof SemNumericType
+    )
+  }
+}
+
+private predicate unknownSign(SemExpr e) { e instanceof UnknownSignExpr }
+
+/**
+ * Holds if `lowerbound` is a lower bound for `v` at `pos`. This is restricted
+ * to only include bounds for which we might determine a sign.
+ */
+private predicate lowerBound(
+  SemExpr lowerbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isStrict
+) {
+  exists(boolean testIsTrue, SemRelationalExpr comp |
+    pos.hasReadOfVar(v) and
+    semGuardControlsSsaRead(semGetComparisonGuard(comp), pos, testIsTrue) and
+    not unknownSign(lowerbound)
+  |
+    testIsTrue = true and
+    comp.getLesserOperand() = lowerbound and
+    comp.getGreaterOperand() = semSsaRead(v, 0) and
+    (if comp.isStrict() then isStrict = true else isStrict = false)
+    or
+    testIsTrue = false and
+    comp.getGreaterOperand() = lowerbound and
+    comp.getLesserOperand() = semSsaRead(v, 0) and
+    (if comp.isStrict() then isStrict = false else isStrict = true)
+  )
+}
+
+/**
+ * Holds if `upperbound` is an upper bound for `v` at `pos`. This is restricted
+ * to only include bounds for which we might determine a sign.
+ */
+private predicate upperBound(
+  SemExpr upperbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isStrict
+) {
+  exists(boolean testIsTrue, SemRelationalExpr comp |
+    pos.hasReadOfVar(v) and
+    semGuardControlsSsaRead(semGetComparisonGuard(comp), pos, testIsTrue) and
+    not unknownSign(upperbound)
+  |
+    testIsTrue = true and
+    comp.getGreaterOperand() = upperbound and
+    comp.getLesserOperand() = semSsaRead(v, 0) and
+    (if comp.isStrict() then isStrict = true else isStrict = false)
+    or
+    testIsTrue = false and
+    comp.getLesserOperand() = upperbound and
+    comp.getGreaterOperand() = semSsaRead(v, 0) and
+    (if comp.isStrict() then isStrict = false else isStrict = true)
+  )
+}
+
+/**
+ * Holds if `eqbound` is an equality/inequality for `v` at `pos`. This is
+ * restricted to only include bounds for which we might determine a sign. The
+ * boolean `isEq` gives the polarity:
+ *  - `isEq = true` : `v = eqbound`
+ *  - `isEq = false` : `v != eqbound`
+ */
+private predicate eqBound(SemExpr eqbound, SemSsaVariable v, SemSsaReadPosition pos, boolean isEq) {
+  exists(SemGuard guard, boolean testIsTrue, boolean polarity |
+    pos.hasReadOfVar(v) and
+    semGuardControlsSsaRead(guard, pos, testIsTrue) and
+    guard.isEquality(eqbound, semSsaRead(v, 0), polarity) and
+    isEq = polarity.booleanXor(testIsTrue).booleanNot() and
+    not unknownSign(eqbound)
+  )
+}
+
+/**
+ * Holds if `bound` is a bound for `v` at `pos` that needs to be positive in
+ * order for `v` to be positive.
+ */
+private predicate posBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  upperBound(bound, v, pos, _) or
+  eqBound(bound, v, pos, true)
+}
+
+/**
+ * Holds if `bound` is a bound for `v` at `pos` that needs to be negative in
+ * order for `v` to be negative.
+ */
+private predicate negBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  lowerBound(bound, v, pos, _) or
+  eqBound(bound, v, pos, true)
+}
+
+/**
+ * Holds if `bound` is a bound for `v` at `pos` that can restrict whether `v`
+ * can be zero.
+ */
+private predicate zeroBound(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  lowerBound(bound, v, pos, _) or
+  upperBound(bound, v, pos, _) or
+  eqBound(bound, v, pos, _)
+}
+
+/** Holds if `bound` allows `v` to be positive at `pos`. */
+private predicate posBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  posBound(bound, v, pos) and TPos() = semExprSign(bound)
+}
+
+/** Holds if `bound` allows `v` to be negative at `pos`. */
+private predicate negBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  negBound(bound, v, pos) and TNeg() = semExprSign(bound)
+}
+
+/** Holds if `bound` allows `v` to be zero at `pos`. */
+private predicate zeroBoundOk(SemExpr bound, SemSsaVariable v, SemSsaReadPosition pos) {
+  lowerBound(bound, v, pos, _) and TNeg() = semExprSign(bound)
+  or
+  lowerBound(bound, v, pos, false) and TZero() = semExprSign(bound)
+  or
+  upperBound(bound, v, pos, _) and TPos() = semExprSign(bound)
+  or
+  upperBound(bound, v, pos, false) and TZero() = semExprSign(bound)
+  or
+  eqBound(bound, v, pos, true) and TZero() = semExprSign(bound)
+  or
+  eqBound(bound, v, pos, false) and TZero() != semExprSign(bound)
+}
+
+/**
+ * Holds if there is a bound that might restrict whether `v` has the sign `s`
+ * at `pos`.
+ */
+private predicate hasGuard(SemSsaVariable v, SemSsaReadPosition pos, Sign s) {
+  s = TPos() and posBound(_, v, pos)
+  or
+  s = TNeg() and negBound(_, v, pos)
+  or
+  s = TZero() and zeroBound(_, v, pos)
+}
+
+/**
+ * Gets a possible sign of `v` at `pos` based on its definition, where the sign
+ * might be ruled out by a guard.
+ */
+pragma[noinline]
+private Sign guardedSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
+  result = semSsaDefSign(v) and
+  pos.hasReadOfVar(v) and
+  hasGuard(v, pos, result)
+}
+
+/**
+ * Gets a possible sign of `v` at `pos` based on its definition, where no guard
+ * can rule it out.
+ */
+pragma[noinline]
+private Sign unguardedSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
+  result = semSsaDefSign(v) and
+  pos.hasReadOfVar(v) and
+  not hasGuard(v, pos, result)
+}
+
+/**
+ * Gets a possible sign of `v` at read position `pos`, where a guard could have
+ * ruled out the sign but does not.
+ * This does not check that the definition of `v` also allows the sign.
+ */
+private Sign guardedSsaSignOk(SemSsaVariable v, SemSsaReadPosition pos) {
+  result = TPos() and
+  forex(SemExpr bound | posBound(bound, v, pos) | posBoundOk(bound, v, pos))
+  or
+  result = TNeg() and
+  forex(SemExpr bound | negBound(bound, v, pos) | negBoundOk(bound, v, pos))
+  or
+  result = TZero() and
+  forex(SemExpr bound | zeroBound(bound, v, pos) | zeroBoundOk(bound, v, pos))
+}
+
+/** Gets a possible sign for `v` at `pos`. */
+private Sign semSsaSign(SemSsaVariable v, SemSsaReadPosition pos) {
+  result = unguardedSsaSign(v, pos)
+  or
+  result = guardedSsaSign(v, pos) and
+  result = guardedSsaSignOk(v, pos)
+}
+
+/** Gets a possible sign for `v`. */
+pragma[nomagic]
+Sign semSsaDefSign(SemSsaVariable v) { result = v.(SignDef).getSign() }
+
+/** Gets a possible sign for `e`. */
+cached
+Sign semExprSign(SemExpr e) {
+  exists(Sign s | s = e.(SignExpr).getSign() |
+    if
+      getTrackedType(e) instanceof SemUnsignedIntegerType and
+      s = TNeg() and
+      not Specific::ignoreTypeRestrictions(e)
+    then result = TPos()
+    else result = s
+  )
+}
+
+/**
+ * Dummy predicate that holds for any sign. This is added to improve readability
+ * of cases where the sign is unrestricted.
+ */
+predicate semAnySign(Sign s) { any() }
+
+/** Holds if `e` can be positive and cannot be negative. */
+predicate semPositive(SemExpr e) {
+  semExprSign(e) = TPos() and
+  not semExprSign(e) = TNeg()
+}
+
+/** Holds if `e` can be negative and cannot be positive. */
+predicate semNegative(SemExpr e) {
+  semExprSign(e) = TNeg() and
+  not semExprSign(e) = TPos()
+}
+
+/** Holds if `e` is strictly positive. */
+predicate semStrictlyPositive(SemExpr e) {
+  semExprSign(e) = TPos() and
+  not semExprSign(e) = TNeg() and
+  not semExprSign(e) = TZero()
+}
+
+/** Holds if `e` is strictly negative. */
+predicate semStrictlyNegative(SemExpr e) {
+  semExprSign(e) = TNeg() and
+  not semExprSign(e) = TPos() and
+  not semExprSign(e) = TZero()
 }

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.5.2-dev
+version: 0.5.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,16 +45,6 @@ module Consistency {
     ) {
       none()
     }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
   }
 
   private class RelevantNode extends Node {
@@ -256,7 +246,6 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -265,7 +254,6 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,16 +45,6 @@ module Consistency {
     ) {
       none()
     }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
   }
 
   private class RelevantNode extends Node {
@@ -256,7 +246,6 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -265,7 +254,6 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

