Skip to content

Fix #15000: Propagate integral cast ranges with path-safe value flow #8819

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jfdeverge wants to merge 1 commit into
base: main
Choose a base branch
from
+3,204 −359
Open

Fix #15000: Propagate integral cast ranges with path-safe value flow #8819

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .github/workflows/CI-cygwin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ jobs:
- name: Set up Cygwin
uses: cygwin/cygwin-install-action@v6
with:
site: https://mirrors.cicku.me/cygwin/
platform: ${{ matrix.platform }}
packages: ${{ matrix.packages }}

Expand Down
6 changes: 3 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -675,7 +675,7 @@ $(libcppdir)/templatesimplifier.o: lib/templatesimplifier.cpp lib/checkers.h lib
$(libcppdir)/timer.o: lib/timer.cpp lib/config.h lib/timer.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/timer.cpp

$(libcppdir)/token.o: lib/token.cpp externals/simplecpp/simplecpp.h lib/astutils.h lib/checkers.h lib/config.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenlist.h lib/tokenrange.h lib/utils.h lib/valueflow.h lib/vfvalue.h
$(libcppdir)/token.o: lib/token.cpp externals/simplecpp/simplecpp.h lib/astutils.h lib/checkers.h lib/config.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenlist.h lib/tokenrange.h lib/utils.h lib/valueflow.h lib/vf_common.h lib/vfvalue.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/token.cpp

$(libcppdir)/tokenlist.o: lib/tokenlist.cpp externals/simplecpp/simplecpp.h lib/astutils.h lib/checkers.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/keywords.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/smallvector.h lib/standards.h lib/templatesimplifier.h lib/token.h lib/tokenlist.h lib/utils.h lib/vfvalue.h
Expand All @@ -690,7 +690,7 @@ $(libcppdir)/vf_analyzers.o: lib/vf_analyzers.cpp lib/analyzer.h lib/astutils.h
$(libcppdir)/vf_common.o: lib/vf_common.cpp lib/astutils.h lib/checkers.h lib/config.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/utils.h lib/vf_common.h lib/vf_settokenvalue.h lib/vfvalue.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/vf_common.cpp

$(libcppdir)/vf_settokenvalue.o: lib/vf_settokenvalue.cpp lib/astutils.h lib/calculate.h lib/checkers.h lib/config.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/utils.h lib/valueflow.h lib/vf_common.h lib/vf_settokenvalue.h lib/vfvalue.h
$(libcppdir)/vf_settokenvalue.o: lib/vf_settokenvalue.cpp lib/astutils.h lib/calculate.h lib/checkers.h lib/config.h lib/errortypes.h lib/infer.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/utils.h lib/valueflow.h lib/valueptr.h lib/vf_common.h lib/vf_settokenvalue.h lib/vfvalue.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/vf_settokenvalue.cpp

$(libcppdir)/vfvalue.o: lib/vfvalue.cpp lib/config.h lib/errortypes.h lib/mathlib.h lib/smallvector.h lib/templatesimplifier.h lib/token.h lib/utils.h lib/vfvalue.h
Expand Down Expand Up @@ -957,7 +957,7 @@ test/testutils.o: test/testutils.cpp lib/check.h lib/checkers.h lib/color.h lib/
test/testvaarg.o: test/testvaarg.cpp lib/check.h lib/checkers.h lib/checkimpl.h lib/checkvaarg.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/standards.h lib/tokenize.h lib/tokenlist.h lib/utils.h test/fixture.h test/helpers.h
$(CXX) ${INCLUDE_FOR_TEST} ${CFLAGS_FOR_TEST} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ test/testvaarg.cpp

test/testvalueflow.o: test/testvalueflow.cpp lib/check.h lib/checkers.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/smallvector.h lib/standards.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h test/fixture.h test/helpers.h
test/testvalueflow.o: test/testvalueflow.cpp lib/check.h lib/checkers.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/infer.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/valueptr.h lib/vf_common.h lib/vfvalue.h test/fixture.h test/helpers.h
$(CXX) ${INCLUDE_FOR_TEST} ${CFLAGS_FOR_TEST} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ test/testvalueflow.cpp

