CodeQL documentation

Using range analysis for C and C++

You can use range analysis to determine the upper or lower bounds on an expression, or whether an expression could potentially over or underflow.

About the range analysis library

The range analysis library (defined in semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis) provides a set of predicates for determining constant upper and lower bounds on expressions, as well as recognizing integer overflows. For performance, the library performs automatic widening and therefore may not provide the tightest possible bounds.

Bounds predicates

The upperBound and lowerBound predicates provide constant bounds on expressions. No conversions of the argument are included in the bound. In the common case that your query needs to take conversions into account, call them on the converted form, such as upperBound(expr.getFullyConverted()).

Overflow predicates

exprMightOverflow and related predicates hold if the relevant expression might overflow, as determined by the range analysis library. The convertedExprMightOverflow family of predicates will take conversions into account.


This query uses upperBound to determine whether the result of snprintf is checked when used in a loop.

from FunctionCall call, DataFlow::Node source, DataFlow::Node sink, Expr convSink
  // the call is an snprintf with a string format argument
  call.getTarget().getName() = "snprintf" and
  call.getArgument(2).getValue().regexpMatch(".*%s.*") and

  // the result of the call influences its size argument in later iterations
  TaintTracking::localTaint(source, sink) and
  source.asExpr() = call and
  sink.asExpr() = call.getArgument(1) and

  // there is no fixed bound on the snprintf's size argument
  upperBound(convSink) = typeUpperBound(convSink.getType().getUnspecifiedType()) and
  convSink = call.getArgument(1).getFullyConverted()

select call, upperBound(call.getArgument(1).getFullyConverted())