Skip to content

Commit b7b6cd5

Browse files
d10cd10c
committed
SimpleRangeAnalysis src/: float -> BigInt
1 parent 71bf61a commit b7b6cd5

File tree

10 files changed

+98
-79
lines changed

10 files changed

+98
-79
lines changed

‎cpp/ql/src/Critical/OverflowStatic.ql

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ predicate overflowOffsetInLoop(BufferAccess bufaccess, string msg) {
5858
loop.limit() >= bufaccess.bufferSize() and
5959
loop.counter().getAnAccess() = bufaccess.getArrayOffset() and
6060
// Ensure that we don't have an upper bound on the array index that's less than the buffer size.
61-
not upperBound(bufaccess.getArrayOffset().getFullyConverted()) < bufaccess.bufferSize() and
61+
not upperBound(bufaccess.getArrayOffset().getFullyConverted()) <
62+
bufaccess.bufferSize().toBigInt() and
6263
// The upper bounds analysis must not have been widended
6364
not upperBoundMayBeWidened(bufaccess.getArrayOffset().getFullyConverted()) and
6465
msg =
@@ -103,24 +104,24 @@ class CallWithBufferSize extends FunctionCall {
103104
)
104105
}
105106

106-
int statedSizeValue() {
107+
QlBuiltins::BigInt statedSizeValue() {
107108
// `upperBound(e)` defaults to `exprMaxVal(e)` when `e` isn't analyzable. So to get a meaningful
108109
// result in this case we pick the minimum value obtainable from dataflow and range analysis.
109110
result =
110111
upperBound(this.statedSizeExpr())
111112
.minimum(min(Expr statedSizeSrc |
112113
DataFlow::localExprFlow(statedSizeSrc, this.statedSizeExpr())
113114
|
114-
statedSizeSrc.getValue().toInt()
115+
statedSizeSrc.getValue().toBigInt()
115116
))
116117
}
117118
}
118119

119120
predicate wrongBufferSize(Expr error, string msg) {
120-
exists(CallWithBufferSize call, int bufsize, Variable buf, int statedSize |
121+
exists(CallWithBufferSize call, int bufsize, Variable buf, QlBuiltins::BigInt statedSize |
121122
staticBuffer(call.buffer(), buf, bufsize) and
122123
statedSize = call.statedSizeValue() and
123-
statedSize > bufsize and
124+
statedSize > bufsize.toBigInt() and
124125
error = call.statedSizeExpr() and
125126
msg =
126127
"Potential buffer-overflow: '" + buf.getName() + "' has size " + bufsize.toString() + " not " +

‎cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,22 @@ int getEffectiveMulOperands(MulExpr me) {
7676
* using SimpleRangeAnalysis.
7777
*/
7878
class AnalyzableExpr extends Expr {
79-
float maxValue() { result = upperBound(this.getFullyConverted()) }
79+
QlBuiltins::BigInt maxValue() { result = upperBound(this.getFullyConverted()) }
8080

81-
float minValue() { result = lowerBound(this.getFullyConverted()) }
81+
QlBuiltins::BigInt minValue() { result = lowerBound(this.getFullyConverted()) }
8282
}
8383

8484
class ParenAnalyzableExpr extends AnalyzableExpr, ParenthesisExpr {
85-
override float maxValue() { result = this.getExpr().(AnalyzableExpr).maxValue() }
85+
override QlBuiltins::BigInt maxValue() { result = this.getExpr().(AnalyzableExpr).maxValue() }
8686

87-
override float minValue() { result = this.getExpr().(AnalyzableExpr).minValue() }
87+
override QlBuiltins::BigInt minValue() { result = this.getExpr().(AnalyzableExpr).minValue() }
8888
}
8989

9090
class MulAnalyzableExpr extends AnalyzableExpr, MulExpr {
91-
override float maxValue() {
92-
exists(float x1, float y1, float x2, float y2 |
91+
override QlBuiltins::BigInt maxValue() {
92+
exists(
93+
QlBuiltins::BigInt x1, QlBuiltins::BigInt y1, QlBuiltins::BigInt x2, QlBuiltins::BigInt y2
94+
|
9395
x1 = this.getLeftOperand().getFullyConverted().(AnalyzableExpr).minValue() and
9496
x2 = this.getLeftOperand().getFullyConverted().(AnalyzableExpr).maxValue() and
9597
y1 = this.getRightOperand().getFullyConverted().(AnalyzableExpr).minValue() and
@@ -98,8 +100,10 @@ class MulAnalyzableExpr extends AnalyzableExpr, MulExpr {
98100
)
99101
}
100102

