[CPP-434] Change query so it flags overflows that were cast to unsigned.

zlaski-semmle · zlaski-semmle · commit 22925189335f · 2019-10-21T17:04:46.000-07:00
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
@@ -15,8 +15,8 @@ import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 private predicate isSignedWithoutUnsignedCast(Expr e) {
-  e.getType().getUnspecifiedType().(IntegralType).isSigned() and
-  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
+  e.getType().getUnspecifiedType().(IntegralType).isSigned() /*and
+  not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()*/
 }
 
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp
@@ -39,7 +39,7 @@ bool shortShort2(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: not deleted
     // gcc 9.2 -O2: not deleted
     // msvc 19.22 /O2: not deleted
-	return (unsigned short)(n1 + delta) < n1; // GOOD
+	return (unsigned short)(n1 + delta) < n1; // BAD: n1 + delta overflow undefined
 }
 
 /* Distinguish `varname` from `ptr->varname` and `obj.varname` */
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.expected
@@ -1,7 +1,9 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:42:9:42:41 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:99:10:99:30 | ... <= ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:106:12:106:62 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:113:12:113:66 | ... < ... | Testing for signed overflow may produce undefined results. |
 | test.cpp:3:11:3:19 | ... < ... | Testing for signed overflow may produce undefined results. |
+| test.cpp:8:11:8:37 | ... < ... | Testing for signed overflow may produce undefined results. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp
@@ -5,7 +5,7 @@ bool checkOverflow1(unsigned short a, unsigned short b) {
 
 // Test for BadAdditionOverflowCheck.
 bool checkOverflow2(unsigned short a, unsigned short b) {
-  return ((unsigned short)(a + b) < a);  // GOOD: explicit cast
+  return ((unsigned short)(a + b) < a);  // BAD: a + b overflow undefined
 }
 
 // Test for PointlessSelfComparison.

Original file line number	Diff line number	Diff line change
`@@ -15,8 +15,8 @@ import cpp`
`15`	`15`	`import semmle.code.cpp.valuenumbering.GlobalValueNumbering`
`16`	`16`
`17`	`17`	`private predicate isSignedWithoutUnsignedCast(Expr e) {`
`18`		`- e.getType().getUnspecifiedType().(IntegralType).isSigned() and`
`19`		`- not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()`
	`18`	`+ e.getType().getUnspecifiedType().(IntegralType).isSigned() /*and`
	`19`	`+ not e.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()*/`
`20`	`20`	`}`
`21`	`21`
`22`	`22`	`from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2`
Original file line number	Diff line number	Diff line change
`@@ -39,7 +39,7 @@ bool shortShort2(unsigned short n1, unsigned short delta) {`
`39`	`39`	`// clang 8.0.0 -O2: not deleted`
`40`	`40`	`// gcc 9.2 -O2: not deleted`
`41`	`41`	`// msvc 19.22 /O2: not deleted`
`42`		`- return (unsigned short)(n1 + delta) < n1; // GOOD`
	`42`	`+ return (unsigned short)(n1 + delta) < n1; // BAD: n1 + delta overflow undefined`
`43`	`43`	`}`
`44`	`44`
`45`	`45`	/* Distinguish `varname` from `ptr->varname` and `obj.varname` */
Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@ bool checkOverflow1(unsigned short a, unsigned short b) {`
`5`	`5`
`6`	`6`	`// Test for BadAdditionOverflowCheck.`
`7`	`7`	`bool checkOverflow2(unsigned short a, unsigned short b) {`
`8`		`- return ((unsigned short)(a + b) < a); // GOOD: explicit cast`
	`8`	`+ return ((unsigned short)(a + b) < a); // BAD: a + b overflow undefined`
`9`	`9`	`}`
`10`	`10`
`11`	`11`	`// Test for PointlessSelfComparison.`