@@ -169,11 +169,19 @@ predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
  */
 predicate modeledTaintStep(Operand nodeIn, Instruction nodeOut) {
   exists(CallInstruction call, TaintFunction func, FunctionInput modelIn, FunctionOutput modelOut |
+    (
+      nodeIn = callInput(call, modelIn)
+      or
+      exists(int n |
+        modelIn.isParameterDerefOrQualifierObject(n) and
+        if n = -1
+        then nodeIn = callInput(call, any(InQualifierObject inQualifier))
+        else nodeIn = callInput(call, any(InParameter inParam | inParam.getIndex() = n))
+      )
+    ) and
+    nodeOut = callOutput(call, modelOut) and
     call.getStaticCallTarget() = func and
     func.hasTaintFlow(modelIn, modelOut)
-  |
-    nodeIn = callInput(call, modelIn) and
-    nodeOut = callOutput(call, modelOut)
   )
   or
   // Taint flow from one argument to another and data flow from an argument to a

cpp/ql/lib/semmle/code/cpp/models/implementations/Iterator.qll

@@ -206,7 +206,7 @@ private class IteratorAssignArithmeticOperatorModel extends IteratorAssignArithm
     input.isReturnValueDeref() and
     output.isParameterDeref(0)
     or
-    (input.isParameter(1) or input.isParameterDeref(1)) and
+    input.isParameterDeref(1) and
     output.isParameterDeref(0)
   }
 }
@@ -305,7 +305,7 @@ private class IteratorAssignArithmeticMemberOperator extends MemberFunction, Dat
     input.isReturnValueDeref() and
     output.isQualifierObject()
     or
-    (input.isParameter(0) or input.isParameterDeref(0)) and
+    input.isParameterDeref(0) and
     output.isQualifierObject()
   }
 }

cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll

@@ -27,12 +27,7 @@ private class StdSetConstructor extends Constructor, TaintFunction {
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // taint flow from any parameter of an iterator type to the qualifier
-    (
-      // AST dataflow doesn't have indirection for iterators.
-      // Once we deprecate AST dataflow we can delete this first disjunct.
-      input.isParameter(this.getAnIteratorParameterIndex()) or
-      input.isParameterDeref(this.getAnIteratorParameterIndex())
-    ) and
+    input.isParameterDeref(this.getAnIteratorParameterIndex()) and
     (
       output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
       or
@@ -50,12 +45,7 @@ private class StdSetInsert extends TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from last parameter to qualifier and return value
     // (where the return value is a pair, this should really flow just to the first part of it)
-    (
-      // AST dataflow doesn't have indirection for iterators.
-      // Once we deprecate AST dataflow we can delete this first disjunct.
-      input.isParameter(this.getNumberOfParameters() - 1) or
-      input.isParameterDeref(this.getNumberOfParameters() - 1)
-    ) and
+    input.isParameterDeref(this.getNumberOfParameters() - 1) and
     (
       output.isQualifierObject() or
       output.isReturnValue()

cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll

@@ -38,7 +38,8 @@ private class StdBasicStringIterator extends Iterator, Type {
  */
 abstract private class StdStringTaintFunction extends TaintFunction {
   /**
-   * Gets the index of a parameter to this function that is a string.
+   * Gets the index of a parameter to this function that is a string (or
+   * character).
    */
   final int getAStringParameterIndex() {
     exists(Type paramType | paramType = this.getParameter(result).getUnspecifiedType() |
@@ -49,14 +50,7 @@ abstract private class StdStringTaintFunction extends TaintFunction {
       paramType instanceof ReferenceType and
       not paramType.(ReferenceType).getBaseType() =
         this.getDeclaringType().getTemplateArgument(2).(Type).getUnspecifiedType()
-    )
-  }
-
-  /**
-   * Gets the index of a parameter to this function that is a character.
-   */
-  final int getACharParameterIndex() {
-    exists(Type paramType | paramType = this.getParameter(result).getUnspecifiedType() |
+      or
       // i.e. `std::basic_string::CharT`
       paramType = this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType()
     )
@@ -85,7 +79,6 @@ private class StdStringConstructor extends Constructor, StdStringTaintFunction {
     // taint flow from any parameter of the value type to the returned object
     (
       input.isParameterDeref(this.getAStringParameterIndex()) or
-      input.isParameter(this.getACharParameterIndex()) or
       input.isParameter(this.getAnIteratorParameterIndex())
     ) and
     (
@@ -135,7 +128,7 @@ private class StdStringPush extends StdStringTaintFunction {
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from parameter to qualifier
-    input.isParameter(0) and
+    input.isParameterDeref(0) and
     output.isQualifierObject()
   }
 }
@@ -187,7 +180,6 @@ private class StdStringAppend extends StdStringTaintFunction {
     (
       input.isQualifierObject() or
       input.isParameterDeref(this.getAStringParameterIndex()) or
-      input.isParameter(this.getACharParameterIndex()) or
       input.isParameter(this.getAnIteratorParameterIndex())
     ) and
     (
@@ -218,7 +210,6 @@ private class StdStringInsert extends StdStringTaintFunction {
     (
       input.isQualifierObject() or
       input.isParameterDeref(this.getAStringParameterIndex()) or
-      input.isParameter(this.getACharParameterIndex()) or
       input.isParameter(this.getAnIteratorParameterIndex())
     ) and
     (
@@ -245,7 +236,6 @@ private class StdStringAssign extends StdStringTaintFunction {
     // flow from parameter to string itself (qualifier) and return value
     (
       input.isParameterDeref(this.getAStringParameterIndex()) or
-      input.isParameter(this.getACharParameterIndex()) or
       input.isParameter(this.getAnIteratorParameterIndex())
     ) and
     (

cpp/ql/lib/semmle/code/cpp/models/interfaces/FormattingFunction.qll

@@ -158,10 +158,11 @@ abstract class FormattingFunction extends ArrayFunction, TaintFunction {
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     exists(int arg |
-      arg = getFormatParameterIndex() or
-      arg >= getFirstFormatArgumentIndex()
-    |
-      (input.isParameterDeref(arg) or input.isParameter(arg)) and
+      (
+        arg = getFormatParameterIndex() or
+        arg >= getFirstFormatArgumentIndex()
+      ) and
+      input.isParameterDeref(arg) and
       output.isParameterDeref(getOutputParameterIndex(_))
     )
   }

cpp/ql/src/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 0.5.1
-
-### Minor Analysis Improvements
-
-* The `cpp/no-space-for-terminator` and `cpp/uncontrolled-allocation-size` queries have been enhanced with heuristic detection of allocations. These queries now find more results.
-
 ## 0.5.0
 
 ### Minor Analysis Improvements

cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql

@@ -15,24 +15,76 @@
 import semmle.code.cpp.ir.dataflow.internal.DefaultTaintTrackingImpl
 import TaintedWithPath
 
-string getATopLevelDomain() {
-  result =
-    [
-      "com", "ru", "net", "org", "de", "jp", "uk", "br", "pl", "in", "it", "fr", "au", "info", "nl",
-      "cn", "ir", "es", "cz", "biz", "ca", "eu", "ua", "kr", "za", "co", "gr", "ro", "se", "tw",
-      "vn", "mx", "ch", "tr", "at", "be", "hu", "tv", "dk", "me", "ar", "us", "no", "sk", "fi",
-      "id", "cl", "nz", "by", "xyz", "pt", "ie", "il", "kz", "my", "hk", "lt", "cc", "sg", "io",
-      "edu", "gov"
-    ]
-}
-
 predicate hardCodedAddressOrIP(StringLiteral txt) {
   exists(string s | s = txt.getValueText() |
     // Hard-coded ip addresses, such as 127.0.0.1
     s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or
     // Hard-coded addresses such as www.mycompany.com
-    s.regexpMatch("\"(www\\.|http:|https:).*\"") or
-    s.regexpMatch("\".*\\.(" + strictconcat(getATopLevelDomain(), "|") + ")\"")
+    s.matches("\"www.%\"") or
+    s.matches("\"http:%\"") or
+    s.matches("\"https:%\"") or
+    s.matches("\"%.com\"") or
+    s.matches("\"%.ru\"") or
+    s.matches("\"%.net\"") or
+    s.matches("\"%.org\"") or
+    s.matches("\"%.de\"") or
+    s.matches("\"%.jp\"") or
+    s.matches("\"%.uk\"") or
+    s.matches("\"%.br\"") or
+    s.matches("\"%.pl\"") or
+    s.matches("\"%.in\"") or
+    s.matches("\"%.it\"") or
+    s.matches("\"%.fr\"") or
+    s.matches("\"%.au\"") or
+    s.matches("\"%.info\"") or
+    s.matches("\"%.nl\"") or
+    s.matches("\"%.cn\"") or
+    s.matches("\"%.ir\"") or
+    s.matches("\"%.es\"") or
+    s.matches("\"%.cz\"") or
+    s.matches("\"%.biz\"") or
+    s.matches("\"%.ca\"") or
+    s.matches("\"%.eu\"") or
+    s.matches("\"%.ua\"") or
+    s.matches("\"%.kr\"") or
+    s.matches("\"%.za\"") or
+    s.matches("\"%.co\"") or
+    s.matches("\"%.gr\"") or
+    s.matches("\"%.ro\"") or
+    s.matches("\"%.se\"") or
+    s.matches("\"%.tw\"") or
+    s.matches("\"%.vn\"") or
+    s.matches("\"%.mx\"") or
+    s.matches("\"%.ch\"") or
+    s.matches("\"%.tr\"") or
+    s.matches("\"%.at\"") or
+    s.matches("\"%.be\"") or
+    s.matches("\"%.hu\"") or
+    s.matches("\"%.tv\"") or
+    s.matches("\"%.dk\"") or
+    s.matches("\"%.me\"") or
+    s.matches("\"%.ar\"") or
+    s.matches("\"%.us\"") or
+    s.matches("\"%.no\"") or
+    s.matches("\"%.sk\"") or
+    s.matches("\"%.fi\"") or
+    s.matches("\"%.id\"") or
+    s.matches("\"%.cl\"") or
+    s.matches("\"%.nz\"") or
+    s.matches("\"%.by\"") or
+    s.matches("\"%.xyz\"") or
+    s.matches("\"%.pt\"") or
+    s.matches("\"%.ie\"") or
+    s.matches("\"%.il\"") or
+    s.matches("\"%.kz\"") or
+    s.matches("\"%.my\"") or
+    s.matches("\"%.hk\"") or
+    s.matches("\"%.lt\"") or
+    s.matches("\"%.cc\"") or
+    s.matches("\"%.sg\"") or
+    s.matches("\"%.io\"") or
+    s.matches("\"%.edu\"") or
+    s.matches("\"%.gov\"")
   )
 }
 

cpp/ql/src/change-notes/2023-01-05-heuristic-allocations.md

@@ -1,5 +1,4 @@
-## 0.5.1
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
 * The `cpp/no-space-for-terminator` and `cpp/uncontrolled-allocation-size` queries have been enhanced with heuristic detection of allocations. These queries now find more results.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.1
+lastReleaseVersion: 0.5.0

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.5.2-dev
+version: 0.5.1-dev
 groups: 
   - cpp
   - queries

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

@@ -92,12 +92,6 @@ postWithInFlow
 | test.cpp:499:3:499:4 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:499:4:499:4 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:505:35:505:35 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:511:5:511:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:511:6:511:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:516:5:516:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:516:6:516:6 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:522:25:522:25 | x [inner post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:526:25:526:25 | y [inner post update] | PostUpdateNode should not be the target of local flow. |
 viableImplInCallContextTooLarge
 uniqueParameterNodeAtPosition
 uniqueParameterNodePosition

cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

@@ -591,18 +591,6 @@ postWithInFlow
 | test.cpp:505:34:505:35 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:505:34:505:35 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
 | test.cpp:505:35:505:35 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:511:5:511:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:511:6:511:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:511:6:511:6 | p [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:516:5:516:6 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:516:6:516:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:516:6:516:6 | p [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:522:24:522:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:522:24:522:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:522:25:522:25 | x [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:526:24:526:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:526:24:526:25 | & ... [post update] | PostUpdateNode should not be the target of local flow. |
-| test.cpp:526:25:526:25 | y [post update] | PostUpdateNode should not be the target of local flow. |
 | true_upon_entry.cpp:9:7:9:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | true_upon_entry.cpp:10:12:10:12 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | true_upon_entry.cpp:10:27:10:27 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