101-
override float minValue() {
102-
exists(float x1, float x2, float y1, float y2 |
103+
override QlBuiltins::BigInt minValue() {
104+
exists(
105+
QlBuiltins::BigInt x1, QlBuiltins::BigInt x2, QlBuiltins::BigInt y1, QlBuiltins::BigInt y2
106+
|
103107
x1 = this.getLeftOperand().getFullyConverted().(AnalyzableExpr).minValue() and
104108
x2 = this.getLeftOperand().getFullyConverted().(AnalyzableExpr).maxValue() and
105109
y1 = this.getRightOperand().getFullyConverted().(AnalyzableExpr).minValue() and
@@ -110,27 +114,27 @@ class MulAnalyzableExpr extends AnalyzableExpr, MulExpr {
110114
}
111115

112116
class AddAnalyzableExpr extends AnalyzableExpr, AddExpr {
113-
override float maxValue() {
117+
override QlBuiltins::BigInt maxValue() {
114118
result =
115119
this.getLeftOperand().getFullyConverted().(AnalyzableExpr).maxValue() +
116120
this.getRightOperand().getFullyConverted().(AnalyzableExpr).maxValue()
117121
}
118122

119-
override float minValue() {
123+
override QlBuiltins::BigInt minValue() {
120124
result =
121125
this.getLeftOperand().getFullyConverted().(AnalyzableExpr).minValue() +
122126
this.getRightOperand().getFullyConverted().(AnalyzableExpr).minValue()
123127
}
124128
}
125129

126130
class SubAnalyzableExpr extends AnalyzableExpr, SubExpr {
127-
override float maxValue() {
131+
override QlBuiltins::BigInt maxValue() {
128132
result =
129133
this.getLeftOperand().getFullyConverted().(AnalyzableExpr).maxValue() -
130134
this.getRightOperand().getFullyConverted().(AnalyzableExpr).minValue()
131135
}
132136

133-
override float minValue() {
137+
override QlBuiltins::BigInt minValue() {
134138
result =
135139
this.getLeftOperand().getFullyConverted().(AnalyzableExpr).minValue() -
136140
this.getRightOperand().getFullyConverted().(AnalyzableExpr).maxValue()
@@ -140,7 +144,7 @@ class SubAnalyzableExpr extends AnalyzableExpr, SubExpr {
140144
class VarAnalyzableExpr extends AnalyzableExpr, VariableAccess {
141145
VarAnalyzableExpr() { this.getTarget() instanceof StackVariable }
142146

143-
override float maxValue() {
147+
override QlBuiltins::BigInt maxValue() {
144148
exists(SsaDefinition def, Variable v |
145149
def.getAUse(v) = this and
146150
// if there is a defining expression, use that for
@@ -152,7 +156,7 @@ class VarAnalyzableExpr extends AnalyzableExpr, VariableAccess {
152156
)
153157
}
154158

155-
override float minValue() {
159+
override QlBuiltins::BigInt minValue() {
156160
exists(SsaDefinition def, Variable v |
157161
def.getAUse(v) = this and
158162
if exists(def.getDefiningValue(v))

‎cpp/ql/src/Likely Bugs/Arithmetic/PointlessComparison.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,9 @@ import UnsignedGEZero
2626
// So to reduce the number of false positives, we do not report a result if
2727
// the comparison is in a macro expansion. Similarly for template
2828
// instantiations.
29-
from ComparisonOperation cmp, SmallSide ss, float left, float right, boolean value, string reason
29+
from
30+
ComparisonOperation cmp, SmallSide ss, QlBuiltins::BigInt left, QlBuiltins::BigInt right,
31+
boolean value, string reason
3032
where
3133
not cmp.isInMacroExpansion() and
3234
not cmp.isFromTemplateInstantiation(_) and

‎cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ predicate guardChecks(IRGuardCondition g, Expr e, boolean branch) {
4646
predicate offsetIsAlwaysInBounds(ArrayExpr arrayExpr, VariableAccess offsetExpr) {
4747
exists(ArrayType arrayType |
4848
arrayType = arrayExpr.getArrayBase().getUnspecifiedType() and
49-
arrayType.getArraySize() > upperBound(offsetExpr.getFullyConverted())
49+
arrayType.getArraySize().toBigInt() > upperBound(offsetExpr.getFullyConverted())
5050
)
5151
}
5252

