From 55a3dae3b2fd5260d4034d6473edfab28ab3d37b Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 18 Dec 2025 09:13:50 -0500 Subject: [PATCH] Minor fix to the query that should not alter prior semantics. Previously checking a type checker pattern and checking an operand is a DerivedType or a PointerType, but pointer derives from DerivedType, so the PointerType check is unnecessary. --- .../SizeOfMisuse/ArgumentIsSizeofOrOperation.ql | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/cpp/ql/src/Microsoft/Likely Bugs/SizeOfMisuse/ArgumentIsSizeofOrOperation.ql b/cpp/ql/src/Microsoft/Likely Bugs/SizeOfMisuse/ArgumentIsSizeofOrOperation.ql index c75a05160aa4..1ac9eda571aa 100644 --- a/cpp/ql/src/Microsoft/Likely Bugs/SizeOfMisuse/ArgumentIsSizeofOrOperation.ql +++ b/cpp/ql/src/Microsoft/Likely Bugs/SizeOfMisuse/ArgumentIsSizeofOrOperation.ql @@ -24,13 +24,11 @@ predicate isIgnorableBinaryOperation(BinaryOperation op) { zeroOperand.getExplicitlyConverted().getUnspecifiedType() = t and // often 'NULL' is defined as (void *)0, ignore these cases not t instanceof VoidPointerType and - ( - // Apparently derived types, eg., functoin pointers, aren't PointerType - // according to codeql, so special casing them out here. - other.getUnspecifiedType() instanceof DerivedType - or - other.getUnspecifiedType() instanceof PointerType - ) + // Note Function pointers are not considered PointerType + // casting a wider net here and saying the 'other' cannot be a + // derived type, which is probably too wide, but I think anything + //loosely matching this pattern should be ignored. + other.getUnspecifiedType() instanceof DerivedType ) }