@@ -505,24 +505,3 @@ void viaOutparamMissingReturn() {
   intOutparamSourceMissingReturn(&x);
   sink(x); // $ ast,ir
 }
-
-void sink_then_source_1(int* p) {
-    sink(*p); // clean
-    *p = source();
-}
-
-void sink_then_source_2(int* p, int y) {
-    sink(y); // $ SPURIOUS: ast
-    *p = source();
-}
-
-void test_sink_then_source() {
-  {
-    int x;
-    sink_then_source_1(&x);
-  }
-  {
-    int y;
-    sink_then_source_2(&y, y);
-  }
-}

cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected

@@ -34,6 +34,3 @@
 | test.cpp:441:7:441:11 | local | test.cpp:442:18:442:22 | local |
 | test.cpp:441:7:441:11 | local | test.cpp:443:8:443:12 | local |
 | test.cpp:441:7:441:11 | local | test.cpp:444:9:444:13 | local |
-| test.cpp:521:9:521:9 | x | test.cpp:522:25:522:25 | x |
-| test.cpp:525:9:525:9 | y | test.cpp:526:25:526:25 | y |
-| test.cpp:525:9:525:9 | y | test.cpp:526:28:526:28 | y |

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -207,35 +207,34 @@ bad_asts.cpp:
 #   27|                 Type = [SpecifiedType] const Point
 #   27|                 ValueCategory = lvalue
 #   28|     getStmt(1): [ReturnStmt] return ...
-bad_stmts.cpp:
-#    5| [TopLevelFunction] void Bad::errorExpr()
-#    5|   <params>: 
-#    5|   getEntryPoint(): [BlockStmt] { ... }
-#    6|     getStmt(0): [DeclStmt] declaration
-#    6|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of intref
-#    6|           Type = [LValueReferenceType] int &
-#    6|         getVariable().getInitializer(): [Initializer] initializer for intref
-#    6|           getExpr(): [ErrorExpr] <error expr>
-#    6|               Type = [ErroneousType] error
-#    6|               ValueCategory = prvalue
-#    7|     getStmt(1): [DeclStmt] declaration
-#    7|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
-#    7|           Type = [IntType] int
-#    7|         getVariable().getInitializer(): [Initializer] initializer for x
-#    7|           getExpr(): [ErrorExpr] <error expr>
-#    7|               Type = [ErroneousType] error
-#    7|               ValueCategory = prvalue
-#    8|     getStmt(2): [ExprStmt] ExprStmt
-#    8|       getExpr(): [AssignExpr] ... = ...
-#    8|           Type = [IntType] int
-#    8|           ValueCategory = lvalue
-#    8|         getLValue(): [VariableAccess] x
-#    8|             Type = [IntType] int
-#    8|             ValueCategory = lvalue
-#    8|         getRValue(): [ErrorExpr] <error expr>
-#    8|             Type = [ErroneousType] error
-#    8|             ValueCategory = prvalue(load)
-#    9|     getStmt(3): [ReturnStmt] return ...
+#   30| [TopLevelFunction] void Bad::errorExpr()
+#   30|   <params>: 
+#   30|   getEntryPoint(): [BlockStmt] { ... }
+#   31|     getStmt(0): [DeclStmt] declaration
+#   31|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of intref
+#   31|           Type = [LValueReferenceType] int &
+#   31|         getVariable().getInitializer(): [Initializer] initializer for intref
+#   31|           getExpr(): [ErrorExpr] <error expr>
+#   31|               Type = [ErroneousType] error
+#   31|               ValueCategory = prvalue
+#   32|     getStmt(1): [DeclStmt] declaration
+#   32|       getDeclarationEntry(0): [VariableDeclarationEntry] definition of x
+#   32|           Type = [IntType] int
+#   32|         getVariable().getInitializer(): [Initializer] initializer for x
+#   32|           getExpr(): [ErrorExpr] <error expr>
+#   32|               Type = [ErroneousType] error
+#   32|               ValueCategory = prvalue
+#   33|     getStmt(2): [ExprStmt] ExprStmt
+#   33|       getExpr(): [AssignExpr] ... = ...
+#   33|           Type = [IntType] int
+#   33|           ValueCategory = lvalue
+#   33|         getLValue(): [VariableAccess] x
+#   33|             Type = [IntType] int
+#   33|             ValueCategory = lvalue
+#   33|         getRValue(): [ErrorExpr] <error expr>
+#   33|             Type = [ErroneousType] error
+#   33|             ValueCategory = prvalue(load)
+#   34|     getStmt(3): [ReturnStmt] return ...
 clang.cpp:
 #    5| [TopLevelFunction] int* globalIntAddress()
 #    5|   <params>: 

cpp/ql/test/library-tests/ir/ir/bad_asts.cpp

@@ -1,4 +1,4 @@
-// semmle-extractor-options: -std=c++17
+// semmle-extractor-options: -std=c++17 --expect_errors
 
 // Test cases that illustrate known bad ASTs that we have to work around in IR generation.
 namespace Bad {
@@ -26,4 +26,10 @@ namespace Bad {
   void CallCopyConstructor(const Point& a) {
     Point b = a;  // Copy constructor contains literal expressions with no values.
   }
+
+  void errorExpr() {
+    int &intref = 0;
+    int x = 0[0];
+    x = 1[1];
+  }
 }

cpp/ql/test/library-tests/ir/ir/bad_stmts.cpp

@@ -1,10 +0,0 @@
-// semmle-extractor-options: -std=c++17 --expect_errors
-
-// Test cases that illustrate known bad ASTs that we have to work around in IR generation.
-namespace Bad {
-  void errorExpr() {
-    int &intref = 0;
-    int x = 0[0];
-    x = 1[1];
-  }
-}

cpp/ql/test/library-tests/ir/ir/operand_locations.expected

@@ -98,17 +98,17 @@
 | bad_asts.cpp:27:15:27:15 | StoreValue | r27_6 |
 | bad_asts.cpp:27:15:27:15 | Unary | r27_3 |
 | bad_asts.cpp:27:15:27:15 | Unary | r27_4 |
-| bad_stmts.cpp:5:8:5:16 | ChiPartial | partial:m5_3 |
-| bad_stmts.cpp:5:8:5:16 | ChiTotal | total:m5_2 |
-| bad_stmts.cpp:5:8:5:16 | SideEffect | m5_3 |
-| bad_stmts.cpp:6:10:6:15 | Address | &:r6_1 |
-| bad_stmts.cpp:6:18:6:19 | StoreValue | r6_2 |
-| bad_stmts.cpp:7:9:7:9 | Address | &:r7_1 |
-| bad_stmts.cpp:7:12:7:16 | StoreValue | r7_2 |
-| bad_stmts.cpp:8:5:8:5 | Address | &:r8_3 |
-| bad_stmts.cpp:8:5:8:12 | Address | &:r8_1 |
-| bad_stmts.cpp:8:5:8:12 | Load | ~m5_4 |
-| bad_stmts.cpp:8:5:8:12 | StoreValue | r8_2 |
+| bad_asts.cpp:30:8:30:16 | ChiPartial | partial:m30_3 |
+| bad_asts.cpp:30:8:30:16 | ChiTotal | total:m30_2 |
+| bad_asts.cpp:30:8:30:16 | SideEffect | m30_3 |
+| bad_asts.cpp:31:10:31:15 | Address | &:r31_1 |
+| bad_asts.cpp:31:18:31:19 | StoreValue | r31_2 |
+| bad_asts.cpp:32:9:32:9 | Address | &:r32_1 |
+| bad_asts.cpp:32:12:32:16 | StoreValue | r32_2 |
+| bad_asts.cpp:33:5:33:5 | Address | &:r33_3 |
+| bad_asts.cpp:33:5:33:12 | Address | &:r33_1 |
+| bad_asts.cpp:33:5:33:12 | Load | ~m30_4 |
+| bad_asts.cpp:33:5:33:12 | StoreValue | r33_2 |
 | clang.cpp:5:6:5:21 | Address | &:r5_5 |
 | clang.cpp:5:6:5:21 | ChiPartial | partial:m5_3 |
 | clang.cpp:5:6:5:21 | ChiTotal | total:m5_2 |

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -120,26 +120,25 @@ bad_asts.cpp:
 #   26|     v26_10(void)          = AliasedUse               : ~m?
 #   26|     v26_11(void)          = ExitFunction             : 
 
-bad_stmts.cpp:
-#    5| void Bad::errorExpr()
-#    5|   Block 0
-#    5|     v5_1(void)         = EnterFunction           : 
-#    5|     mu5_2(unknown)     = AliasedDefinition       : 
-#    5|     mu5_3(unknown)     = InitializeNonLocal      : 
-#    6|     r6_1(glval<int &>) = VariableAddress[intref] : 
-#    6|     r6_2(error)        = Error                   : 
-#    6|     mu6_3(int &)       = Store[intref]           : &:r6_1, r6_2
-#    7|     r7_1(glval<int>)   = VariableAddress[x]      : 
-#    7|     r7_2(error)        = Error                   : 
-#    7|     mu7_3(int)         = Store[x]                : &:r7_1, r7_2
-#    8|     r8_1(glval<error>) = Error                   : 
-#    8|     r8_2(error)        = Load[?]                 : &:r8_1, ~m?
-#    8|     r8_3(glval<int>)   = VariableAddress[x]      : 
-#    8|     mu8_4(int)         = Store[x]                : &:r8_3, r8_2
-#    9|     v9_1(void)         = NoOp                    : 
-#    5|     v5_4(void)         = ReturnVoid              : 
-#    5|     v5_5(void)         = AliasedUse              : ~m?
-#    5|     v5_6(void)         = ExitFunction            : 
+#   30| void Bad::errorExpr()
+#   30|   Block 0
+#   30|     v30_1(void)         = EnterFunction           : 
+#   30|     mu30_2(unknown)     = AliasedDefinition       : 
+#   30|     mu30_3(unknown)     = InitializeNonLocal      : 
+#   31|     r31_1(glval<int &>) = VariableAddress[intref] : 
+#   31|     r31_2(error)        = Error                   : 
+#   31|     mu31_3(int &)       = Store[intref]           : &:r31_1, r31_2
+#   32|     r32_1(glval<int>)   = VariableAddress[x]      : 
+#   32|     r32_2(error)        = Error                   : 
+#   32|     mu32_3(int)         = Store[x]                : &:r32_1, r32_2
+#   33|     r33_1(glval<error>) = Error                   : 
+#   33|     r33_2(error)        = Load[?]                 : &:r33_1, ~m?
+#   33|     r33_3(glval<int>)   = VariableAddress[x]      : 
+#   33|     mu33_4(int)         = Store[x]                : &:r33_3, r33_2
+#   34|     v34_1(void)         = NoOp                    : 
+#   30|     v30_4(void)         = ReturnVoid              : 
+#   30|     v30_5(void)         = AliasedUse              : ~m?
+#   30|     v30_6(void)         = ExitFunction            : 
 
 clang.cpp:
 #    5| int* globalIntAddress()

cpp/ql/test/library-tests/ir/modulus-analysis/ModulusAnalysis.ql

@@ -1,16 +1,9 @@
 import cpp
 import experimental.semmle.code.cpp.semantic.analysis.ModulusAnalysis
 import experimental.semmle.code.cpp.semantic.Semantic
-import experimental.semmle.code.cpp.semantic.analysis.RangeUtils
-import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
-import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysisSpecific
-import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
 import semmle.code.cpp.ir.IR as IR
 import TestUtilities.InlineExpectationsTest
 
