From f0de9c3913ba381d56832ddf3f083283d7ac3695 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 28 Aug 2026 13:39:54 +0100 Subject: [PATCH 1/4] C++: Add a crazy false positive from a Microsoft internal issue. --- .../UnsafeArrayForDaysOfYear.expected | 1 + .../Leap Year/UnsafeArrayForDaysOfYear/test.cpp | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected index 37dd8b1ae7d0..b4b42dcf499d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected @@ -1,3 +1,4 @@ | test.cpp:17:6:17:10 | items | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | | test.cpp:25:15:25:26 | new[] | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | | test.cpp:52:20:52:23 | call to vector | There is a std::vector allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | +| test.cpp:78:11:78:29 | __PRETTY_FUNCTION__ | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp index f76167c1893b..1759215eb55f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp @@ -68,3 +68,12 @@ void VectorOfDays_FalsePositive(int dayOfYear, int x) items[dayOfYear - 1] = x; } + +void f_______________________________________________________this_name_must_be_exactly_357_chars__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________() { + // Using this magic compiler variable results in a `const char` array being + // initialized with the function name which (including `void`, a space, + // and `()`). in this case, this adds up to exactly 364 characters. + // The initializer for `__PRETTY_FUNCTION__` thus initializes an array of + // length 365 (because the null-terminator adds another character). + auto x = __PRETTY_FUNCTION__; // $ SPURIOUS: Alert +} \ No newline at end of file From fcfdf8103b922bef213516e2f1951a6df597d2fb Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 28 Aug 2026 13:41:02 +0100 Subject: [PATCH 2/4] C++: Exclude compiler generated variables from a case in 'cpp/leap-year/unsafe-array-for-days-of-the-year'. --- cpp/ql/src/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql | 1 + .../UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected | 1 - .../Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/ql/src/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql b/cpp/ql/src/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql index b27db937b577..e6b1ccaa6687 100644 --- a/cpp/ql/src/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql +++ b/cpp/ql/src/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql @@ -26,6 +26,7 @@ where or exists(Variable var | var = element and + not var.isCompilerGenerated() and var.getType() instanceof LeapYearUnsafeDaysOfTheYearArrayType and allocType = "an array allocation" ) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected index b4b42dcf499d..37dd8b1ae7d0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.expected @@ -1,4 +1,3 @@ | test.cpp:17:6:17:10 | items | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | | test.cpp:25:15:25:26 | new[] | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | | test.cpp:52:20:52:23 | call to vector | There is a std::vector allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | -| test.cpp:78:11:78:29 | __PRETTY_FUNCTION__ | There is an array allocation with a hard-coded set of 365 elements, which may indicate the number of days in a year without considering leap year scenarios. | diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp index 1759215eb55f..b772c4cc3526 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp @@ -75,5 +75,5 @@ void f_______________________________________________________this_name_must_be_e // and `()`). in this case, this adds up to exactly 364 characters. // The initializer for `__PRETTY_FUNCTION__` thus initializes an array of // length 365 (because the null-terminator adds another character). - auto x = __PRETTY_FUNCTION__; // $ SPURIOUS: Alert + auto x = __PRETTY_FUNCTION__; // clean } \ No newline at end of file From 2fe9ff3a67d1bf5b9851f492ef76e739b95db7f7 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 28 Aug 2026 13:45:54 +0100 Subject: [PATCH 3/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp index b772c4cc3526..3994fce4ee88 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp @@ -71,8 +71,8 @@ void VectorOfDays_FalsePositive(int dayOfYear, int x) void f_______________________________________________________this_name_must_be_exactly_357_chars__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________() { // Using this magic compiler variable results in a `const char` array being - // initialized with the function name which (including `void`, a space, - // and `()`). in this case, this adds up to exactly 364 characters. + // initialized with the function signature. Including `void`, a space, and + // `()`, the signature adds up to exactly 364 characters in this case. // The initializer for `__PRETTY_FUNCTION__` thus initializes an array of // length 365 (because the null-terminator adds another character). auto x = __PRETTY_FUNCTION__; // clean From 416b3ee158e535467072b0068c1dbd50627a9615 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 28 Aug 2026 13:49:19 +0100 Subject: [PATCH 4/4] C++: Add an amazing change note. --- .../src/change-notes/2026-08-28-leap-year-unsafe-array-fp.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 cpp/ql/src/change-notes/2026-08-28-leap-year-unsafe-array-fp.md diff --git a/cpp/ql/src/change-notes/2026-08-28-leap-year-unsafe-array-fp.md b/cpp/ql/src/change-notes/2026-08-28-leap-year-unsafe-array-fp.md new file mode 100644 index 000000000000..4ba04f0de358 --- /dev/null +++ b/cpp/ql/src/change-notes/2026-08-28-leap-year-unsafe-array-fp.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The `cpp/leap-year/unsafe-array-for-days-of-the-year` query ("Unsafe array for days of the year") no longer reports an alert on the `__PRETTY_FUNCTION__` variable (and related variables) when the enclosing function has a signature that is exactly 364 characters. \ No newline at end of file