C++: Enforce more uniqueness in Buffer.qll

[MathiasVP]

We received a number of FP reports at Microsoft related to buffer overflow queries that all involve inconsistency in DBs. Sadly, I don't have access to any tracer logs so that we can debug why these inconsistencies happen, and I haven't been able to reproduce it with any locally build DBs.

The main problem is that a struct has multiple sizes, and this PR mitigates the problem by restricting the Buffer.qll library (which is used in a number of overflow-related queries) to only types with unique type sizes.

Since I haven't been able to reproduce the problem I also haven't been able to provide a testcase.

Commit-by-commit review recommended.

The removed result on DCA looks like exactly the kind of result we're hoping to remove. After prepreocessing the memset looks like:

memset(&_usbd_dev, 0, sizeof(*(&_usbd_dev)))

and this is obviously fine.

[Copilot]

Pull request overview

This PR addresses false positive reports in buffer overflow queries caused by database inconsistencies where structs have multiple sizes. The changes add uniqueness enforcement to the Buffer.qll library by wrapping type size calculations with the unique() aggregate.

Changes:

• Added unique() aggregate to getVariableSize() to ensure variables have a single type size
• Wrapped field size calculation in getSize() with unique() to enforce uniqueness for class field buffer sizes
• Simplified isSource() by removing redundant nested unique() since getSize() now handles uniqueness

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[IdrissRio]

Seems reasonable to me. My understanding is that when the database cannot agree on the size of a struct, for example due to missing or inconsistent defines, we currently end up reporting false positives. Your change narrows the domain by only reasoning about structs whose size is consistent and unique in the database avoiding those cases. Am I reading this correctly?

[MathiasVP]

Yep, that's exactly right 🙂

[IdrissRio]

LGTM 👍