Merge pull request #475 from geoffw0/av_164

CPP: Fix AV Rule 164

Author: jbj

cpp/ql/src/jsf/4.21 Operators/AV Rule 164.ql

@@ -35,7 +35,7 @@ predicate constantValue(Expr e, int value) {
 predicate violation(BinaryBitwiseOperation op, int lhsBytes, int value) {
     (op instanceof LShiftExpr or op instanceof RShiftExpr) and
     constantValue(op.getRightOperand(), value) and
-    lhsBytes = op.getLeftOperand().getType().getSize() and
+    lhsBytes = op.getLeftOperand().getExplicitlyConverted().getType().getSize() and
     (value < 0 or value >= lhsBytes * 8)
 }
 

cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.expected

@@ -0,0 +1,8 @@
+| test.c:3:2:3:9 | ... >> ... | AV Rule 164: The right-hand operand (here a value is -1) of this shift shall lie between 0 and 7. |
+| test.c:6:2:6:8 | ... >> ... | AV Rule 164: The right-hand operand (here a value is 8) of this shift shall lie between 0 and 7. |
+| test.c:8:2:8:9 | ... << ... | AV Rule 164: The right-hand operand (here a value is -1) of this shift shall lie between 0 and 7. |
+| test.c:11:2:11:8 | ... << ... | AV Rule 164: The right-hand operand (here a value is 8) of this shift shall lie between 0 and 7. |
+| test.c:18:2:18:9 | ... >> ... | AV Rule 164: The right-hand operand (here a value is -1) of this shift shall lie between 0 and 7. |
+| test.c:21:2:21:8 | ... >> ... | AV Rule 164: The right-hand operand (here a value is 8) of this shift shall lie between 0 and 7. |
+| test.c:23:2:23:25 | ... >> ... | AV Rule 164: The right-hand operand (here a value is -1) of this shift shall lie between 0 and 7. |
+| test.c:26:2:26:24 | ... >> ... | AV Rule 164: The right-hand operand (here a value is 8) of this shift shall lie between 0 and 7. |

cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.qlref

@@ -0,0 +1 @@
+jsf/4.21 Operators/AV Rule 164.ql

cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c

@@ -0,0 +1,28 @@
+
+void f(unsigned char uc, signed char sc, int i) {
+	uc >> -1; // BAD
+	uc >> 0;
+	uc >> 7;
+	uc >> 8; // BAD
+
+	uc << -1; // BAD
+	uc << 0;
+	uc << 7;
+	uc << 8; // BAD
+	
+	uc >>= -1; // BAD [NOT DETECTED]
+	uc >>= 0; // BAD [NOT DETECTED]
+	uc >>= 7;
+	uc >>= 8; // BAD [NOT DETECTED]
+
+	sc >> -1; // BAD
+	sc >> 0;
+	sc >> 7;
+	sc >> 8; // BAD
+
+	((unsigned char)i) >> -1; // BAD
+	((unsigned char)i) >> 0;
+	((unsigned char)i) >> 7;
+	((unsigned char)i) >> 8; // BAD
+}
+