C++: Fix false positives

MathiasVP · MathiasVP · commit e1942bbee126 · 2020-03-13T17:09:57.000+01:00
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -101,9 +101,20 @@ private string getValue(Expr e) {
   then result = e.getValue()
   else
     exists(VariableAccess access, Variable v |
+      /*
+       * It should be safe to propagate the initialization value to a variable if:
+       * The type of v is const, and
+       * The type of v is not volatile, and
+       * Either:
+       *   v is a local/global variable, or
+       *   v is a static member variable
+       */
+
+      (v instanceof StaticStorageDurationVariable or v instanceof LocalVariable) and
+      not v.getUnderlyingType().isVolatile() and
+      v.getUnderlyingType().isConst() and
       e = access and
       v = access.getTarget() and
-      v.getUnderlyingType().isConst() and
       result = getValue(v.getAnAssignedValue())
     )
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp
@@ -1,5 +1,5 @@
 void func_with_default_arg(const int n = 0) {
-    if(n <= 10) {} // GOOD [FALSE POSITIVE]
+    if(n <= 10) {}
 }
 
 struct A {
@@ -13,7 +13,7 @@ struct A {
 
 struct B {
     B(const int n = 0) {
-        if(n <= 10) {} // GOOD [FALSE POSITIVE]
+        if(n <= 10) {}
     }
 };
 
@@ -25,5 +25,5 @@ void test1() {
     A a(100);
     if(a.int_member <= 10) {}
 
-    if(volatile_const_global <= 10) {} // GOOD [FALSE POSITIVE]
+    if(volatile_const_global <= 10) {}
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.expected
@@ -38,8 +38,5 @@
 | PointlessComparison.c:303:9:303:14 | ... >= ... | Comparison is always false because c <= 0. |
 | PointlessComparison.c:312:9:312:14 | ... >= ... | Comparison is always false because c <= 0. |
 | PointlessComparison.c:337:14:337:21 | ... >= ... | Comparison is always true because x >= 0. |
-| PointlessComparison.cpp:2:8:2:14 | ... <= ... | Comparison is always true because n <= 0. |
-| PointlessComparison.cpp:16:12:16:18 | ... <= ... | Comparison is always true because n <= 0. |
-| PointlessComparison.cpp:28:8:28:34 | ... <= ... | Comparison is always true because volatile_const_global <= 0. |
 | RegressionTests.cpp:57:7:57:22 | ... <= ... | Comparison is always true because * ... <= 4294967295. |
 | Templates.cpp:9:10:9:24 | ... <= ... | Comparison is always true because local <= 32767. |

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`void func_with_default_arg(const int n = 0) {`
`2`		`- if(n <= 10) {} // GOOD [FALSE POSITIVE]`
	`2`	`+ if(n <= 10) {}`
`3`	`3`	`}`
`4`	`4`
`5`	`5`	`struct A {`
`@@ -13,7 +13,7 @@ struct A {`
`13`	`13`
`14`	`14`	`struct B {`
`15`	`15`	`B(const int n = 0) {`
`16`		`- if(n <= 10) {} // GOOD [FALSE POSITIVE]`
	`16`	`+ if(n <= 10) {}`
`17`	`17`	`}`
`18`	`18`	`};`
`19`	`19`
`@@ -25,5 +25,5 @@ void test1() {`
`25`	`25`	`A a(100);`
`26`	`26`	`if(a.int_member <= 10) {}`
`27`	`27`
`28`		`- if(volatile_const_global <= 10) {} // GOOD [FALSE POSITIVE]`
	`28`	`+ if(volatile_const_global <= 10) {}`
`29`	`29`	`}`