C++: Fix BMN issue in cpp/integer-multiplication-cast-to-long.

geoffw0 · geoffw0 · commit 6552c849f0d0 · 2026-03-11T17:49:36.000Z
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql b/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
@@ -218,7 +218,9 @@ where
   // only report if we cannot prove that the result of the
   // multiplication will be less (resp. greater) than the
   // maximum (resp. minimum) number we can compute.
-  overflows(me, t1)
+  overflows(me, t1) and
+  // exclude cases where the expression type may not have been extracted accurately
+  not me.getParent().(Call).getTarget().hasAmbiguousReturnType()
 select me,
   "Multiplication result may overflow '" + me.getType().toString() + "' before it is converted to '"
     + me.getFullyConverted().getType().toString() + "'."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c
@@ -6,9 +6,9 @@ void test_float_double1(float f, double d) {
     double r3 = f * f; // BAD
     double r4 = f * d; // GOOD
 
-    float f1 = fabsf(f * f); // GOOD [FALSE POSITIVE]
+    float f1 = fabsf(f * f); // GOOD
     float f2 = fabsf(f * d); // GOOD
-    double f3 = fabs(f * f); // BAD
+    double f3 = fabs(f * f); // BAD [NOT DETECTED]
     double f4 = fabs(f * d); // GOOD
 }
 
@@ -23,6 +23,6 @@ void test_float_double2(float f, double d) {
 
     float f1 = fabsf(f * f); // GOOD
     float f2 = fabsf(f * d); // GOOD
-    double f3 = fabs(f * f); // BAD
+    double f3 = fabs(f * f); // BAD [NOT DETECTED]
     double f4 = fabs(f * d); // GOOD
 }
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.expected b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.expected
@@ -1,8 +1,5 @@
 | Buildless.c:6:17:6:21 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
-| Buildless.c:9:22:9:26 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
-| Buildless.c:11:22:11:26 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
 | Buildless.c:21:17:21:21 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
-| Buildless.c:26:22:26:26 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
 | IntMultToLong.c:4:10:4:14 | ... * ... | Multiplication result may overflow 'int' before it is converted to 'long long'. |
 | IntMultToLong.c:7:16:7:20 | ... * ... | Multiplication result may overflow 'int' before it is converted to 'long long'. |
 | IntMultToLong.c:18:19:18:23 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
