diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp index 9ebbc4dd6e0..0345e8352be 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp @@ -13,8 +13,8 @@ void test_size_t() { printf("%zu", s); // GOOD (we generally permit signedness changes) printf("%zx", s); // GOOD (we generally permit signedness changes) printf("%d", s); // BAD [NOT DETECTED] - printf("%ld", s); // BAD [NOT DETECTED] - printf("%lld", s); // BAD [NOT DETECTED] + printf("%ld", s); // DUBIOUS [NOT DETECTED] + printf("%lld", s); // DUBIOUS [NOT DETECTED] printf("%u", s); // BAD [NOT DETECTED] char buffer[1024]; @@ -24,7 +24,9 @@ void test_size_t() { printf("%zu", &buffer[1023] - buffer); // GOOD printf("%zx", &buffer[1023] - buffer); // GOOD printf("%d", &buffer[1023] - buffer); // BAD - printf("%ld", &buffer[1023] - buffer); // BAD [NOT DETECTED] - printf("%lld", &buffer[1023] - buffer); // BAD [NOT DETECTED] + printf("%ld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED] + printf("%lld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED] printf("%u", &buffer[1023] - buffer); // BAD + // (for the `%ld` and `%lld` cases, the signedness and type sizes match, `%zd` would be most correct + // and robust but the developer may know enough to make this safe) }