github / github/codeql

False positive

Open
#13,464 5 comments 0 reactions 0 assignees View on GitHub
C++ false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the false positive**

The error

This 'call to strcpy_s' operation is limited to 512 bytes but the destination is only 256 bytes.

Somehow it is getting a different size for sizeof and the actual size of the array. Not sure why it thinks they are different sizes when it's the same physical array. Code is below.

**Code samples or links to source code**

// Get the full device path
char devPath[ 256 ];
strcpy_s( devPath, sizeof( devPath ), pDetData->DevicePath );

Contributor guide

Open the contributing guide

Research direction

No file, query, entry point, or test is named. Start by locating the CodeQL query that reports the supplied strcpy_s call, then reproduce the report with the shown 256-byte array and 512-byte bound. Done means determining whether the diagnostic is a false positive and validating any query change with a regression case.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.