diff --git a/codeql/samples/integer_overflow/findIntegerOverflow.ql b/codeql/samples/integer_overflow/findIntegerOverflow.ql new file mode 100644 index 0000000..a52f952 --- /dev/null +++ b/codeql/samples/integer_overflow/findIntegerOverflow.ql @@ -0,0 +1,12 @@ +import cpp +import semmle.code.cpp.security.FlowSources +import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis +import semmle.code.cpp.valuenumbering.GlobalValueNumbering + +from RelationalOperation ro, AddExpr add, Expr exprOne, Expr exprTwo +where + add.getAnOperand() = exprOne and + add.getAnOperand() = exprTwo and + globalValueNumber(exprOne) = globalValueNumber(exprTwo) and + exprMightOverflowPositively(add) or exprMightOverflowNegatively(add) +select add