codeql/cpp/ql/src/Likely Bugs/Arithmetic/BitwiseSignCheck.ql at main · github/codeql

28 lines (26 loc) · 1 KB

/**
 * @name Sign check of bitwise operation
 * @description Checking the sign of the result of a bitwise operation may yield unexpected results.
 * @kind problem
 * @problem.severity warning
 * @precision high
 * @id cpp/bitwise-sign-check
 * @tags reliability
 *       correctness
 */

import cpp

from RelationalOperation e, BinaryBitwiseOperation lhs
where
  // `lhs > 0` (or `0 < lhs`)
  // (note that `lhs < 0`, `lhs >= 0` or `lhs <= 0` all imply that the signedness of
  //  `lhs` is understood, so should not be flagged).
  (e instanceof GTExpr or e instanceof LTExpr) and
  e.getGreaterOperand() = lhs and
  e.getLesserOperand().getValue() = "0" and
  // lhs is signed
  lhs.getActualType().(IntegralType).isSigned() and
  // if `lhs` has the form `x & c`, with constant `c`, `c` is negative
  forall(int op | op = lhs.(BitwiseAndExpr).getAnOperand().getValue().toInt() | op < 0) and
  // exception for cases involving macros
  not e.isAffectedByMacro()
select e, "Potentially unsafe sign check of a bitwise operation."

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Expand file tree

Search code, repositories, users, issues, pull requests...

Uh oh!

FilesExpand file tree

BitwiseSignCheck.ql

Latest commit

History

BitwiseSignCheck.ql

File metadata and controls

Expand file tree