-module ModulusAnalysisInstantiated =
-  ModulusAnalysis<FloatDelta, Bounds, RangeUtil<FloatDelta, CppLangImpl>>;
-
 class ModulusAnalysisTest extends InlineExpectationsTest {
   ModulusAnalysisTest() { this = "ModulusAnalysisTest" }
 
@@ -30,7 +23,7 @@ class ModulusAnalysisTest extends InlineExpectationsTest {
 
 private string getAModString(SemExpr e) {
   exists(SemBound b, int delta, int mod |
-    ModulusAnalysisInstantiated::semExprModulus(e, b, delta, mod) and
+    semExprModulus(e, b, delta, mod) and
     result = b.toString() + "," + delta.toString() + "," + mod.toString() and
     not (delta = 0 and mod = 0)
   )

cpp/ql/test/library-tests/ir/sign-analysis/SignAnalysis.ql

@@ -1,14 +1,9 @@
 import cpp
 import experimental.semmle.code.cpp.semantic.analysis.SignAnalysisCommon
 import experimental.semmle.code.cpp.semantic.Semantic
-import experimental.semmle.code.cpp.semantic.analysis.RangeUtils
-import experimental.semmle.code.cpp.semantic.analysis.FloatDelta
-import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysisSpecific
 import semmle.code.cpp.ir.IR as IR
 import TestUtilities.InlineExpectationsTest
 
-module SignAnalysisInstantiated = SignAnalysis<FloatDelta, RangeUtil<FloatDelta, CppLangImpl>>;
-
 class SignAnalysisTest extends InlineExpectationsTest {
   SignAnalysisTest() { this = "SignAnalysisTest" }
 
@@ -26,6 +21,4 @@ class SignAnalysisTest extends InlineExpectationsTest {
   }
 }
 
-private string getASignString(SemExpr e) {
-  result = strictconcat(SignAnalysisInstantiated::semExprSign(e).toString(), "")
-}
+private string getASignString(SemExpr e) { result = strictconcat(semExprSign(e).toString(), "") }

cpp/ql/test/library-tests/syntax-zoo/allocators.cpp

@@ -1,7 +1,7 @@
-struct Allocators
+struct Foo
 {
-  Allocators(int x, int y) : m_x(x), m_y(y) {}
-  ~Allocators() {m_x = m_y = 0;}
+  Foo(int x, int y) : m_x(x), m_y(y) {}
+  ~Foo() {m_x = m_y = 0;}
 
   // NB: In Microsoft mode, size_t is predeclared.
   static void* operator new(size_t sz, int z, int w) { return nullptr; }
@@ -13,7 +13,7 @@ struct Allocators
 
 int main()
 {
-  auto foo = new(11, 22) Allocators(33, 44);
+  auto foo = new(11, 22) Foo(33, 44);
   delete foo;
 }
 

cpp/ql/test/library-tests/syntax-zoo/array_delete.cpp

@@ -1,7 +1,7 @@
-struct ArrayDelete {
-  ~ArrayDelete();
+struct Foo {
+  ~Foo();
 };
 
 void f() {
-  delete[] (ArrayDelete*)nullptr;
+  delete[] (Foo*)nullptr;
 }

cpp/ql/test/library-tests/syntax-zoo/dataflow-consistency.expected

@@ -74,8 +74,8 @@ argHasPostUpdate
 | ir.cpp:625:5:625:5 | s | ArgumentNode is missing PostUpdateNode. |
 postWithInFlow
 | VacuousDestructorCall.cpp:10:22:10:22 | i [inner post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:18:4:20 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:24:4:26 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:13 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:19 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
 | assignexpr.cpp:9:4:9:4 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | builtin.c:34:23:34:31 | staticint [inner post update] | PostUpdateNode should not be the target of local flow. |
 | builtin.c:39:37:39:45 | carry_out [inner post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

@@ -1483,17 +1483,17 @@ postWithInFlow
 | aggregateinitializer.c:3:6:3:6 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | aggregateinitializer.c:3:11:3:27 | PointerAdd [post update] | PostUpdateNode should not be the target of local flow. |
 | aggregateinitializer.c:3:11:3:27 | PointerAdd [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:3:30:3:35 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:3:38:3:43 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:18:4:20 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:18:4:20 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:24:4:26 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:4:24:4:26 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:23:3:28 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:3:31:3:36 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:13 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:11:4:13 | m_x [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:19 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:4:17:4:19 | m_y [post update] | PostUpdateNode should not be the target of local flow. |
 | allocators.cpp:7:56:7:70 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | allocators.cpp:16:8:16:10 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:16:14:16:43 | Call [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:16:14:16:43 | new [post update] | PostUpdateNode should not be the target of local flow. |
-| allocators.cpp:16:14:16:43 | new [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:16:14:16:36 | Call [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:16:14:16:36 | new [post update] | PostUpdateNode should not be the target of local flow. |
+| allocators.cpp:16:14:16:36 | new [post update] | PostUpdateNode should not be the target of local flow. |
 | allocators.cpp:18:1:18:1 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
 | assignexpr.cpp:9:4:9:4 | i [post update] | PostUpdateNode should not be the target of local flow. |
 | bad_asts.cpp:10:7:10:23 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c

@@ -168,34 +168,4 @@ int main(int argc, char **argv) {
 	int i10 = (int) argv[1];
 	printf((char *) i10);
 	printWrapper((char *) i10);
-
-	// BAD: b value comes from argv
-	{
-		char b[64];
-		char *bp = &b[0];
-		char *t;
-		if (0) {
-			t = 0;
-		} else {
-			t = bp;
-		}
-		memcpy(t, argv[1] + 1, 1);
-		printf(bp);
-		printWrapper(bp);
-	}
-
-	// BAD: b value comes from argv
-	{
-		char b[64];
-		char *bp = &b[0];
-		char *t;
-		if (1) {
-			t = ++bp;
-		} else {
-			t = 0;
-		}
-		memcpy(t, argv[1] + 1, 1);
-		printf(bp);
-		printWrapper(bp);
-	}
 }

cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected

@@ -260,30 +260,6 @@ edges
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | (const char *)... |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | (const char *)... |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp indirection |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp indirection |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp indirection |
-| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp indirection |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | (const char *)... |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | (const char *)... |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp indirection |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp indirection |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp indirection |
-| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp indirection |
 subpaths
 | argvLocal.c:102:15:102:16 | i1 indirection | argvLocal.c:9:25:9:31 | *correct | argvLocal.c:9:25:9:31 | ReturnIndirection | argvLocal.c:102:15:102:16 | printWrapper output argument |
 | argvLocal.c:107:15:107:19 | access to array indirection | argvLocal.c:9:25:9:31 | *correct | argvLocal.c:9:25:9:31 | ReturnIndirection | argvLocal.c:107:15:107:19 | printWrapper output argument |
@@ -420,22 +396,6 @@ nodes
 | argvLocal.c:170:15:170:26 | i10 indirection | semmle.label | i10 indirection |
 | argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
 | argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
-| argvLocal.c:182:13:182:16 | argv | semmle.label | argv |
-| argvLocal.c:182:13:182:16 | argv | semmle.label | argv |
-| argvLocal.c:183:10:183:11 | (const char *)... | semmle.label | (const char *)... |
-| argvLocal.c:183:10:183:11 | bp | semmle.label | bp |
-| argvLocal.c:183:10:183:11 | bp indirection | semmle.label | bp indirection |
-| argvLocal.c:184:16:184:17 | bp | semmle.label | bp |
-| argvLocal.c:184:16:184:17 | bp | semmle.label | bp |
-| argvLocal.c:184:16:184:17 | bp indirection | semmle.label | bp indirection |
-| argvLocal.c:197:13:197:16 | argv | semmle.label | argv |
-| argvLocal.c:197:13:197:16 | argv | semmle.label | argv |
-| argvLocal.c:198:10:198:11 | (const char *)... | semmle.label | (const char *)... |
-| argvLocal.c:198:10:198:11 | bp | semmle.label | bp |
-| argvLocal.c:198:10:198:11 | bp indirection | semmle.label | bp indirection |
-| argvLocal.c:199:16:199:17 | bp | semmle.label | bp |
-| argvLocal.c:199:16:199:17 | bp | semmle.label | bp |
-| argvLocal.c:199:16:199:17 | bp indirection | semmle.label | bp indirection |
 #select
 | argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:95:9:95:12 | argv | argv |
 | argvLocal.c:96:15:96:21 | access to array | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:96:15:96:18 | argv | argv |
@@ -465,7 +425,3 @@ nodes
 | argvLocal.c:165:15:165:17 | i91 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:163:22:163:25 | argv | argv |
 | argvLocal.c:169:18:169:20 | i10 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:168:18:168:21 | argv | argv |
 | argvLocal.c:170:24:170:26 | i10 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:168:18:168:21 | argv | argv |
-| argvLocal.c:183:10:183:11 | bp | argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:182:13:182:16 | argv | argv |
-| argvLocal.c:184:16:184:17 | bp | argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:182:13:182:16 | argv | argv |
-| argvLocal.c:198:10:198:11 | bp | argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:197:13:197:16 | argv | argv |
-| argvLocal.c:199:16:199:17 | bp | argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:197:13:197:16 | argv | argv |

cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.expected

@@ -17,24 +17,6 @@ edges
 | test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
 | test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address |
 | test.cpp:38:25:38:42 | (const char *)... | test.cpp:42:14:42:20 | address indirection |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address indirection |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address indirection |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address |
-| test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address indirection |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:52:14:52:20 | address indirection |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:56:14:56:20 | address indirection |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address |
-| test.cpp:49:25:49:42 | (const char *)... | test.cpp:60:14:60:20 | address indirection |
 subpaths
 nodes
 | test.cpp:16:25:16:30 | call to getenv | semmle.label | call to getenv |
@@ -52,21 +34,7 @@ nodes
 | test.cpp:42:14:42:20 | address | semmle.label | address |
 | test.cpp:42:14:42:20 | address | semmle.label | address |
 | test.cpp:42:14:42:20 | address indirection | semmle.label | address indirection |
-| test.cpp:49:25:49:30 | call to getenv | semmle.label | call to getenv |
-| test.cpp:49:25:49:42 | (const char *)... | semmle.label | (const char *)... |
-| test.cpp:52:14:52:20 | address | semmle.label | address |
-| test.cpp:52:14:52:20 | address | semmle.label | address |
-| test.cpp:52:14:52:20 | address indirection | semmle.label | address indirection |
-| test.cpp:56:14:56:20 | address | semmle.label | address |
-| test.cpp:56:14:56:20 | address | semmle.label | address |
-| test.cpp:56:14:56:20 | address indirection | semmle.label | address indirection |
-| test.cpp:60:14:60:20 | address | semmle.label | address |
-| test.cpp:60:14:60:20 | address | semmle.label | address |
-| test.cpp:60:14:60:20 | address indirection | semmle.label | address indirection |
 #select
 | test.cpp:20:7:20:12 | call to strcmp | test.cpp:16:25:16:30 | call to getenv | test.cpp:20:14:20:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:16:25:16:30 | call to getenv | call to getenv |
 | test.cpp:31:7:31:12 | call to strcmp | test.cpp:27:25:27:30 | call to getenv | test.cpp:31:14:31:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:27:25:27:30 | call to getenv | call to getenv |
 | test.cpp:42:7:42:12 | call to strcmp | test.cpp:38:25:38:30 | call to getenv | test.cpp:42:14:42:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:38:25:38:30 | call to getenv | call to getenv |
-| test.cpp:52:7:52:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:52:14:52:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |
-| test.cpp:56:7:56:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:56:14:56:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |
-| test.cpp:60:7:60:12 | call to strcmp | test.cpp:49:25:49:30 | call to getenv | test.cpp:60:14:60:20 | address | Untrusted input $@ might be vulnerable to a spoofing attack. | test.cpp:49:25:49:30 | call to getenv | call to getenv |

cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp

@@ -43,27 +43,3 @@ void processRequest3()
     isServer = 1;
   }
 }
-
-void processRequest4() 
-{
-  const char *address = getenv("SERVERIP");
-  bool cond = false;
-
-  if (strcmp(address, "127.0.0.1")) { cond = true; } // BAD
-  if (strcmp(address, "127_0_0_1")) { cond = true; } // GOOD (not an IP)
-  if (strcmp(address, "127.0.0")) { cond = true; } // GOOD (not an IP)
-  if (strcmp(address, "127.0.0.0.1")) { cond = true; } // GOOD (not an IP)
-  if (strcmp(address, "http://mycompany")) { cond = true; } // BAD
-  if (strcmp(address, "http_//mycompany")) { cond = true; } // GOOD (not an address)
-  if (strcmp(address, "htt://mycompany")) { cond = true; } // GOOD (not an address)
-  if (strcmp(address, "httpp://mycompany")) { cond = true; } // GOOD (not an address)
-  if (strcmp(address, "mycompany.com")) { cond = true; } // BAD
-  if (strcmp(address, "mycompany_com")) { cond = true; } // GOOD (not an address)
-  if (strcmp(address, "mycompany.c")) { cond = true; } // GOOD (not an address)
-  if (strcmp(address, "mycompany.comm")) { cond = true; } // GOOD (not an address)
-
-  if (cond) {
-    isServer = 1;
-  }
-}
-

csharp/downgrades/1136957c0b3c73a7798ae42645c361e813295393/upgrade.properties

@@ -1,2 +0,0 @@
-description: Remove operators from the virtualizable type.
-compatibility: full

csharp/downgrades/81a394bedda3d4747e36496c7be4d958424636d6/expressions.ql

@@ -1,13 +0,0 @@
-class Expression extends @expr {
-  string toString() { none() }
-}
-
-class TypeOrRef extends @type_or_ref {
-  string toString() { none() }
-}
-
-from Expression e, int k, int kind, TypeOrRef t
-where
-  expressions(e, k, t) and
-  if k = 135 then kind = 106 else kind = k
-select e, kind, t

csharp/downgrades/81a394bedda3d4747e36496c7be4d958424636d6/upgrade.properties

@@ -1,3 +0,0 @@
-description: Remove UTF-8 expression kind.
-compatibility: backwards
-expressions.rel: run expressions.qlo

csharp/extractor/Semmle.Extraction.CIL/Entities/DefinitionMethod.cs

@@ -92,8 +92,7 @@ namespace Semmle.Extraction.CIL.Entities
                         yield return Tuples.cil_parameter_out(pe);
                     if (p.Attributes.HasFlag(ParameterAttributes.In))
                         yield return Tuples.cil_parameter_in(pe);
-                    foreach (var c in Attribute.Populate(Context, pe, p.GetCustomAttributes()))
-                        yield return c;
+                    Attribute.Populate(Context, pe, p.GetCustomAttributes());
                 }
 
                 yield return Tuples.metadata_handle(this, Context.Assembly, MetadataTokens.GetToken(handle));
@@ -206,8 +205,7 @@ namespace Semmle.Extraction.CIL.Entities
                     yield return Tuples.cil_newslot(this);
 
                 // Populate attributes
-                foreach (var c in Attribute.Populate(Context, this, md.GetCustomAttributes()))
-                    yield return c;
+                Attribute.Populate(Context, this, md.GetCustomAttributes());
             }
         }
 

csharp/extractor/Semmle.Extraction.CSharp/Entities/ExpressionNodeInfo.cs

@@ -2,6 +2,7 @@ using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Semmle.Extraction.CSharp.Populators;
+using Semmle.Extraction.Entities;
 using Semmle.Extraction.Kinds;
 
 namespace Semmle.Extraction.CSharp.Entities
@@ -106,11 +107,6 @@ namespace Semmle.Extraction.CSharp.Entities
                     return Expression.ValueAsString(val);
                 }
 
-                if (TryGetStringValueFromUtf8Literal(out var s))
-                {
-                    return s;
-                }
-
                 return null;
             }
         }
@@ -185,17 +181,6 @@ namespace Semmle.Extraction.CSharp.Entities
             return isTrue || isFalse;
         }
 
-        private bool TryGetStringValueFromUtf8Literal(out string? value)
-        {
-            value = null;
-            if (Node.IsKind(SyntaxKind.Utf8StringLiteralExpression) && Node is LiteralExpressionSyntax literal)
-            {
-                value = literal.Token.ValueText;
-                return true;
-            }
-            return false;
-        }
-
         public bool IsBoolLiteral()
         {
             return TryGetBoolValueFromLiteral(out var _);

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Factory.cs

@@ -47,7 +47,6 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     case SyntaxKind.FalseLiteralExpression:
                     case SyntaxKind.TrueLiteralExpression:
                     case SyntaxKind.StringLiteralExpression:
-                    case SyntaxKind.Utf8StringLiteralExpression:
                     case SyntaxKind.NullLiteralExpression:
                     case SyntaxKind.NumericLiteralExpression:
                     case SyntaxKind.CharacterLiteralExpression:

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/InterpolatedString.cs

@@ -27,7 +27,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     case SyntaxKind.InterpolatedStringText:
                         // Create a string literal
                         var interpolatedText = (InterpolatedStringTextSyntax)c;
-                        new Expression(new ExpressionInfo(Context, Type, Context.CreateLocation(c.GetLocation()), ExprKind.UTF16_STRING_LITERAL, this, child++, false, interpolatedText.TextToken.ValueText));
+                        new Expression(new ExpressionInfo(Context, Type, Context.CreateLocation(c.GetLocation()), ExprKind.STRING_LITERAL, this, child++, false, interpolatedText.TextToken.Text));
                         break;
                     default:
                         throw new InternalError(c, $"Unhandled interpolation kind {c.Kind()}");

csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Literal.cs

@@ -20,8 +20,6 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
             {
                 case SyntaxKind.DefaultLiteralExpression:
                     return ExprKind.DEFAULT;
-                case SyntaxKind.Utf8StringLiteralExpression:
-                    return ExprKind.UTF8_STRING_LITERAL;
                 case SyntaxKind.NullLiteralExpression:
                     info.SetType(null);  // Don't use converted type.
                     return ExprKind.NULL_LITERAL;
@@ -65,7 +63,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                     return ExprKind.FLOAT_LITERAL;
 
                 case SpecialType.System_String:
-                    return ExprKind.UTF16_STRING_LITERAL;
+                    return ExprKind.STRING_LITERAL;
 
                 case SpecialType.System_UInt16:
                 case SpecialType.System_UInt32:

csharp/extractor/Semmle.Extraction.CSharp/Kinds/ExprKind.cs

@@ -15,7 +15,7 @@ namespace Semmle.Extraction.Kinds
         ULONG_LITERAL = 7,
         FLOAT_LITERAL = 8,
         DOUBLE_LITERAL = 9,
-        UTF16_STRING_LITERAL = 10,
+        STRING_LITERAL = 10,
         NULL_LITERAL = 11,
         THIS_ACCESS = 12,
         BASE_ACCESS = 13,
@@ -129,7 +129,6 @@ namespace Semmle.Extraction.Kinds
         SLICE_PATTERN = 132,
         URSHIFT = 133,
         ASSIGN_URSHIFT = 134,
-        UTF8_STRING_LITERAL = 135,
         DEFINE_SYMBOL = 999,
     }
 }

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.4.1
-
-No user-facing changes.
-
 ## 1.4.0
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.4.1.md

@@ -1,3 +0,0 @@
-## 1.4.1
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.1
+lastReleaseVersion: 1.4.0

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.4.2-dev
+version: 1.4.1-dev
 groups:
     - csharp
     - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.4.1
-
-No user-facing changes.
-
 ## 1.4.0
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.4.1.md

