C++: More fixes to overflow detection

Author: Robert Marsh

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisStage.qll

@@ -941,6 +941,17 @@ module RangeStage<
       semExprDoesntOverflow(upper.booleanNot(), e)
       or
       not potentiallyOverflowingExpr(upper.booleanNot(), e)
+      or
+      initialBounded(e, any(SemZeroBound z), _, upper.booleanNot(), _, _, _)
+      or
+      exists(D::Delta otherDelta |
+        initialBounded(e, _, otherDelta, upper.booleanNot(), _, _, _) and
+        (
+          upper = true and D::toFloat(otherDelta) >= 0
+          or
+          upper = false and D::toFloat(otherDelta) <= 0
+        )
+      )
     )
   }
 
@@ -952,16 +963,14 @@ module RangeStage<
     (
       positively = true and
       (
-        not semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TPos()
-        or
-        not semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TPos()
+        semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TPos() and
+        semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TPos()
       )
       or
       positively = false and
       (
-        not semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TNeg()
-        or
-        not semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TNeg()
+        semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TNeg() and
+        semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TNeg()
       )
     )
     or
@@ -972,16 +981,14 @@ module RangeStage<
     (
       positively = true and
       (
-        not semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TPos()
-        or
-        not semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TNeg()
+        semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TPos() and
+        semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TNeg()
       )
       or
       positively = false and
       (
-        not semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TNeg()
-        or
-        not semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TPos()
+        semExprSign(expr.(SemBinaryExpr).getLeftOperand()) = TNeg() and
+        semExprSign(expr.(SemBinaryExpr).getRightOperand()) = TPos()
       )
     )
     or

cpp/ql/test/library-tests/ir/range-analysis/Overflow.ql

@@ -0,0 +1,25 @@
+import cpp
+import experimental.semmle.code.cpp.semantic.analysis.SimpleRangeAnalysis
+import TestUtilities.InlineExpectationsTest
+
+class RangeAnalysisTest extends InlineExpectationsTest {
+  RangeAnalysisTest() { this = "RangeAnalysisTest" }
+
+  override string getARelevantTag() { result = "overflow" }
+
+  override predicate hasActualResult(Location location, string element, string tag, string value) {
+    exists(Expr e |
+      /*call.getArgument(0) = e and
+      call.getTarget().hasName("range") and*/
+      tag = "overflow" and
+      element = e.toString() and
+      location = e.getLocation() and
+      value =
+        strictconcat(string s |
+          s = "+" and exprMightOverflowPositively(e)
+          or
+          s = "-" and exprMightOverflowNegatively(e)
+        )
+    )
+  }
+}