‎cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,8 @@ where
5858
// We adjust the comparison size in the case of a signed integer type.
5959
// This is to exclude the sign bit from the comparison that determines if the small type's size is sufficient to hold
6060
// the value of the larger type determined with range analysis.
61-
upperBound(conv).log2() > (getComparisonSize(small) * 8 - getComparisonSizeAdjustment(small))
61+
upperBound(conv).toString().toFloat().log() / 2.log() >
62+
(getComparisonSize(small) * 8 - getComparisonSizeAdjustment(small))
6263
) and
6364
// Ignore cases where the smaller type is int or larger
6465
// These are still bugs, but you should need a very large string or array to

‎cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ Expr exprIsLeftOrLessBase(SubExpr sub) {
6262
// result = e - y <= e
6363
result = s and
6464
s.getLeftOperand() = e and
65-
lowerBound(s.getRightOperand().getFullyConverted()) >= 0
65+
lowerBound(s.getRightOperand().getFullyConverted()) >= 0.toBigInt()
6666
)
6767
or
6868
exists(Expr other |
@@ -73,7 +73,7 @@ Expr exprIsLeftOrLessBase(SubExpr sub) {
7373
// so:
7474
// result = e + y <= e + 0 = e
7575
result.(AddExpr).hasOperands(e, other) and
76-
upperBound(other.getFullyConverted()) <= 0
76+
upperBound(other.getFullyConverted()) <= 0.toBigInt()
7777
)
7878
or
7979
exists(DivExpr d |
@@ -85,7 +85,7 @@ Expr exprIsLeftOrLessBase(SubExpr sub) {
8585
// result = e / y <= e / 1 = e
8686
result = d and
8787
d.getLeftOperand() = e and
88-
lowerBound(d.getRightOperand().getFullyConverted()) >= 1
88+
lowerBound(d.getRightOperand().getFullyConverted()) >= 1.toBigInt()
8989
)
9090
or
9191
exists(RShiftExpr rs |
@@ -122,20 +122,20 @@ predicate exprIsSubLeftOrLess(SubExpr sub, DataFlow::Node n) {
122122
isGuarded(sub, other.asExpr(), n.asExpr()) // other >= n
123123
)
124124
or
125-
exists(DataFlow::Node other, float p, float q |
125+
exists(DataFlow::Node other, QlBuiltins::BigInt p, QlBuiltins::BigInt q |
126126
// linear access of `other`
127127
exprIsSubLeftOrLess(sub, other) and
128128
linearAccess(n.asExpr(), other.asExpr(), p, q) and // n = p * other + q
129-
p <= 1 and
130-
q <= 0
129+
p <= 1.toBigInt() and
130+
q <= 0.toBigInt()
131131
)
132132
or
133-
exists(DataFlow::Node other, float p, float q |
133+
exists(DataFlow::Node other, QlBuiltins::BigInt p, QlBuiltins::BigInt q |
134134
// linear access of `n`
135135
exprIsSubLeftOrLess(sub, other) and
136136
linearAccess(other.asExpr(), n.asExpr(), p, q) and // other = p * n + q
137-
p >= 1 and
138-
q >= 0
137+
p >= 1.toBigInt() and
138+
q >= 0.toBigInt()
139139
)
140140
}
141141

‎cpp/ql/src/experimental/Likely Bugs/DerefNullResult.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
#define NULL nullptr
2+
char *malloc(int);
3+
void printf(const char *, ...);
4+
int snprintf(char *, int, const char *);
5+
16
char * create (int arg) {
27
if (arg > 42) {
38
// this function may return NULL

‎cpp/ql/src/experimental/Likely Bugs/RedundantNullCheckParam.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
#define NULL nullptr
2+
13
void test(char *arg1, int *arg2) {
24
if (arg1[0] == 'A') {
35
if (arg2 != NULL) { //maybe redundant

