Skip to content

Commit bc3e8c9

Browse files
jketemaCopilot
andcommitted
Add std::byte pointer scaling test
Cover record-index arithmetic from std::byte storage, reproducing #22929. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 824bba2 commit bc3e8c9

2 files changed

Lines changed: 15 additions & 0 deletions

File tree

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
| test.cpp:50:19:50:19 | p | This pointer might have type $@ (size 8), but this pointer arithmetic is done with type int * (size 4). | test.cpp:45:11:45:11 | test.cpp:45:11:45:11 | double |
22
| test.cpp:94:18:94:18 | x | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:88:21:88:21 | test.cpp:88:21:88:21 | int |
33
| test.cpp:130:27:130:29 | arr | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:128:16:128:18 | test.cpp:128:16:128:18 | int |
4+
| test.cpp:161:36:161:42 | storage | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type Record * (size 4). | test.cpp:158:27:158:33 | test.cpp:158:27:158:33 | byte |

‎cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,3 +146,17 @@ int test18(int i) {
146146
// BAD: the pointer arithmetic uses type char*, so the offset is not scaled by sizeof(int).
147147
return *(int *)(charPointer + i); // $ Alert[cpp/incorrect-pointer-scaling-char]
148148
}
149+
150+
namespace std {
151+
enum class byte : unsigned char {};
152+
}
153+
154+
struct Record {
155+
int value;
156+
};
157+
158+
Record* test19(std::byte* storage, unsigned long recordIndex) {
159+
// GOOD [FALSE POSITIVE of IncorrectPointerScaling.ql]: this offset is a
160+
// record index, not a byte offset.
161+
return reinterpret_cast<Record*>(storage) + recordIndex; // $ Alert[cpp/suspicious-pointer-scaling]
162+
}

0 commit comments

Comments
 (0)