Add failing test for upper bound checks

owen-mc · owen-mc · commit 773f46d3b417 · 2023-10-26T16:58:36.000+01:00
diff --git a/go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.go b/go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.go
@@ -333,8 +333,11 @@ func testBoundsChecking(input string) {
 			_ = uint16(parsed)
 			_ = int16(parsed) // $ hasValueFlow="type conversion"
 		}
-		if parsed < 5 {
-			_ = uint16(parsed)
+		if parsed <= 255 {
+			_ = uint8(parsed)
+		}
+		if parsed <= 256 {
+			_ = uint8(parsed) // $ hasValueFlow="type conversion"
 		}
 		if err == nil && 1 == 1 && parsed < math.MaxInt8 {
 			_ = int8(parsed)

Original file line number	Diff line number	Diff line change
`@@ -333,8 +333,11 @@ func testBoundsChecking(input string) {`
`333`	`333`	`_ = uint16(parsed)`
`334`	`334`	`_ = int16(parsed) // $ hasValueFlow="type conversion"`
`335`	`335`	`}`
`336`		`- if parsed < 5 {`
`337`		`- _ = uint16(parsed)`
	`336`	`+ if parsed <= 255 {`
	`337`	`+ _ = uint8(parsed)`
	`338`	`+ }`
	`339`	`+ if parsed <= 256 {`
	`340`	`+ _ = uint8(parsed) // $ hasValueFlow="type conversion"`
`338`	`341`	`}`
`339`	`342`	`if err == nil && 1 == 1 && parsed < math.MaxInt8 {`
`340`	`343`	`_ = int8(parsed)`