C++: Demonstrate overflowing guard bounds

jbj · jbj · commit 1d9acbfca939 · 2020-10-06T15:31:34.000+02:00
diff --git a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected
@@ -582,6 +582,10 @@
 | test.c:635:9:635:10 | ss | -32768 |
 | test.c:638:7:638:8 | ss | -32768 |
 | test.c:639:9:639:10 | ss | -1 |
+| test.c:645:7:645:7 | i | 0 |
+| test.c:646:9:646:9 | i | -2147483648 |
+| test.c:650:7:650:7 | u | 0 |
+| test.c:651:9:651:9 | u | 0 |
 | test.cpp:10:7:10:7 | b | -2147483648 |
 | test.cpp:11:5:11:5 | x | -2147483648 |
 | test.cpp:13:10:13:10 | x | -2147483648 |
diff --git a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c
@@ -638,4 +638,16 @@ void two_bounds_from_one_test(short ss, unsigned short us) {
   if (ss + 1 < sizeof(int)) {
     out(ss); // -1 .. 2
   }
-}
+}
+
+void guard_bound_out_of_range(void) {
+  int i = 0;
+  if (i < 0) {
+    out(i); // 0 .. 0 [BUG: is -max .. +max]
+  }
+
+  unsigned int u = 0;
+  if (u < 0) {
+    out(u); // 0 .. 0 [BUG: is 0 .. +max]
+  }
+}
diff --git a/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected b/cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected
@@ -582,6 +582,10 @@
 | test.c:635:9:635:10 | ss | 32767 |
 | test.c:638:7:638:8 | ss | 32767 |
 | test.c:639:9:639:10 | ss | 2 |
+| test.c:645:7:645:7 | i | 0 |
+| test.c:646:9:646:9 | i | 2147483647 |
+| test.c:650:7:650:7 | u | 0 |
+| test.c:651:9:651:9 | u | 4294967295 |
 | test.cpp:10:7:10:7 | b | 2147483647 |
 | test.cpp:11:5:11:5 | x | 2147483647 |
 | test.cpp:13:10:13:10 | x | 2147483647 |