@@ -1,3 +0,0 @@
-## 1.4.1
-
-No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.1
+lastReleaseVersion: 1.4.0

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.4.2-dev
+version: 1.4.1-dev
 groups:
     - csharp
     - solorigate

csharp/ql/lib/CHANGELOG.md

@@ -1,18 +1,3 @@
-## 0.5.1
-
-### Major Analysis Improvements
-
-* Added library support for generic attributes (also for CIL extracted attributes).
-* `cil.ConstructedType::getName` was changed to include printing of the type arguments.
-
-### Minor Analysis Improvements
-
-* Attributes on methods in CIL are now extracted (Bugfix).
-* Support for `static virtual` and `static abstract` interface members.
-* Support for *operators* in interface definitions. 
-* C# 11: Added support for the unsigned right shift `>>>` and unsigned right shift assignment `>>>=` operators.
-* Query id's have been aligned such that they are prefixed with `cs` instead of `csharp`.
-
 ## 0.5.0
 
 ### Minor Analysis Improvements

csharp/ql/lib/change-notes/2023-01-03-queryids.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Query id's have been aligned such that they are prefixed with `cs` instead of `csharp`.

csharp/ql/lib/change-notes/2023-01-11-unsigned-right-shift.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# 11: Added support for the unsigned right shift `>>>` and unsigned right shift assignment `>>>=` operators.

csharp/ql/lib/change-notes/2023-01-19-utf8stringliterals.md

@@ -1,6 +0,0 @@
----
-category: majorAnalysis
----
-* Add extractor and library support for UTF-8 encoded strings.
-* The `StringLiteral` class includes UTF-8 encoded strings.
-* In the DB Schema `@string_literal_expr` is renamed to `@utf16_string_literal_expr`

csharp/ql/lib/change-notes/released/0.5.1.md

@@ -1,14 +0,0 @@
-## 0.5.1
-
-### Major Analysis Improvements
-
-* Added library support for generic attributes (also for CIL extracted attributes).
-* `cil.ConstructedType::getName` was changed to include printing of the type arguments.
-
-### Minor Analysis Improvements
-
-* Attributes on methods in CIL are now extracted (Bugfix).
-* Support for `static virtual` and `static abstract` interface members.
-* Support for *operators* in interface definitions. 
-* C# 11: Added support for the unsigned right shift `>>>` and unsigned right shift assignment `>>>=` operators.
-* Query id's have been aligned such that they are prefixed with `cs` instead of `csharp`.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.1
+lastReleaseVersion: 0.5.0

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.5.2-dev
+version: 0.5.1-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/lib/semmle/code/cil/Attribute.qll

@@ -27,19 +27,3 @@ class Attribute extends Element, @cil_attribute {
 
   override CS::Location getLocation() { result = getDeclaration().getLocation() }
 }
-
-/** A generic attribute to a declaration. */
-class GenericAttribute extends Attribute {
-  private ConstructedType type;
-
-  GenericAttribute() { type = this.getType() }
-
-  /** Gets the total number of type arguments. */
-  int getNumberOfTypeArguments() { result = count(int i | cil_type_argument(type, i, _)) }
-
-  /** Gets the `i`th type argument, if any. */
-  Type getTypeArgument(int i) { result = type.getTypeArgument(i) }
-
-  /** Get a type argument. */
-  Type getATypeArgument() { result = this.getTypeArgument(_) }
-}

csharp/ql/lib/semmle/code/cil/Generics.qll

@@ -28,12 +28,6 @@ class ConstructedGeneric extends Generic, DotNet::ConstructedGeneric {
   final override Type getTypeArgument(int n) { cil_type_argument(this, n, result) }
 }
 
-/** Gets the concatenation of the `getName()` of type arguments. */
-language[monotonicAggregates]
-private string getTypeArgumentsNames(ConstructedGeneric cg) {
-  result = strictconcat(Type t, int i | t = cg.getTypeArgument(i) | t.getName(), "," order by i)
-}
-
 /** An unbound generic type. */
 class UnboundGenericType extends UnboundGeneric, Type { }
 
@@ -47,10 +41,6 @@ class ConstructedType extends ConstructedGeneric, Type {
   override predicate isInterface() { this.getUnboundType().isInterface() }
 
   override predicate isClass() { this.getUnboundType().isClass() }
-
-  final override string getName() {
-    result = this.getUndecoratedName() + "<" + getTypeArgumentsNames(this) + ">"
-  }
 }
 
 /** A constructed generic method. */

csharp/ql/lib/semmle/code/csharp/Attribute.qll

@@ -37,14 +37,8 @@ class Attributable extends @attributable {
 }
 
 private string getAttributeName(Attribute a) {
-  exists(string type, string pattern |
-    type = a.getType().getName() and pattern = "(.*)Attribute(<.*>)?"
-  |
-    type.regexpMatch(pattern) and
-    result = concat(int i | i = [1, 2] | type.regexpCapture(pattern, i) order by i)
-    or
-    not type.regexpMatch(pattern) and
-    result = type
+  exists(string type | type = a.getType().getName() |
+    if type.matches("%Attribute") then result = type.prefix(type.length() - 9) else result = type
   )
 }
 
@@ -105,31 +99,6 @@ class Attribute extends TopLevelExprParent, @attribute {
   override string getAPrimaryQlClass() { result = "Attribute" }
 }
 
-/**
- * A generic attribute, for example `[...]` on line 1 in
- *
- * ```csharp
- * [MyGenericAttribute<int>(0)]
- * public void SomeMethod(string s) { }
- * ```
- */
-class GenericAttribute extends Attribute {
-  private ConstructedClass type;
-
-  GenericAttribute() { type = this.getType() }
-
-  /** Gets the total number of type arguments. */
-  int getNumberOfTypeArguments() { result = count(int i | type_arguments(_, i, type)) }
-
-  /** Gets the `i`th type argument, if any. */
-  Type getTypeArgument(int i) { result = type.getTypeArgument(i) }
-
-  /** Get a type argument. */
-  Type getATypeArgument() { result = this.getTypeArgument(_) }
-
-  override string getAPrimaryQlClass() { result = "GenericAttribute" }
-}
-
 /**
  * An attribute with default kind, for example `[...]` on line 1 in
  * ```csharp
@@ -141,17 +110,6 @@ class DefaultAttribute extends Attribute, @attribute_default {
   override string getAPrimaryQlClass() { result = "DefaultAttribute" }
 }
 
-/**
- * A generic attribute with default kind, for example `[...]` on line 1 in
- * ```csharp
- * [MyAttribute<string>(0)]
- * int SomeMethod() { return 1; }
- * ```
- */
-class GenericDefaultAttribute extends GenericAttribute, DefaultAttribute {
-  override string getAPrimaryQlClass() { result = "GenericDefaultAttribute" }
-}
-
 /**
  * An attribute with return kind, for example `[...]` on line 1 in
  * ```csharp
@@ -165,17 +123,6 @@ class ReturnAttribute extends Attribute, @attribute_return {
   override string getAPrimaryQlClass() { result = "ReturnAttribute" }
 }
 
-/**
- * A generic attribute with return kind, for example `[...]` on line 1 in
- * ```csharp
- * [return: MyAttribute<object>(0)]
- * int SomeMethod() { return 1; }
- * ```
- */
-class GenericReturnAttribute extends GenericAttribute, ReturnAttribute {
-  override string getAPrimaryQlClass() { result = "GenericReturnAttribute" }
-}
-
 /**
  * An attribute with assembly kind, for example `[...]` on line 1 in
  * ```csharp
@@ -188,16 +135,6 @@ class AssemblyAttribute extends Attribute, @attribute_assembly {
   override string getAPrimaryQlClass() { result = "AssemblyAttribute" }
 }
 
-/**
- * A generic attribute with assembly kind, for example `[...]` on line 1 in
- * ```csharp
- * [assembly: MyAttribute<string>(0)]
- * ```
- */
-class GenericAssemblyAttribute extends GenericAttribute, AssemblyAttribute {
-  override string getAPrimaryQlClass() { result = "GenericAssemblyAttribute" }
-}
-
 /**
  * An attribute with module kind, for example `[...]` on line 1 in
  * ```csharp
@@ -209,13 +146,3 @@ class ModuleAttribute extends Attribute, @attribute_module {
 
   override string getAPrimaryQlClass() { result = "ModuleAttribute" }
 }
-
-/**
- * A generic attribute with module kind, for example `[...]` on line 1 in
- * ```csharp
- * [module: MyAttribute<string>(0)]
- * ```
- */
-class GenericModuleAttribute extends GenericAttribute, ModuleAttribute {
-  override string getAPrimaryQlClass() { result = "GenericModuleAttribute" }
-}

csharp/ql/lib/semmle/code/csharp/Implements.qll

@@ -129,7 +129,7 @@ pragma[nomagic]
 private Virtualizable getACompatibleInterfaceMemberAux(Virtualizable m) {
   result = getACompatibleInterfaceAccessor(m) or
   result = getACompatibleInterfaceIndexer(m) or
-  result = getACompatibleRelevantInterfaceMember(m)
+  result = getACompatibleInterfaceMethod(m)
 }
 
 /**
@@ -210,13 +210,11 @@ private predicate getACompatibleInterfaceIndexerAux(Indexer i, ValueOrRefType t)
   t = getAPossibleImplementor(i.getDeclaringType())
 }
 
-private RelevantInterfaceMember getACompatibleRelevantInterfaceMember0(
-  RelevantInterfaceMember m, int i
-) {
-  result = getARelevantInterfaceMemberCandidate(m) and
+private Method getACompatibleInterfaceMethod0(Method m, int i) {
+  result = getAnInterfaceMethodCandidate(m) and
   i = -1
   or
-  result = getACompatibleRelevantInterfaceMember0(m, i - 1) and
+  result = getACompatibleInterfaceMethod0(m, i - 1) and
   exists(Type t1, Type t2 |
     t1 = getArgumentOrReturnType(m, i) and
     t2 = getArgumentOrReturnType(result, i)
@@ -225,47 +223,32 @@ private RelevantInterfaceMember getACompatibleRelevantInterfaceMember0(
   )
 }
 
-/**
- * A class of callables relevant for interface member compatibility.
- */
-private class RelevantInterfaceMember extends Callable {
-  RelevantInterfaceMember() {
-    this instanceof Method or
-    this instanceof Operator
-  }
-
-  predicate isPublic() {
-    this.(Method).isPublic() or
-    this.(Operator).isPublic()
-  }
-}
-
-private RelevantInterfaceMember getACompatibleRelevantInterfaceMember(RelevantInterfaceMember m) {
-  result = getACompatibleRelevantInterfaceMember0(m, m.getNumberOfParameters())
+private Method getACompatibleInterfaceMethod(Method m) {
+  result = getACompatibleInterfaceMethod0(m, m.getNumberOfParameters())
 }
 
