[CPP-434] Update Qhelp.

zlaski-semmle · zlaski-semmle · commit 6eb0f0709ae6 · 2019-10-22T17:28:35.000-07:00
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck-bad2.cpp
@@ -1,3 +1,4 @@
 bool bar(unsigned short n1, unsigned short delta) {
-    return n1 + delta < n1; // BAD
+    // NB: Comparison is always false
+    return n1 + delta < n1; // GOOD
 }
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.qhelp
@@ -22,33 +22,35 @@ In the following example, even though <code>delta</code> has been declared
 <code>unsigned short</code>, C/C++ type promotion rules require that its
 type is promoted to the larger type used in the addition and comparison,
 namely a <code>signed int</code>.  As a result, the entire expression is
-evaluated using <code>signed</code> values and its value is therefore undefined.
+evaluated using <code>signed</code> integers and may overflow, and hence
+is undefined.
 </p>
 <sample src="SignedOverflowCheck-bad1.cpp" />
 <p>
 In the following example, even though both <code>n</code> and <code>delta</code>
-have been declared <code>unsigned short</code>, C/C++ type promotion rules
-require that both parameters be promoted to the next bigger <code>signed</code>
-integer type (in this case <code>signed int</code>) before being added together.
-As a result, the entire expression is evaluated using <code>signed</code> values
-and its value is therefore undefined.  (Note, however, that the addition cannot
-overflow since we are adding two "small" <code>unsigned short</code> values.)
+have been declared <code>unsigned short</code>, both are promoted to 
+<code>signed int</code> prior to addition.  Because we started out with the
+narrower <code>short</code> type, the addition is guaranteed not to overflow
+and is therefore defined.  But the fact that <code>n1 + delta</code> never 
+overflows means that the condition <code>n1 + delta &lt; n1</code> will never
+hold true, which likely is not what the programmer intended. (see also the
+<code>BadArithmeticOverflow.Check.ql</code> query).
 </p>
 <sample src="SignedOverflowCheck-bad2.cpp" />
 <p>
 The following example builds upon the previous one.  Again, we have two
 <code>unsigned short</code> values getting promoted to a wider type.  However,
 since <code>delta</code> is explicitly cast to an <code>unsigned</code> type,
 <code>n1</code> (on both sides of the comparison) is promoted to
-<code>unsigned</code> as well.  Since we are now operating on
+<code>unsigned int</code> as well.  Since we are now operating on
 <code>unsigned</code> values, the overflow check is defined and supported by
 standard C/C++.
 </p>
 <sample src="SignedOverflowCheck-good1.cpp" />
 <p>
 In the next example, a value of type <code>signed int</code> is
 added to a value of type <code>unsigned int</code>.  Because
-the types are of the same size, C/C++ promotion rules dictate that
+the types are of the same size, C/C++ conversion rules dictate that
 <code>unsigned int</code> is chosen as the overall type of the addition
 operation. The entire expression is evaluated using <code>unsigned</code>
 values, which is allowed and defined behavior per the C/C++ standard.

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
`1`	`1`	`bool bar(unsigned short n1, unsigned short delta) {`
`2`		`- return n1 + delta < n1; // BAD`
	`2`	`+ // NB: Comparison is always false`
	`3`	`+ return n1 + delta < n1; // GOOD`
`3`	`4`	`}`