C++: Account for the signedness of the lesser operand in cpp/comparison-with-wider-type

[rvermeulen]

The provided example case is not detected because the value INT16_MAX + 1 can be represented with 16 bits. To account for the overflow that happens before the comparison we need to determine if the value can be represented by the type of the lesser operand. We do this by adjusting the size of the lesser operand if it is signed to ensure that the check
upperBound(conv).log2() > (getComparisonSize(small) * 8 - getComparisonSizeAdjustment(small)) holds.

...
	uint32_t big_num = INT32_MAX;
	char buf[big_num];
	int16_t bytes_received = 0;
	int max_get = INT16_MAX + 1;

	// BAD: 'bytes_received' is compared with a value of a wider type.
	// 'bytes_received' overflows before  reaching 'max_get',
	// causing an infinite loop
	while (bytes_received < max_get)
		bytes_received += get_from_input(buf, bytes_received);
	}
...

[MathiasVP]

The code (and the DCA run) LGTM. Final thing: Do we want to add a change note for this? Something like:

---
category: minorAnalysis
---
* The `cpp/comparison-with-wider-type` query now correctly handles relational operations on signed operators. As a result the query may find more results.

This would need to go to a new file at cpp/ql/src/change-notes.

[MathiasVP]

LGTM!