diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected index 1b6db01b903..d4b80599950 100644 --- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected +++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected @@ -43,6 +43,7 @@ ql/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql ql/cpp/ql/src/Security/CWE/CWE-416/IteratorToExpiredContainer.ql ql/cpp/ql/src/Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql ql/cpp/ql/src/Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql +ql/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql ql/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql ql/cpp/ql/src/Security/CWE/CWE-611/XXE.ql ql/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql index 343e96a00d3..d5a5cd8f665 100644 --- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql +++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql @@ -6,7 +6,7 @@ * @kind problem * @problem.severity warning * @security-severity 8.8 - * @precision medium + * @precision high * @id cpp/suspicious-add-sizeof * @tags security * external/cwe/cwe-468 diff --git a/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md new file mode 100644 index 00000000000..040e89c1347 --- /dev/null +++ b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.