‎cpp/ql/src/experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -28,32 +28,32 @@ predicate isRealRange(Expr exp) {
2828
lowerBound(exp).toString() != "-4294967296" and
2929
lowerBound(exp).toString() != "-Infinity" and
3030
lowerBound(exp).toString() != "NaN" and
31-
upperBound(exp) != 2147483647 and
32-
upperBound(exp) != 268435455 and
33-
upperBound(exp) != 33554431 and
34-
upperBound(exp) != 8388607 and
35-
upperBound(exp) != 65535 and
36-
upperBound(exp) != 32767 and
37-
upperBound(exp) != 255 and
38-
upperBound(exp) != 127 and
39-
upperBound(exp) != 63 and
40-
upperBound(exp) != 31 and
41-
upperBound(exp) != 15 and
42-
upperBound(exp) != 7 and
43-
lowerBound(exp) != -2147483648 and
44-
lowerBound(exp) != -268435456 and
45-
lowerBound(exp) != -33554432 and
46-
lowerBound(exp) != -8388608 and
47-
lowerBound(exp) != -65536 and
48-
lowerBound(exp) != -32768 and
49-
lowerBound(exp) != -128
31+
upperBound(exp) != 2147483647.toBigInt() and
32+
upperBound(exp) != 268435455.toBigInt() and
33+
upperBound(exp) != 33554431.toBigInt() and
34+
upperBound(exp) != 8388607.toBigInt() and
35+
upperBound(exp) != 65535.toBigInt() and
36+
upperBound(exp) != 32767.toBigInt() and
37+
upperBound(exp) != 255.toBigInt() and
38+
upperBound(exp) != 127.toBigInt() and
39+
upperBound(exp) != 63.toBigInt() and
40+
upperBound(exp) != 31.toBigInt() and
41+
upperBound(exp) != 15.toBigInt() and
42+
upperBound(exp) != 7.toBigInt() and
43+
lowerBound(exp) != "-2147483648".toBigInt() and
44+
lowerBound(exp) != -268435456.toBigInt() and
45+
lowerBound(exp) != -33554432.toBigInt() and
46+
lowerBound(exp) != -8388608.toBigInt() and
47+
lowerBound(exp) != -65536.toBigInt() and
48+
lowerBound(exp) != -32768.toBigInt() and
49+
lowerBound(exp) != -128.toBigInt()
5050
}
5151

5252
/** Holds if the range of values for the condition is less than the choices. */
5353
predicate isNotAllSelected(SwitchStmt swtmp) {
5454
not swtmp.getExpr().isConstant() and
55-
exists(int i |
56-
i != 0 and
55+
exists(QlBuiltins::BigInt i |
56+
i != 0.toBigInt() and
5757
(
5858
i = lowerBound(swtmp.getASwitchCase().getExpr()) and
5959
upperBound(swtmp.getExpr()) < i
@@ -70,7 +70,7 @@ predicate isNotAllSelected(SwitchStmt swtmp) {
7070
/** Holds if the range of values for the condition is greater than the selection. */
7171
predicate isConditionBig(SwitchStmt swtmp) {
7272
not swtmp.hasDefaultCase() and
73-
not exists(int iu, int il |
73+
not exists(QlBuiltins::BigInt iu, QlBuiltins::BigInt il |
7474
(
7575
iu = upperBound(swtmp.getASwitchCase().getExpr()) or
7676
iu = upperBound(swtmp.getASwitchCase().getEndExpr())
@@ -130,7 +130,7 @@ from SwitchStmt sw, string msg
130130
where
131131
isRealRange(sw.getExpr()) and
132132
lowerBound(sw.getExpr()) != upperBound(sw.getExpr()) and
133-
lowerBound(sw.getExpr()) != 0 and
133+
lowerBound(sw.getExpr()) != 0.toBigInt() and
134134
not exists(Expr cexp |
135135
cexp = sw.getASwitchCase().getExpr() and not isRealRange(cexp)
136136
or

