Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 53709de

Browse files
author
Robert Marsh
authored
Merge pull request #2342 from jbj/overflow-doc-fixes
C++: Signed Overflow Check qhelp improvements
2 parents c73ae53 + 466f7fe commit 53709de

1 file changed

Lines changed: 29 additions & 39 deletions

File tree

‎cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp‎

Lines changed: 29 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -18,57 +18,47 @@ optimizing compiler.
1818
<recommendation>
1919
<p>
2020
Solutions to this problem can be thought of as falling into one of two
21-
categories: (1) rewrite the signed expression so that overflow cannot occur
22-
but the signedness remains, or (2) rewrite (or cast) the signed expression
23-
into unsigned form.
21+
categories:
2422
</p>
2523

26-
<p>
27-
Below we list examples of expressions where signed overflow may
28-
occur, along with proposed solutions. The list should not be
29-
considered exhaustive.
30-
</p>
24+
<ol>
25+
<li>Rewrite the signed expression so that overflow cannot occur
26+
but the signedness remains.</li>
27+
<li>Change the variables and all their uses to be unsigned.</li>
28+
</ol>
3129

3230
<p>
33-
Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
34-
it is possible to rewrite it as <code>(unsigned short)(i + delta)&nbsp;&lt;&nbsp;i</code>.
35-
Note that <code>i + delta</code>does not actually overflow, due to <code>int</code> promotion
31+
The following cases all fall into the first category.
3632
</p>
3733

38-
<p>
39-
Given <code>unsigned short i, delta</code> and <code>i + delta &lt; i</code>,
40-
it is also possible to rewrite it as <code>USHORT_MAX - delta</code>. It must be true
41-
that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
42-
header has been included.
43-
</p>
44-
45-
<p>
46-
Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
47-
it is possible to rewrite it as <code>INT_MAX - delta</code>. It must be true
48-
that <code>delta &gt; 0</code> and the <code>limits.h</code> or <code>climits</code>
49-
header has been included.
50-
</p>
34+
<ol>
35+
<li>
36+
Given <code>unsigned short n1, delta</code> and <code>n1 + delta &lt; n1</code>,
37+
it is possible to rewrite it as <code>(unsigned short)(n1 + delta)&nbsp;&lt;&nbsp;n1</code>.
38+
Note that <code>n1 + delta</code> does not actually overflow, due to <code>int</code> promotion.
39+
</li>
5140

52-
<p>
53-
Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
54-
it is also possible to rewrite it as <code>(unsigned)i + delta &lt; i</code>.
55-
Note that program semantics are affected by this change.
56-
</p>
41+
<li>
42+
Given <code>unsigned short n1, delta</code> and <code>n1 + delta &lt; n1</code>,
43+
it is also possible to rewrite it as <code>n1 &gt; USHORT_MAX - delta</code>. The
44+
<code>limits.h</code> or <code>climits</code> header must then be included.
45+
</li>
5746

58-
<p>
59-
Given <code>int i, delta</code> and <code>i + delta &lt; i</code>,
60-
it is also possible to rewrite it as <code>unsigned int i, delta</code> and
61-
<code>i + delta &lt; i</code>. Note that program semantics are
62-
affected by this change.
63-
</p>
47+
<li>
48+
Given <code>int n1, delta</code> and <code>n1 + delta &lt; n1</code>,
49+
it is possible to rewrite it as <code>n1 &gt; INT_MAX - delta</code>. It must be true
50+
that <code>delta &gt;= 0</code> and the <code>limits.h</code> or <code>climits</code>
51+
header has been included.
52+
</li>
53+
</ol>
6454
</recommendation>
6555

6656
<example>
6757
<p>
6858
In the following example, even though <code>delta</code> has been declared
6959
<code>unsigned short</code>, C/C++ type promotion rules require that its
7060
type is promoted to the larger type used in the addition and comparison,
71-
namely a <code>signed int</code>. Addition is performed on
61+
namely a <code>signed int</code>. Addition is performed on
7262
signed integers, and may have undefined behavior if an overflow occurs.
7363
As a result, the entire (comparison) expression may also have an undefined
7464
result.
@@ -87,18 +77,18 @@ are avoided.
8777
<sample src="SignedOverflowCheck-good1.cpp" />
8878
<p>
8979
In the following example, even though both <code>n</code> and <code>delta</code>
90-
have been declared <code>unsigned short</code>, both are promoted to
80+
have been declared <code>unsigned short</code>, both are promoted to
9181
<code>signed int</code> prior to addition. Because we started out with the
9282
narrower <code>short</code> type, the addition is guaranteed not to overflow
93-
and is therefore defined. But the fact that <code>n1 + delta</code> never
83+
and is therefore defined. But the fact that <code>n1 + delta</code> never
9484
overflows means that the condition <code>n1 + delta &lt; n1</code> will never
9585
hold true, which likely is not what the programmer intended. (see also the
9686
<code>cpp/bad-addition-overflow-check</code> query).
9787
</p>
9888
<sample src="SignedOverflowCheck-bad2.cpp" />
9989
<p>
10090
The next example provides a solution to the previous one. Even though
101-
<code>i + delta</code> does not overflow, casting it to an
91+
<code>n1 + delta</code> does not overflow, casting it to an
10292
<code>unsigned short</code> truncates the addition modulo 2^16,
10393
so that <code>unsigned short</code> "wrap around" may now be observed.
10494
Furthermore, since the left-hand side is now of type <code>unsigned short</code>,

0 commit comments

Comments
 (0)