Thanks to visit codestin.com
Credit goes to github.com

Skip to content

False positive: Multiplication result converted to larger type #11556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
robn opened this issue Dec 3, 2022 · 4 comments
Open

False positive: Multiplication result converted to larger type #11556

robn opened this issue Dec 3, 2022 · 4 comments
Labels
acknowledged GitHub staff acknowledges this issue false-positive

Comments

@robn
Copy link

robn commented Dec 3, 2022 •
edited
Loading

Description of the false positive

Monocypher implements, among other things, the Poly1305 MAC. CodeQL takes issue with a carefully-constructed sequence of multiplications, tripping cpp/integer-multiplication-cast-to-long.

I asked the author about it in LoupVaillant/Monocypher#245, and you should check there for an analysis. I understand the short version to be:

  • CodeQL is correct
  • The sequence is carefully constructed to never overflow, and the author has a proof
  • There are additional invariants enforced earlier that stop the overflow from being possible, that can't be expressed in C's type system
  • Adding an explicit cast silences the warnings, but results in a measurable drop in performance (it converts a 64x32b multiplication to a 64x64b)

Ideally if there was a suppression mechanism, I would use it. As it is, I will likely simply leave a comment.

Code samples or links to source code

https://github.com/LoupVaillant/Monocypher/blob/master/src/monocypher.c#L352

URL to the alert on GitHub code scanning (optional)

The Security tab appears to have no alerts in it; the reports appear in openzfs/zfs#14249.
This was referenced Dec 3, 2022
Closed
Draft
@ryao
Copy link

ryao commented Dec 4, 2022 •
edited
Loading

The Security tab appears to have no alerts in it; the reports appear in openzfs/zfs#14249.

That is issue #11021. Github does not give projects a way to stop hiding those results without giving everyone commit access. I am #4 by commit count in openzfs/zfs and even I do not have access to it. Ironically, I am the one who proposed using CodeQL in the first place. :/

We can still see general code scanning results in our own forked repositories, which makes hiding them pointless.

@hvitved
Copy link
Contributor

hvitved commented Dec 5, 2022

Hi

Just to be clear: Are you asking whether the query can be updated, to not report the claimed false-positive, or that we introduce some form of suppression mechanism (e.g. a comment)? Are you aware, that alerts can be dismissed in the UI?

@robn
Copy link
Author

robn commented Dec 5, 2022

I'm not asking for anything; I'm just letting you know that this happened so you can think about it and if its interesting, put it in your plans somewhere.

I'd prefer an inline method to silence the warnings but I know you're not interested in that (#9298) and I can't dismiss them in the UI as I do not have commit access to the repo (#11021).

@hvitved
Copy link
Contributor

hvitved commented Dec 5, 2022

I'm not asking for anything; I'm just letting you know that this happened so you can think about it and if its interesting, put it in your plans somewhere.

👍

@github/codeql-c I'll let you decide, whether you want to track this internally.

@hvitved hvitved added the acknowledged GitHub staff acknowledges this issue label Dec 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
acknowledged GitHub staff acknowledges this issue false-positive
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@robn @ryao @hvitved