 /**
- * Gets an interface method or operator that may potentially be implemented by `m`.
+ * Gets an interface method that may potentially be implemented by `m`.
  *
  * That is, a method with the same name, same number of parameters, and declared
  * in a type that is a possible implementor type for the interface type.
  */
-private RelevantInterfaceMember getARelevantInterfaceMemberCandidate(RelevantInterfaceMember m) {
-  getAPotentialRelevantInterfaceMemberAux(result, m.getDeclaringType(), m.getUndecoratedName(),
+private Method getAnInterfaceMethodCandidate(Method m) {
+  getAPotentialInterfaceMethodAux(result, m.getDeclaringType(), m.getUndecoratedName(),
     m.getNumberOfParameters()) and
   m.isPublic()
 }
 
 pragma[nomagic]
-private predicate getAPotentialRelevantInterfaceMemberAux(
-  RelevantInterfaceMember m, ValueOrRefType t, string name, int params
+private predicate getAPotentialInterfaceMethodAux(
+  Method m, ValueOrRefType t, string name, int params
 ) {
   t = getAPossibleImplementor(m.getDeclaringType()) and
   name = m.getUndecoratedName() and
   params = m.getNumberOfParameters()
 }
 
-private Type getArgumentOrReturnType(RelevantInterfaceMember m, int i) {
+private Type getArgumentOrReturnType(Method m, int i) {
   i = 0 and result = m.getReturnType()
   or
   result = m.getParameter(i - 1).getType()

csharp/ql/lib/semmle/code/csharp/Member.qll

@@ -184,7 +184,7 @@ private class TOverridable = @virtualizable or @callable_accessor;
 
 /**
  * A declaration that can be overridden or implemented. That is, a method,
- * a property, an indexer, an event, an accessor, or an operator.
+ * a property, an indexer, an event, or an accessor.
  *
  * Unlike `Virtualizable`, this class includes accessors.
  */
@@ -360,7 +360,7 @@ class Overridable extends Declaration, TOverridable {
 
 /**
  * A member where the `virtual` modifier is valid. That is, a method,
- * a property, an indexer, an event, or an operator.
+ * a property, an indexer, or an event.
  *
  * Equivalently, these are the members that can be defined in an interface.
  *

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,16 +45,6 @@ module Consistency {
     ) {
       none()
     }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
   }
 
   private class RelevantNode extends Node {
@@ -256,7 +246,6 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -265,7 +254,6 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -39,11 +39,6 @@ module Public {
       )
       or
       exists(ReturnKind rk | this = TReturnSummaryComponent(rk) and result = "return (" + rk + ")")
-      or
-      exists(SummaryComponent::SyntheticGlobal sg |
-        this = TSyntheticGlobalSummaryComponent(sg) and
-        result = "synthetic global (" + sg + ")"
-      )
     }
   }
 
@@ -164,24 +159,24 @@ module Public {
     SummaryComponentStack return(ReturnKind rk) { result = singleton(SummaryComponent::return(rk)) }
   }
 
-  private predicate noComponentSpecific(SummaryComponent sc) {
-    not exists(getComponentSpecific(sc))
+  private predicate noComponentSpecificCsv(SummaryComponent sc) {
+    not exists(getComponentSpecificCsv(sc))
   }
 
   /** Gets a textual representation of this component used for flow summaries. */
-  private string getComponent(SummaryComponent sc) {
-    result = getComponentSpecific(sc)
+  private string getComponentCsv(SummaryComponent sc) {
+    result = getComponentSpecificCsv(sc)
     or
-    noComponentSpecific(sc) and
+    noComponentSpecificCsv(sc) and
     (
       exists(ArgumentPosition pos |
         sc = TParameterSummaryComponent(pos) and
-        result = "Parameter[" + getArgumentPosition(pos) + "]"
+        result = "Parameter[" + getArgumentPositionCsv(pos) + "]"
       )
       or
       exists(ParameterPosition pos |
         sc = TArgumentSummaryComponent(pos) and
-        result = "Argument[" + getParameterPosition(pos) + "]"
+        result = "Argument[" + getParameterPositionCsv(pos) + "]"
       )
       or
       sc = TReturnSummaryComponent(getReturnValueKind()) and result = "ReturnValue"
@@ -189,16 +184,16 @@ module Public {
   }
 
   /** Gets a textual representation of this stack used for flow summaries. */
-  string getComponentStack(SummaryComponentStack stack) {
+  string getComponentStackCsv(SummaryComponentStack stack) {
     exists(SummaryComponent head, SummaryComponentStack tail |
       head = stack.head() and
       tail = stack.tail() and
-      result = getComponentStack(tail) + "." + getComponent(head)
+      result = getComponentStackCsv(tail) + "." + getComponentCsv(head)
     )
     or
     exists(SummaryComponent c |
       stack = TSingletonSummaryComponentStack(c) and
-      result = getComponent(c)
+      result = getComponentCsv(c)
     )
   }
 
@@ -1222,8 +1217,8 @@ module Private {
         c.relevantSummary(input, output, preservesValue) and
         csv =
           c.getCallableCsv() // Callable information
-            + getComponentStack(input) + ";" // input
-            + getComponentStack(output) + ";" // output
+            + getComponentStackCsv(input) + ";" // input
+            + getComponentStackCsv(output) + ";" // output
             + renderKind(preservesValue) + ";" // kind
             + renderProvenance(c) // provenance
       )

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -178,7 +178,7 @@ SummaryComponent interpretComponentSpecific(AccessPathToken c) {
 }
 
 /** Gets the textual representation of the content in the format used for flow summaries. */
-private string getContentSpecific(Content c) {
+private string getContentSpecificCsv(Content c) {
   c = TElementContent() and result = "Element"
   or
   exists(Field f | c = TFieldContent(f) and result = "Field[" + f.getQualifiedName() + "]")
@@ -189,8 +189,8 @@ private string getContentSpecific(Content c) {
 }
 
 /** Gets the textual representation of a summary component in the format used for flow summaries. */
-string getComponentSpecific(SummaryComponent sc) {
-  exists(Content c | sc = TContentSummaryComponent(c) and result = getContentSpecific(c))
+string getComponentSpecificCsv(SummaryComponent sc) {
+  exists(Content c | sc = TContentSummaryComponent(c) and result = getContentSpecificCsv(c))
   or
   sc = TWithoutContentSummaryComponent(_) and result = "WithoutElement"
   or
@@ -204,7 +204,7 @@ string getComponentSpecific(SummaryComponent sc) {
 }
 
 /** Gets the textual representation of a parameter position in the format used for flow summaries. */
-string getParameterPosition(ParameterPosition pos) {
+string getParameterPositionCsv(ParameterPosition pos) {
   result = pos.getPosition().toString()
   or
   pos.isThisParameter() and
@@ -212,7 +212,7 @@ string getParameterPosition(ParameterPosition pos) {
 }
 
 /** Gets the textual representation of an argument position in the format used for flow summaries. */
-string getArgumentPosition(ArgumentPosition pos) {
+string getArgumentPositionCsv(ArgumentPosition pos) {
   result = pos.getPosition().toString()
   or
   pos.isQualifier() and

csharp/ql/lib/semmle/code/csharp/exprs/Literal.qll

@@ -102,8 +102,7 @@ class DecimalLiteral extends RealLiteral, @decimal_literal_expr {
 }
 
 /**
- * A `string` literal. Either a `string` literal (`StringLiteralUtf16`),
- * or a `u8` literal (`StringLiteralUtf8`).
+ * A `string` literal, for example `"Hello, World!"`.
  */
 class StringLiteral extends DotNet::StringLiteral, Literal, @string_literal_expr {
   override string toString() { result = "\"" + this.getValue().replaceAll("\"", "\\\"") + "\"" }
@@ -111,20 +110,6 @@ class StringLiteral extends DotNet::StringLiteral, Literal, @string_literal_expr
   override string getAPrimaryQlClass() { result = "StringLiteral" }
 }
 
-/**
- * A `string` literal, for example `"Hello, World!"`.
- */
-class StringLiteralUtf16 extends StringLiteral, @utf16_string_literal_expr {
-  override string getAPrimaryQlClass() { result = "StringLiteralUtf16" }
-}
-
-/**
- * A `u8` literal, for example `"AUTH"u8`
- */
-class StringLiteralUtf8 extends StringLiteral, @utf8_string_literal_expr {
-  override string getAPrimaryQlClass() { result = "StringLiteralUtf8" }
-}
-
 /**
  * A `null` literal.
  */

csharp/ql/lib/semmlecode.csharp.dbscheme

@@ -670,7 +670,7 @@ compiler_generated(unique int id: @modifiable ref);
 
 @named_exprorstmt = @goto_stmt | @labeled_stmt | @expr;
 
-@virtualizable = @method | @property | @indexer | @event | @operator;
+@virtualizable = @method | @property | @indexer | @event;
 
 exprorstmt_name(
   unique int parent_id: @named_exprorstmt ref,
@@ -1005,7 +1005,7 @@ case @expr.kind of
 |  7 = @ulong_literal_expr
 |  8 = @float_literal_expr
 |  9 = @double_literal_expr
-| 10 = @utf16_string_literal_expr
+| 10 = @string_literal_expr
 | 11 = @null_literal_expr
 /* primary & unary */
 | 12 = @this_access_expr
@@ -1139,7 +1139,6 @@ case @expr.kind of
 | 132 = @slice_pattern_expr
 | 133 = @urshift_expr
 | 134 = @assign_urshift_expr
-| 135 = @utf8_string_literal_expr
 /* Preprocessor */
 | 999 = @define_symbol_expr
 ;
@@ -1153,7 +1152,6 @@ case @expr.kind of
 
 @integer_literal_expr = @int_literal_expr | @long_literal_expr | @uint_literal_expr | @ulong_literal_expr;
 @real_literal_expr = @float_literal_expr | @double_literal_expr | @decimal_literal_expr;
-@string_literal_expr = @utf16_string_literal_expr | @utf8_string_literal_expr;
 @literal_expr = @bool_literal_expr | @char_literal_expr | @integer_literal_expr | @real_literal_expr
               | @string_literal_expr | @null_literal_expr;
 

csharp/ql/lib/upgrades/1136957c0b3c73a7798ae42645c361e813295393/upgrade.properties

