Skip to content

Commit 832e78c

Browse files
committed
Unify approach to architecture bit size in isSink2
1 parent cf5d1e3 commit 832e78c

File tree

1 file changed

+10
-7
lines changed

1 file changed

+10
-7
lines changed

go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,9 @@ private class MaxValueState extends TMaxValueState {
187187
* If the architecture bit size is known, then we should use that. Otherwise,
188188
* we should use 32 bits, because that will lead to more results.
189189
*/
190-
int getSinkBitSize() {
191-
if this = TMkMaxValueState(_, TMk64Bit()) then result = 64 else result = 32
190+
bindingset[default]
191+
int getSinkBitSize(int default) {
192+
if this = TMkMaxValueState(_, TMk64Bit()) then result = 64 else result = default
192193
}
193194

194195
/** Gets a textual representation of this element. */
@@ -242,7 +243,7 @@ class UpperBoundCheck extends BarrierFlowStateTransformer {
242243
}
243244

244245
override predicate barrierFor(MaxValueState flowstate) {
245-
g.isBoundFor2(flowstate.getBitSize(), flowstate.getSinkBitSize())
246+
g.isBoundFor2(flowstate.getBitSize(), flowstate.getSinkBitSize(32))
246247
}
247248

248249
override MaxValueState transform(MaxValueState state) {
@@ -251,7 +252,7 @@ class UpperBoundCheck extends BarrierFlowStateTransformer {
251252
max(int bitsize |
252253
bitsize = validBitSize() and
253254
bitsize < state.getBitSize() and
254-
not g.isBoundFor2(bitsize, state.getSinkBitSize())
255+
not g.isBoundFor2(bitsize, state.getSinkBitSize(32))
255256
|
256257
bitsize
257258
) and
@@ -325,20 +326,22 @@ private module ConversionWithoutBoundsCheckConfig implements DataFlow::StateConf
325326
*/
326327
additional predicate isSink2(DataFlow::TypeCastNode sink, FlowState state) {
327328
sink.asExpr() instanceof ConversionExpr and
328-
exists(IntegerType integerType, int sinkBitsize, boolean sinkIsSigned |
329+
exists(int architectureBitSize, IntegerType integerType, int sinkBitsize, boolean sinkIsSigned |
330+
architectureBitSize = getIntTypeBitSize(sink.getFile(), state.getSinkBitSize(32)) and
331+
not (state.getArchitectureBitSize() = 32 and architectureBitSize = 64) and
329332
sink.getResultType().getUnderlyingType() = integerType and
330333
(
331334
sinkBitsize = integerType.getSize()
332335
or
333336
not exists(integerType.getSize()) and
334-
sinkBitsize = getIntTypeBitSize(sink.getFile(), 0)
337+
sinkBitsize = 0
335338
) and
336339
(
337340
if integerType instanceof SignedIntegerType
338341
then sinkIsSigned = true
339342
else sinkIsSigned = false
340343
) and
341-
adjustBitSize(sinkBitsize, sinkIsSigned, state.getSinkBitSize()) < state.getBitSize()
344+
adjustBitSize(sinkBitsize, sinkIsSigned, architectureBitSize) < state.getBitSize()
342345
) and
343346
not exists(ShrExpr shrExpr |
344347
shrExpr.getLeftOperand().getGlobalValueNumber() =

0 commit comments

Comments
 (0)