`A4-7-1`: Incorporate CERT C integer data loss rules

Open
#491 0 comments 0 reactions 1 assignee View on GitHub

@lcartey is already working on this.

Since Jan 17, 2024.

Assessment

This issue has not been assessed yet.

Description

Difficulty-Medium false positive/false negative Impact-High Standard-AUTOSAR
Affected rules
  • A4-7-1
Description

The IntegerExpressionLeadToDataLoss.ql query should be replaced by the more refined queries from CERT, specifically INT30-C (UnsignedIntegerOperationsWrapAround.ql), INT31-C (IntegerConversionCausesDataLoss.ql), INT32-C (SignedIntegerOverflow.ql) and INT34-C (ExprShiftedByNegativeOrGreaterPrecisionOperand.ql). These provide:

  • Additional results not covered by the original query (particularly around lossy casts and conversions).
  • Improved alert messages with more additional information and no inaccurate descriptions.
  • Additional guard and validation detection, to reduce false positives.
Dominant language
CodeQL
Stars
227
Forks
82
Avg merge
6d 7h
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-coding-standards

All issues in github/codeql-coding-standards

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.