Skip to content

Conversation

@bdrodes
Copy link

@bdrodes bdrodes commented Dec 2, 2025

Modifications to two sizeof queries:

  • cpp/microsoft/public/sizeof/const-int-argument
  • cpp/microsoft/public/sizeof/sizeof-or-operation-as-argument

This involved adding additional filters to how sizeof operations are chosen, which largely focused on filtering patterns observed in linux, and common patterns for asserts.

Additional filters were added to address false positives in evaluating const-int-argument for MORSE. Auditing for const-int-argument was completed over 50 cases for MORSE.

Some general stats:

  • Improved FPs for cpp/microsoft/public/sizeof/const-int-argument -> Originally 5355 alerts now 2561 (47% of the original alerts)
  • Improved FPs for cpp/microsoft/public/sizeof/sizeof-or-operation-as-argument -> Originally 81477 alerts in campaign, now 2830 (~3.5% of the original alerts)

Note, we previously considered the existing FPs acceptable as they were highly concentrated in macros that were repeatedly used. The use was suspect, though correct. Given how popular the specific macros were, we have now decided to filter these cases out to avoid noise.

@MathiasVP
Copy link
Collaborator

@bdrodes third time's the charm! See the latest backlink in this PR for the DCA run.

…hey were there, but too confusing to have repeating tests.
Copy link
Collaborator

@MathiasVP MathiasVP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One question, but otherwise this LGTM!

bdrodes and others added 2 commits December 5, 2025 12:27
…cro.ql

Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
@MathiasVP MathiasVP merged commit 3cdeb38 into main Dec 5, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants