Check for leap day

Author: ropwareJB

cpp/ql/src/Likely Bugs/Leap Year/LeapYear.qll

@@ -380,6 +380,55 @@ class StructTmLeapYearFieldAccess extends LeapYearFieldAccess {
   }
 }
 
+/**
+ * `stDate.wMonth == 2`
+ */
+class DateCheckMonthFebruary extends Operation {
+  DateCheckMonthFebruary(){
+    this.getOperator() = "==" and
+    this.getAnOperand() instanceof MonthFieldAccess and
+    this.getAnOperand().(Literal).getValue() = "2"
+  }
+
+  Expr getDateQualifier(){
+    result = this.getAnOperand().(MonthFieldAccess).getQualifier()
+  }
+}
+
+/**
+ * `stDate.wDay == 29`
+ */
+class DateCheckDay29 extends Operation {
+  DateCheckDay29(){
+    this.getOperator() = "==" and
+    this.getAnOperand() instanceof DayFieldAccess and
+    this.getAnOperand().(Literal).getValue() = "29"
+  }
+
+  Expr getDateQualifier(){
+    result = this.getAnOperand().(DayFieldAccess).getQualifier()
+  }
+}
+
+/**
+ * The combination of a February and Day 29 verification
+ * `stDate.wMonth == 2 && stDate.wDay == 29`
+ */
+class DateFebruary29Check extends Operation {
+  DateFebruary29Check(){
+    this.getOperator() = "&&" and
+    exists(DateCheckMonthFebruary checkFeb, DateCheckDay29 check29 |
+      checkFeb = this.getAnOperand() and
+      check29 = this.getAnOperand() and
+      hashCons(checkFeb.getDateQualifier()) = hashCons(check29.getDateQualifier())
+    )
+  }
+
+  Expr getDateQualifier(){
+    result = this.getAnOperand().(DateCheckMonthFebruary).getDateQualifier()
+  }
+}
+
 /**
  * `Function` that includes an operation that is checking for leap year.
  */

cpp/ql/src/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModificationPrecise.ql

@@ -280,6 +280,19 @@ predicate isYearModifiedWithCheck(YearFieldAccess fa) {
     src.isSource() and
     src.getNode().asExpr() = fa
   )
+  or
+  isUsedInFeb29Check(fa)
+}
+
+/**
+ * If there is a flow from a date struct year field access/assignment to a Feb 29 check
+ */
+predicate isUsedInFeb29Check(YearFieldAccess fa){
+  exists(DateFebruary29Check check |
+    DataFlow::localExprFlow(fa.getQualifier(), check.getDateQualifier())
+    or
+    DataFlow::localExprFlow(check.getDateQualifier(), fa.getQualifier())
+  )
 }
 
 import OperationToYearAssignmentFlow::PathGraph