Java: Add another overflow check pattern to UselessComparisonTest.

aschackmull · aschackmull · commit 066a2f0d1295 · 2019-10-04T15:04:40.000+02:00
diff --git a/java/ql/src/Likely Bugs/Comparison/UselessComparisonTest.ql b/java/ql/src/Likely Bugs/Comparison/UselessComparisonTest.ql
@@ -134,34 +134,41 @@ Expr overFlowCand() {
   result.(LocalVariableDeclExpr).getInit() = overFlowCand()
 }
 
-/** Gets an expression that equals `v` plus a positive value. */
-Expr increaseOfVar(SsaVariable v) {
+predicate positiveOrNegative(Expr e) { positive(e) or negative(e) }
+
+/** Gets an expression that equals `v` plus a positive or negative value. */
+Expr increaseOrDecreaseOfVar(SsaVariable v) {
   exists(AssignAddExpr add |
     result = add and
-    positive(add.getDest()) and
+    positiveOrNegative(add.getDest()) and
     add.getRhs() = v.getAUse()
   )
   or
   exists(AddExpr add, Expr e |
     result = add and
     add.hasOperands(v.getAUse(), e) and
-    positive(e)
+    positiveOrNegative(e)
   )
   or
-  exists(SsaExplicitUpdate x | result = x.getAUse() and x.getDefiningExpr() = increaseOfVar(v))
+  exists(SubExpr sub |
+    result = sub and
+    sub.getLeftOperand() = v.getAUse() and
+    positiveOrNegative(sub.getRightOperand())
+  )
   or
-  result.(ParExpr).getExpr() = increaseOfVar(v)
+  exists(SsaExplicitUpdate x |
+    result = x.getAUse() and x.getDefiningExpr() = increaseOrDecreaseOfVar(v)
+  )
   or
-  result.(AssignExpr).getRhs() = increaseOfVar(v)
+  result.(ParExpr).getExpr() = increaseOrDecreaseOfVar(v)
   or
-  result.(LocalVariableDeclExpr).getInit() = increaseOfVar(v)
+  result.(AssignExpr).getRhs() = increaseOrDecreaseOfVar(v)
+  or
+  result.(LocalVariableDeclExpr).getInit() = increaseOrDecreaseOfVar(v)
 }
 
 predicate overFlowTest(ComparisonExpr comp) {
-  exists(SsaVariable v |
-    comp.getLesserOperand() = increaseOfVar(v) and
-    comp.getGreaterOperand() = v.getAUse()
-  )
+  exists(SsaVariable v | comp.hasOperands(increaseOrDecreaseOfVar(v), v.getAUse()))
   or
   comp.getLesserOperand() = overFlowCand() and
   comp.getGreaterOperand().(IntegerLiteral).getIntValue() = 0
diff --git a/java/ql/test/query-tests/UselessComparisonTest/A.java b/java/ql/test/query-tests/UselessComparisonTest/A.java
@@ -121,6 +121,26 @@ void overflowTests(int x, int y) {
     }
   }
 
+  static final long VAL = 100L;
+
+  long overflowAwareIncrease(long x) {
+    if (x + VAL > x) {
+      return x + VAL;
+    } else {
+      overflow();
+      return Long.MAX_VALUE;
+    }
+  }
+
+  long overflowAwareDecrease(long x) {
+    if (x - VAL < x) {
+      return x - VAL;
+    } else {
+      overflow();
+      return Long.MIN_VALUE;
+    }
+  }
+
   void overflow() { }
 
   void unreachableCode() {
