FilesExpand file tree

 main

/

NegativeLengthCheck.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

48 lines (46 loc) · 1.4 KB

 main

/

NegativeLengthCheck.ql

Top

File metadata and controls

• Code
• Blame

48 lines (46 loc) · 1.4 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

/**

* @name Redundant check for negative value

* @description Checking whether the result of 'len' or 'cap' is negative is pointless,

* since these functions always returns a non-negative number. It is also

* pointless checking if an unsigned integer is negative, as it can only

* hold non-negative values.

* @kind problem

* @problem.severity warning

* @precision very-high

* @id go/negative-length-check

* @tags quality

* reliability

* correctness

* external/cwe/cwe-571

*/

import go

from ComparisonExpr cmp, DataFlow::Node op, int ub, string d, string r

where

(

exists(BuiltinFunction bf | bf = Builtin::len() or bf = Builtin::cap() |

op = bf.getACall() and d = "'" + bf.getName() + "'"

)

or

op.getType().getUnderlyingType() instanceof UnsignedIntegerType and

d = "This unsigned value"

) and

(

exists(RelationalComparisonExpr rel | rel = cmp |

rel.getLesserOperand() = op.asExpr() and

rel.getGreaterOperand().getIntValue() = ub and

(

ub < 0

or

ub = 0 and rel.isStrict()

) and

r = "be less than"

)

or

exists(EqualityTestExpr eq | eq = cmp |

eq.getAnOperand() = op.asExpr() and

eq.getAnOperand().getIntValue() = ub and

ub < 0 and

r = "equal"

)

)

select cmp, d + " is always non-negative, and hence cannot " + r + " " + ub + "."