test/testvarid.o: test/testvarid.cpp lib/check.h lib/checkers.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/path.h lib/platform.h lib/settings.h lib/smallvector.h lib/standards.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h test/fixture.h test/helpers.h
Expand Down
67 changes: 67 additions & 0 deletions lib/checkbufferoverrun.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,10 +355,77 @@ void CheckBufferOverrunImpl::arrayIndex()
arrayIndexError(tok, dimensions, indexValues);
}

const auto isNonnegativeInductionVariable = [&](const Token* indexToken) {
const Variable* const variable = indexToken->variable();
if (!variable || !indexToken->varId())
return false;

for (const Scope* loop = indexToken->scope(); loop; loop = loop->nestedIn) {
if (loop->type != ScopeType::eFor || !loop->classDef || !loop->bodyStart || !loop->bodyEnd)
continue;
const Token* const forExpressions = loop->classDef->next();
if (!forExpressions || !forExpressions->astOperand2())
continue;
const Token* const clauses = forExpressions->astOperand2();
const Token* const init = clauses->astOperand1();
const Token* const remainingClauses = clauses->astOperand2();
if (!init || !remainingClauses || !remainingClauses->astOperand1() || !remainingClauses->astOperand2())
continue;
const Token* const step = remainingClauses->astOperand2();
if (!Token::simpleMatch(init, "=") || !init->astOperand1() ||
init->astOperand1()->varId() != indexToken->varId() || !Token::simpleMatch(step, "++"))
continue;
const Token* stepVariable = step->astOperand1();
if (!stepVariable)
stepVariable = step->astOperand2();
if (!stepVariable || stepVariable->varId() != indexToken->varId())
continue;

const Token* const initialValue = init->astOperand2();
const ValueType* const initialType = initialValue ? initialValue->valueType() : nullptr;
const ValueType* const indexType = indexToken->valueType();
if (!initialValue || !initialType || !indexType || !initialType->isIntegral() || !indexType->isIntegral() ||
initialType->pointer || indexType->pointer || initialType->sign != indexType->sign ||
initialType->getSizeOf(mSettings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointer) >
indexType->getSizeOf(mSettings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointer))
continue;
const bool hasNonnegativeLowerBound = std::any_of(initialValue->values().cbegin(),

@dmcppcheck dmcppcheck Oct 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

any_of accepts the init expression when some value is a possible lower bound >= 0, even if other possible values are negative. After if (x >= 0) {}, x has >=0 and <=-1, so for (int i = x; i < 10; i++) a[i] = 0; is treated as non-negative. The negativeIndex error that the base reports (index -1) is lost. This should require that no non-impossible value of the init is negative, not just that one value is non-negative.

initialValue->values().cend(),
[](const ValueFlow::Value& value) {
return value.isIntValue() && !value.isImpossible() && !value.isInconclusive() && value.intvalue >= 0 &&
(value.bound == ValueFlow::Value::Bound::Lower ||
(value.bound == ValueFlow::Value::Bound::Point && value.isKnown()));
});
if (!hasNonnegativeLowerBound)
continue;
const Token* const condition = remainingClauses->astOperand1();
if (findVariableChanged(previousBeforeAstLeftmostLeaf(condition)->next(),
nextAfterAstRightmostLeaf(condition),
/*indirect*/ 0,
variable->declarationId(),
variable->isGlobal(),
mSettings))
continue;
if (findVariableChanged(loop->bodyStart->next(),
Comment thread
jfdeverge marked this conversation as resolved.
loop->bodyEnd,
/*indirect*/ 1,
variable->declarationId(),
variable->isGlobal(),
mSettings))
continue;
return true;
}
return false;
};

// Negative index
bool neg = false;
std::vector<ValueFlow::Value> negativeIndexes;
for (const Token * indexToken : indexTokens) {
if (isNonnegativeInductionVariable(indexToken)) {
negativeIndexes.emplace_back(ValueFlow::Value::unknown());
continue;
}
const ValueFlow::Value *negativeValue = indexToken->getValueLE(-1, mSettings);
if (negativeValue) {
negativeIndexes.emplace_back(*negativeValue);
Expand Down
Loading
Loading