‎cpp/ql/src/experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -97,24 +97,24 @@ predicate isRealRange(Expr exp) {
9797
lowerBound(exp).toString() != "-4294967296" and
9898
lowerBound(exp).toString() != "-Infinity" and
9999
lowerBound(exp).toString() != "NaN" and
100-
upperBound(exp) != 2147483647 and
101-
upperBound(exp) != 268435455 and
102-
upperBound(exp) != 33554431 and
103-
upperBound(exp) != 8388607 and
104-
upperBound(exp) != 65535 and
105-
upperBound(exp) != 32767 and
106-
upperBound(exp) != 255 and
107-
upperBound(exp) != 127 and
108-
lowerBound(exp) != -2147483648 and
109-
lowerBound(exp) != -268435456 and
110-
lowerBound(exp) != -33554432 and
111-
lowerBound(exp) != -8388608 and
112-
lowerBound(exp) != -65536 and
113-
lowerBound(exp) != -32768 and
114-
lowerBound(exp) != -128
100+
upperBound(exp) != 2147483647.toBigInt() and
101+
upperBound(exp) != 268435455.toBigInt() and
102+
upperBound(exp) != 33554431.toBigInt() and
103+
upperBound(exp) != 8388607.toBigInt() and
104+
upperBound(exp) != 65535.toBigInt() and
105+
upperBound(exp) != 32767.toBigInt() and
106+
upperBound(exp) != 255.toBigInt() and
107+
upperBound(exp) != 127.toBigInt() and
108+
lowerBound(exp) != "-2147483648".toBigInt() and
109+
lowerBound(exp) != -268435456.toBigInt() and
110+
lowerBound(exp) != -33554432.toBigInt() and
111+
lowerBound(exp) != -8388608.toBigInt() and
112+
lowerBound(exp) != -65536.toBigInt() and
113+
lowerBound(exp) != -32768.toBigInt() and
114+
lowerBound(exp) != -128.toBigInt()
115115
or
116-
lowerBound(exp) = 0 and
117-
upperBound(exp) = 1
116+
lowerBound(exp) = 0.toBigInt() and
117+
upperBound(exp) = 1.toBigInt()
118118
}
119119

120120
/** Holds if expressions are of different size or range */
@@ -128,11 +128,15 @@ predicate isDifferentSize(Expr exp1, Expr exp2, Expr exp3) {
128128
isRealRange(exp2) and
129129
isRealRange(exp3)
130130
) and
131-
upperBound(exp1).maximum(upperBound(exp2)) - upperBound(exp1).minimum(upperBound(exp2)) < 16 and
132-
lowerBound(exp1).maximum(lowerBound(exp2)) - lowerBound(exp1).minimum(lowerBound(exp2)) < 16 and
131+
upperBound(exp1).maximum(upperBound(exp2)) - upperBound(exp1).minimum(upperBound(exp2)) <
132+
16.toBigInt() and
133+
lowerBound(exp1).maximum(lowerBound(exp2)) - lowerBound(exp1).minimum(lowerBound(exp2)) <
134+
16.toBigInt() and
133135
(
134-
upperBound(exp1).maximum(upperBound(exp3)) - upperBound(exp1).minimum(upperBound(exp3)) > 256 or
135-
lowerBound(exp1).maximum(lowerBound(exp2)) - lowerBound(exp1).minimum(lowerBound(exp2)) > 256
136+
upperBound(exp1).maximum(upperBound(exp3)) - upperBound(exp1).minimum(upperBound(exp3)) >
137+
256.toBigInt() or
138+
lowerBound(exp1).maximum(lowerBound(exp2)) - lowerBound(exp1).minimum(lowerBound(exp2)) >
139+
256.toBigInt()
136140
)
137141
}
138142

@@ -146,10 +150,10 @@ predicate isDifferentResults(
146150
isRealRange(exp2) and
147151
isRealRange(exp3)
148152
) and
149-
exists(int i1, int i2, int i3 |
150-
i1 in [lowerBound(exp1).floor() .. upperBound(exp1).floor()] and
151-
i2 in [lowerBound(exp2).floor() .. upperBound(exp2).floor()] and
152-
i3 in [lowerBound(exp3).floor() .. upperBound(exp3).floor()] and
153+
exists(QlBuiltins::BigInt i1, QlBuiltins::BigInt i2, QlBuiltins::BigInt i3 |
154+
i1 = lowerBound(exp1) + [0 .. (upperBound(exp1) - lowerBound(exp1)).toInt()].toBigInt() and
155+
i2 = lowerBound(exp2) + [0 .. (upperBound(exp2) - lowerBound(exp2)).toInt()].toBigInt() and
156+
i3 = lowerBound(exp3) + [0 .. (upperBound(exp3) - lowerBound(exp3)).toInt()].toBigInt() and
153157
(
154158
op1 instanceof BitwiseOrExpr and
155159
op2 instanceof BitwiseAndExpr and

0 commit comments

Comments
 (0)