Skip to content

Commit f84f646

Browse files
jketemaCopilot
andcommitted
Cover both cast styles for std::byte pointer scaling
Replace the Record example with two int-pointer cases matching test9, using C-style casts and reinterpret_cast respectively. Regenerate expected results for both existing false positives. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent bc3e8c9 commit f84f646

2 files changed

Lines changed: 17 additions & 8 deletions

File tree

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
| test.cpp:50:19:50:19 | p | This pointer might have type $@ (size 8), but this pointer arithmetic is done with type int * (size 4). | test.cpp:45:11:45:11 | test.cpp:45:11:45:11 | double |
22
| test.cpp:94:18:94:18 | x | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:88:21:88:21 | test.cpp:88:21:88:21 | int |
33
| test.cpp:130:27:130:29 | arr | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:128:16:128:18 | test.cpp:128:16:128:18 | int |
4-
| test.cpp:161:36:161:42 | storage | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type Record * (size 4). | test.cpp:158:27:158:33 | test.cpp:158:27:158:33 | byte |
4+
| test.cpp:160:24:160:24 | p | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type int * (size 4). | test.cpp:155:14:155:14 | test.cpp:155:14:155:14 | byte |
5+
| test.cpp:169:39:169:39 | p | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type int * (size 4). | test.cpp:164:14:164:14 | test.cpp:164:14:164:14 | byte |

‎cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -151,12 +151,20 @@ namespace std {
151151
enum class byte : unsigned char {};
152152
}
153153

154-
struct Record {
155-
int value;
156-
};
154+
std::byte* test19(
155+
std::byte *x
156+
) {
157+
int *p = (int*)x;
158+
// GOOD [FALSE POSITIVE of IncorrectPointerScaling.ql]: like char*, std::byte*
159+
// is a generic pointer type, so assume that it is really an int*.
160+
return (std::byte *)(p + 1); // $ Alert[cpp/suspicious-pointer-scaling]
161+
}
157162

158-
Record* test19(std::byte* storage, unsigned long recordIndex) {
159-
// GOOD [FALSE POSITIVE of IncorrectPointerScaling.ql]: this offset is a
160-
// record index, not a byte offset.
161-
return reinterpret_cast<Record*>(storage) + recordIndex; // $ Alert[cpp/suspicious-pointer-scaling]
163+
std::byte* test20(
164+
std::byte *x
165+
) {
166+
int *p = reinterpret_cast<int*>(x);
167+
// GOOD [FALSE POSITIVE of IncorrectPointerScaling.ql]: like char*, std::byte*
168+
// is a generic pointer type, so assume that it is really an int*.
169+
return reinterpret_cast<std::byte*>(p + 1); // $ Alert[cpp/suspicious-pointer-scaling]
162170
}

0 commit comments

Comments
 (0)