Missing if/else statements detection by static analysis - static-analysis

Question

I'm trying to catch missing unhandled conditions of expressiong inside if statements.
First Example
if (a < 5) {
// Do something
} else {
// handled else condition
}
Second Example
if (a < 5) {
// Do something
} else if (a >= 5){
// handled else if condition
}
this two examples are correct and all possibilities are handled.
But I'm trying to cathc the conditions like
if ((a < 5) && b > 10) {
// Do something
} else if ((a >= 5) && (b > 10)){
// handled else condition
} else if((a < 5) && (b <= 10)) {
// handled else condition
}
But this condition does not handle all possibilities and there is a missing condition of
} else if ((a >= 5) && (b <= 10)) {
// missing condition which is not handled
}
I'm trying to find these kind of vulnerability by static analysis and using Abstract Syntax Tree of source codes. Is there any algorithm, approach or any paper which is studied on problem like that?

Answer 1

If you have code like
if(A) { ... }
else if (B) { ... }
else if (C) { ... }
and you want to make sure that all possibilities are handled, then you have to prove that the formula A or B or C always evaluates to true. If all you do is check for ranges, then I would transform this formula to a conjunctive normal form.
After this transformation you have a formula of the form
(F1 or F2 or ...) and (G1 or G2 or G3) and (H1 or H2 or H3) ...
where each atomic proposition is of the form (x < c), (x ≤ c), (x > c) or (x ≥ c), where x is a variable and c is a constant. These propositions can be combined by using the following transformations:
(x < c1) together with (x > c2) transforms to true if (c1 > c2)
(x < c1) together with (x ≥ c2) transforms to true if (c1 ≥ c2)
(x ≤ c1) together with (x > c2) transforms to true if (c1 ≥ c2)
(x ≤ c1) together with (x ≥ c2) transforms to true if (c1 ≥ c2)
Now look at the clause (F1 or F2 or ...). As soon as you are able to perform one of these transformations, then the entire clause is valid, and you can begin checking the next clause.
If all clauses are valid, then all possibilities are handled.
A generic solution (where the conditions in the if statements can be anything) is not as trivial. For instance, if you want to check if(f(x) || g(x)), it is possible that f() or g() have side effects, or perform very complex calculations.

Answer 2

If you wish to reduce your problem to a more general problem, you can transform the code
if ((a < 5) && b > 10) {
// Do something
} else if ((a >= 5) && (b > 10)){
// handled else condition
} else if((a < 5) && (b <= 10)) {
// handled else condition
}
into:
if ((a < 5) && b > 10) {
// Do something
} else if ((a >= 5) && (b > 10)){
// handled else condition
} else if((a < 5) && (b <= 10)) {
// handled else condition
} else {
/*# assert false ; */
}
A reasonable compiler would emit the same code for the transformed version as for the original version, and now you can use static analysis or test generation to verify that the assert holds, which is the same as verifying that the last else is never taken, which is exactly the property you are interested in.
Tools exist if the above code is Java (the assert can be a JML annotation), C (the assert can be an ACSL annotation), or C# (the assert can be a Spec# annotation). Elian Ebbing's algorithm is fine, but the alternative I suggest it to let the automated theorem provers used as back-end for these tools do the job without re-implementing the wheel that determines if a given logical proposition is a tautology. Chances are that the existing wheels are doing a better job than you'll ever be able to get.
Example in C, using Frama-C and Jessie:
int a, b;
main(){
if ((a < 5) && b > 10) {
// Do something
} else if ((a >= 5) && (b > 10)){
// handled else condition
} else if((a < 5) && (b <= 10)) {
// handled else condition
} else {
/*# assert \false ; */
}
}
The assertion is not verified, indicating that Jessie wasn't able to verify that the last case was unreachable. Adding } else if ((a >= 5) && (b <= 10)) {, the assertion is verified.