@@ -1,2 +0,0 @@
-description: Add UTF-8 expression kind.
-compatibility: backwards

csharp/ql/lib/upgrades/d0fba103f7dee477dd7d9f6c038518b3f683b2c7/upgrade.properties

@@ -1,2 +0,0 @@
-description: Add operators to the virtualizable type.
-compatibility: full

csharp/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 0.5.1
-
-No user-facing changes.
-
 ## 0.5.0
 
 ### New Queries

csharp/ql/src/change-notes/released/0.5.1.md

@@ -1,3 +0,0 @@
-## 0.5.1
-
-No user-facing changes.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.1
+lastReleaseVersion: 0.5.0

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.5.2-dev
+version: 0.5.1-dev
 groups: 
   - csharp
   - queries

csharp/ql/test/experimental/ir/ir/PrintAst.expected

@@ -232,10 +232,10 @@ collections.cs:
 #   15|                   -1: [ObjectInitializer] { ..., ... }
 #   15|                     0: [MemberInitializer] ... = ...
 #   15|                       0: [FieldAccess] access to field a
-#   15|                       1: [StringLiteralUtf16] "Hello"
+#   15|                       1: [StringLiteral] "Hello"
 #   15|                     1: [MemberInitializer] ... = ...
 #   15|                       0: [FieldAccess] access to field b
-#   15|                       1: [StringLiteralUtf16] "World"
+#   15|                       1: [StringLiteral] "World"
 #   16|               1: [ElementInitializer] call to method Add
 #   16|                 0: [IntLiteral] 1
 #   16|                 1: [ObjectCreation] object creation of type MyClass
@@ -243,10 +243,10 @@ collections.cs:
 #   16|                   -1: [ObjectInitializer] { ..., ... }
 #   16|                     0: [MemberInitializer] ... = ...
 #   16|                       0: [FieldAccess] access to field a
-#   16|                       1: [StringLiteralUtf16] "Foo"
+#   16|                       1: [StringLiteral] "Foo"
 #   16|                     1: [MemberInitializer] ... = ...
 #   16|                       0: [FieldAccess] access to field b
-#   16|                       1: [StringLiteralUtf16] "Bar"
+#   16|                       1: [StringLiteral] "Bar"
 constructor_init.cs:
 #    1| [Class] BaseClass
 #    3|   4: [Field] num
@@ -443,7 +443,7 @@ events.cs:
 #   32|           0: [LocalVariableAccess] access to local variable result
 #   32|           1: [DelegateCall] delegate call
 #   32|             -1: [LocalVariableAccess] access to local variable obj
-#   32|             0: [StringLiteralUtf16] "string"
+#   32|             0: [StringLiteral] "string"
 #   33|       3: [ExprStmt] ...;
 #   33|         0: [MethodCall] call to method RemoveEvent
 #   33|           -1: [LocalVariableAccess] access to local variable obj
@@ -549,13 +549,13 @@ indexers.cs:
 #   22|           0: [IndexerCall] access to indexer
 #   22|             -1: [LocalVariableAccess] access to local variable inst
 #   22|             0: [IntLiteral] 0
-#   22|           1: [StringLiteralUtf16] "str1"
+#   22|           1: [StringLiteral] "str1"
 #   23|       2: [ExprStmt] ...;
 #   23|         0: [AssignExpr] ... = ...
 #   23|           0: [IndexerCall] access to indexer
 #   23|             -1: [LocalVariableAccess] access to local variable inst
 #   23|             0: [IntLiteral] 1
-#   23|           1: [StringLiteralUtf16] "str1"
+#   23|           1: [StringLiteral] "str1"
 #   24|       3: [ExprStmt] ...;
 #   24|         0: [AssignExpr] ... = ...
 #   24|           0: [IndexerCall] access to indexer
@@ -775,7 +775,7 @@ jumps.cs:
 #   13|             0: [MethodCall] call to method WriteLine
 #   13|               -1: [TypeAccess] access to type Console
 #   13|                 0: [TypeMention] Console
-#   13|               0: [StringLiteralUtf16] "BreakAndContinue"
+#   13|               0: [StringLiteral] "BreakAndContinue"
 #   16|       1: [ForStmt] for (...;...;...) ...
 #   16|         -1: [LocalVariableDeclAndInitExpr] Int32 i = ...
 #   16|           -1: [TypeMention] int
@@ -831,7 +831,7 @@ jumps.cs:
 #   38|         0: [MethodCall] call to method WriteLine
 #   38|           -1: [TypeAccess] access to type Console
 #   38|             0: [TypeMention] Console
-#   38|           0: [StringLiteralUtf16] "Done"
+#   38|           0: [StringLiteral] "Done"
 lock.cs:
 #    3| [Class] LockTest
 #    5|   5: [Method] A
@@ -1152,9 +1152,9 @@ stmts.cs:
 #   31|         2: [ConstCase] case ...:
 #   31|           0: [ConstantPatternExpr,IntLiteral] 0
 #   32|         3: [GotoCaseStmt] goto case ...;
-#   32|           0: [StringLiteralUtf16] "123"
+#   32|           0: [StringLiteral] "123"
 #   33|         4: [ConstCase] case ...:
-#   33|           0: [ConstantPatternExpr,StringLiteralUtf16] "123"
+#   33|           0: [ConstantPatternExpr,StringLiteral] "123"
 #   34|         5: [ExprStmt] ...;
 #   34|           0: [AssignExpr] ... = ...
 #   34|             0: [LocalVariableAccess] access to local variable select

csharp/ql/test/library-tests/arguments/PrintAst.expected

@@ -232,7 +232,7 @@ arguments.cs:
 #   68|       1: [DefaultAttribute] [My(...)]
 #   68|         -1: [TypeMention] MyAttribute
 #   68|         0: [BoolLiteral] true
-#   68|         1: [StringLiteralUtf16] ""
+#   68|         1: [StringLiteral] ""
 #   68|         2: [IntLiteral] 0
 #   69|     4: [BlockStmt] {...}
 #   72| [Class] MyAttribute

csharp/ql/test/library-tests/attributes/PrintAst.expected

@@ -1,40 +1,40 @@
 attributes.cs:
 #   10| [AssemblyAttribute] [assembly: AssemblyTitle(...)]
 #   10|   -1: [TypeMention] AssemblyTitleAttribute
-#   10|   0: [StringLiteralUtf16] "C# attributes test"
+#   10|   0: [StringLiteral] "C# attributes test"
 #   11| [AssemblyAttribute] [assembly: AssemblyDescription(...)]
 #   11|   -1: [TypeMention] AssemblyDescriptionAttribute
-#   11|   0: [StringLiteralUtf16] "A test of C# attributes"
+#   11|   0: [StringLiteral] "A test of C# attributes"
 #   12| [AssemblyAttribute] [assembly: AssemblyConfiguration(...)]
 #   12|   -1: [TypeMention] AssemblyConfigurationAttribute
-#   12|   0: [StringLiteralUtf16] ""
+#   12|   0: [StringLiteral] ""
 #   13| [AssemblyAttribute] [assembly: AssemblyCompany(...)]
 #   13|   -1: [TypeMention] AssemblyCompanyAttribute
-#   13|   0: [StringLiteralUtf16] "Semmle Plc"
+#   13|   0: [StringLiteral] "Semmle Plc"
 #   14| [AssemblyAttribute] [assembly: AssemblyProduct(...)]
 #   14|   -1: [TypeMention] AssemblyProductAttribute
-#   14|   0: [StringLiteralUtf16] "Odasa"
+#   14|   0: [StringLiteral] "Odasa"
 #   15| [AssemblyAttribute] [assembly: AssemblyCopyright(...)]
 #   15|   -1: [TypeMention] AssemblyCopyrightAttribute
-#   15|   0: [StringLiteralUtf16] "Copyright © Semmle 2018"
+#   15|   0: [StringLiteral] "Copyright © Semmle 2018"
 #   16| [AssemblyAttribute] [assembly: AssemblyTrademark(...)]
 #   16|   -1: [TypeMention] AssemblyTrademarkAttribute
-#   16|   0: [StringLiteralUtf16] ""
+#   16|   0: [StringLiteral] ""
 #   17| [AssemblyAttribute] [assembly: AssemblyCulture(...)]
 #   17|   -1: [TypeMention] AssemblyCultureAttribute
-#   17|   0: [StringLiteralUtf16] ""
+#   17|   0: [StringLiteral] ""
 #   22| [AssemblyAttribute] [assembly: ComVisible(...)]
 #   22|   -1: [TypeMention] ComVisibleAttribute
 #   22|   0: [BoolLiteral] false
 #   25| [AssemblyAttribute] [assembly: Guid(...)]
 #   25|   -1: [TypeMention] GuidAttribute
-#   25|   0: [StringLiteralUtf16] "2f70fdd6-14aa-4850-b053-d547adb1f476"
+#   25|   0: [StringLiteral] "2f70fdd6-14aa-4850-b053-d547adb1f476"
 #   37| [AssemblyAttribute] [assembly: AssemblyVersion(...)]
 #   37|   -1: [TypeMention] AssemblyVersionAttribute
-#   37|   0: [StringLiteralUtf16] "1.0.0.0"
+#   37|   0: [StringLiteral] "1.0.0.0"
 #   38| [AssemblyAttribute] [assembly: AssemblyFileVersion(...)]
 #   38|   -1: [TypeMention] AssemblyFileVersionAttribute
-#   38|   0: [StringLiteralUtf16] "1.0.0.0"
+#   38|   0: [StringLiteral] "1.0.0.0"
 #   40| [AssemblyAttribute] [assembly: Args(...)]
 #   40|   -1: [TypeMention] ArgsAttribute
 #   40|   0: [IntLiteral] 0
@@ -107,7 +107,7 @@ attributes.cs:
 #-----|     0: (Attributes)
 #   46|       1: [DefaultAttribute] [Conditional(...)]
 #   46|         -1: [TypeMention] ConditionalAttribute
-#   46|         0: [StringLiteralUtf16] "DEBUG2"
+#   46|         0: [StringLiteral] "DEBUG2"
 #   47|     4: [BlockStmt] {...}
 #   50| [Class] Bar
 #   52|   5: [Method] inc
@@ -136,7 +136,7 @@ attributes.cs:
 #   57|       1: [DefaultAttribute] [My(...)]
 #   57|         -1: [TypeMention] MyAttribute
 #   57|         0: [BoolLiteral] true
-#   57|         1: [StringLiteralUtf16] ""
+#   57|         1: [StringLiteral] ""
 #   57|         2: [IntLiteral] 0
 #   58|       2: [DefaultAttribute] [My2(...)]
 #   58|         -1: [TypeMention] My2Attribute