diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected index 57d240fd7958..4e86c27d53fd 100644 --- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected +++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected @@ -40,6 +40,7 @@ ql/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql ql/cpp/ql/src/Security/CWE/CWE-416/IteratorToExpiredContainer.ql ql/cpp/ql/src/Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql ql/cpp/ql/src/Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql +ql/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql ql/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql ql/cpp/ql/src/Security/CWE/CWE-611/XXE.ql ql/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql index 343e96a00d39..d5a5cd8f6655 100644 --- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql +++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql @@ -6,7 +6,7 @@ * @kind problem * @problem.severity warning * @security-severity 8.8 - * @precision medium + * @precision high * @id cpp/suspicious-add-sizeof * @tags security * external/cwe/cwe-468 diff --git a/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md new file mode 100644 index 000000000000..040e89c13475 --- /dev/null +++ b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.