Compare commits

...

2 Commits

Author SHA1 Message Date
Geoffrey White
560b876d6d C++: Disable results from the 5 queries. 2026-04-02 10:51:31 +01:00
Geoffrey White
83aa07b22c C++: Upgrade all 5 queries to code scanning (even cpp/implicit-function-declaration, for testing purposes). 2026-04-02 10:50:05 +01:00
5 changed files with 16 additions and 10 deletions

View File

@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.1
* @precision medium
* @precision high
* @id cpp/integer-multiplication-cast-to-long
* @tags reliability
* security
@@ -220,7 +220,8 @@ where
// maximum (resp. minimum) number we can compute.
overflows(me, t1) and
// exclude cases where the expression type may not have been extracted accurately
not me.getParent().(Call).getTarget().hasAmbiguousReturnType()
not me.getParent().(Call).getTarget().hasAmbiguousReturnType() and
none()
select me,
"Multiplication result may overflow '" + me.getType().toString() + "' before it is converted to '"
+ me.getFullyConverted().getType().toString() + "'."

View File

@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 7.5
* @precision medium
* @precision high
* @id cpp/wrong-type-format-argument
* @tags reliability
* correctness
@@ -175,7 +175,8 @@ where
not arg.getType().stripType().(RoutineType).getReturnType() instanceof ErroneousType and
not arg.(Call).mayBeFromImplicitlyDeclaredFunction() and
// Make sure that the format function definition is consistent
count(ffc.getTarget().getFormatParameterIndex()) = 1
count(ffc.getTarget().getFormatParameterIndex()) = 1 and
none()
select arg,
"This format specifier for type '" + expected.getName() + "' does not match the argument type '" +
actual.getUnspecifiedType().getName() + "'."

View File

@@ -5,10 +5,11 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
* @precision medium
* @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
* security
*/
import cpp
@@ -44,5 +45,6 @@ where
sameLocation(fdeIm, fc) and
not mistypedFunctionArguments(fc, _, _) and
not tooFewArguments(fc, _) and
not tooManyArguments(fc, _)
not tooManyArguments(fc, _) and
none()
select fc, "Function call implicitly declares '" + fdeIm.getName() + "'."

View File

@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 7.8
* @precision medium
* @precision high
* @tags reliability
* security
* external/cwe/cwe-190
@@ -73,7 +73,8 @@ where
not getComparisonSize(large.(RShiftExpr).getLeftOperand().getExplicitlyConverted()) <=
getComparisonSize(small) and
// ignore loop-invariant smaller variables
loopVariant(small, l)
loopVariant(small, l) and
none()
select rel,
"Comparison between $@ of type " + small.getType().getName() + " and $@ of wider type " +
large.getType().getName() + ".", friendlyLoc(small), small.toString(), friendlyLoc(large),

View File

@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.8
* @precision medium
* @precision high
* @id cpp/suspicious-add-sizeof
* @tags security
* external/cwe/cwe-468
@@ -29,7 +29,8 @@ where
// the pointer expression to be `char*` or `void*`. Otherwise it
// is probably a mistake.
addWithSizeof(e, sizeofExpr, _) and
not isCharSzPtrExpr(e)
not isCharSzPtrExpr(e) and
none()
select sizeofExpr,
"Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@.",
e.getFullyConverted().getType() as t, t.toString()