C++: Do not warn on static buffer overflow using loop counters, if the loop counter has been widened

andersfugmann · andersfugmann · commit 032ac5003484 · 2021-09-24T08:31:36.000+02:00
diff --git a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -1593,6 +1593,14 @@ private module SimpleRangeAnalysisCached {
     result = min([max(getTruncatedUpperBounds(expr)), getGuardedUpperBound(expr)])
   }
 
+  /** Holds if `expr` may have been widened */
+  cached
+  predicate upperBoundMayBeWidened(Expr e) {
+    isRecursiveExpr(e) and
+    // Corresponds to taking max on the RHS
+    not getGuardedUpperBound(e) < getTruncatedUpperBounds(e)
+  }
+
   /**
    * Holds if `expr` has a provably empty range. For example:
    *
diff --git a/cpp/ql/src/Critical/OverflowStatic.ql b/cpp/ql/src/Critical/OverflowStatic.ql
@@ -55,6 +55,8 @@ predicate overflowOffsetInLoop(BufferAccess bufaccess, string msg) {
     loop.counter().getAnAccess() = bufaccess.getArrayOffset() and
     // Ensure that we don't have an upper bound on the array index that's less than the buffer size.
     not upperBound(bufaccess.getArrayOffset().getFullyConverted()) < bufaccess.bufferSize() and
+    // The upper bounds analysis must not have been widended
+    not upperBoundMayBeWidened(bufaccess.getArrayOffset().getFullyConverted()) and
     msg =
       "Potential buffer-overflow: counter '" + loop.counter().toString() + "' <= " +
         loop.limit().toString() + " but '" + bufaccess.buffer().getName() + "' has " +

Original file line number	Diff line number	Diff line change
`@@ -1593,6 +1593,14 @@ private module SimpleRangeAnalysisCached {`
`1593`	`1593`	`result = min([max(getTruncatedUpperBounds(expr)), getGuardedUpperBound(expr)])`
`1594`	`1594`	`}`
`1595`	`1595`
	`1596`	+ /** Holds if `expr` may have been widened */
	`1597`	`+ cached`
	`1598`	`+ predicate upperBoundMayBeWidened(Expr e) {`
	`1599`	`+ isRecursiveExpr(e) and`
	`1600`	`+ // Corresponds to taking max on the RHS`
	`1601`	`+ not getGuardedUpperBound(e) < getTruncatedUpperBounds(e)`
	`1602`	`+ }`
	`1603`	`+`
`1596`	`1604`	`/**`
`1597`	`1605`	* Holds if `expr` has a provably empty range. For example:
`1598`	`1606`	`*`