[CPP-434] Much improved query (producing only true positives on a run of 75 projects).

zlaski-semmle · zlaski-semmle · commit 7fc47d496a6c · 2019-10-09T16:40:19.000-07:00
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql b/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
@@ -14,16 +14,12 @@
 import cpp
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
-private predicate sameAccess(VariableAccess va1, VariableAccess va2) {
-  globalValueNumber(va1) = globalValueNumber(va2)
-}
-
 from RelationalOperation ro, AddExpr add, VariableAccess va1, VariableAccess va2
 where
   ro.getAnOperand() = add and
   add.getAnOperand() = va1 and
   ro.getAnOperand() = va2 and
-  sameAccess(va1, va2) and
-  add.getExplicitlyConverted().getType().(IntegralType).isSigned() and
-  va2.getExplicitlyConverted().getType().(IntegralType).isSigned()
+  globalValueNumber(va1) = globalValueNumber(va2) and
+  add.getFullyConverted().getType().getUnspecifiedType().(IntegralType).isSigned() and
+  not add.getExplicitlyConverted().getType().getUnspecifiedType().(IntegralType).isUnsigned()
 select ro, "Testing for signed overflow may produce undefined results."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.cpp
@@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) {
     // clang 8.0.0 -O2: deleted
     // gcc 9.2 -O2: deleted
     // msvc 19.22 /O2: not deleted
-	return n1 + delta < n1; // BAD [NOT DETECTED]
+	return n1 + delta < n1; // BAD
 }
 
 bool shortShort2(unsigned short n1, unsigned short delta) {
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/SignedOverflowCheck/SignedOverflowCheck.expected
@@ -1,2 +1,3 @@
 | SignedOverflowCheck.cpp:8:12:8:22 | ... < ... | Testing for signed overflow may produce undefined results. |
 | SignedOverflowCheck.cpp:18:12:18:26 | ... < ... | Testing for signed overflow may produce undefined results. |
+| SignedOverflowCheck.cpp:35:9:35:23 | ... < ... | Testing for signed overflow may produce undefined results. |

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) {`
`32`	`32`	`// clang 8.0.0 -O2: deleted`
`33`	`33`	`// gcc 9.2 -O2: deleted`
`34`	`34`	`// msvc 19.22 /O2: not deleted`
`35`		`- return n1 + delta < n1; // BAD [NOT DETECTED]`
	`35`	`+ return n1 + delta < n1; // BAD`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`bool shortShort2(unsigned short n1, unsigned short delta) {`
Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`\| SignedOverflowCheck.cpp:8:12:8:22 \| ... < ... \| Testing for signed overflow may produce undefined results. \|`
`2`	`2`	`\| SignedOverflowCheck.cpp:18:12:18:26 \| ... < ... \| Testing for signed overflow may produce undefined results. \|`
	`3`	`+\| SignedOverflowCheck.cpp:35:9:35:23 \| ... < ... \| Testing for signed overflow may produce undefined results. \|`