Exclude std::byte buffers from suspicious pointer scaling

Treat std::byte source pointers like char and void buffers when checking pointer scaling, avoiding false positives for intentional typed indexing. Match only the standard byte enum and update both cast-style tests to expect no alerts.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jketema

cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql

@@ -22,11 +22,12 @@ where
   destBase = baseType(destType) and
   destBase.getSize() != sourceBase.getSize() and
   not dest.isInMacroExpansion() and
-  // If the source type is a `char*` or `void*` then don't
+  // If the source type is a `char*`, `void*` or `std::byte*` then don't
   // produce a result, because it is likely to be a false
   // positive.
   not sourceBase instanceof CharType and
   not sourceBase instanceof VoidType and
+  not sourceBase.(Enum).hasQualifiedName("std", "byte") and
   // Low-level pointer tricks often involve casting a struct pointer to a
   // char pointer, then accessing it at byte offsets. For example, this can
   // be necessary in order to resume an interrupted `write(2)`.

cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScaling.expected

@@ -1,5 +1,3 @@
 | test.cpp:50:19:50:19 | p | This pointer might have type $@ (size 8), but this pointer arithmetic is done with type int * (size 4). | test.cpp:45:11:45:11 | test.cpp:45:11:45:11 | double |
 | test.cpp:94:18:94:18 | x | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:88:21:88:21 | test.cpp:88:21:88:21 | int |
 | test.cpp:130:27:130:29 | arr | This pointer might have type $@ (size 4), but this pointer arithmetic is done with type short * (size 2). | test.cpp:128:16:128:18 | test.cpp:128:16:128:18 | int |
-| test.cpp:160:24:160:24 | p | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type int * (size 4). | test.cpp:155:14:155:14 | test.cpp:155:14:155:14 | byte |
-| test.cpp:169:39:169:39 | p | This pointer might have type $@ (size 1), but this pointer arithmetic is done with type int * (size 4). | test.cpp:164:14:164:14 | test.cpp:164:14:164:14 | byte |

cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp

@@ -155,16 +155,16 @@ std::byte* test19(
   std::byte *x
 ) {
   int *p = (int*)x;
-  // GOOD [FALSE POSITIVE cpp/suspicious-pointer-scaling]: like char*, std::byte*
-  // is a generic pointer type, so assume that it is really an int*.
-  return (std::byte *)(p + 1); // $ Alert[cpp/suspicious-pointer-scaling]
+  // GOOD: like char*, std::byte* is a generic pointer type,
+  // so assume that it is really an int*.
+  return (std::byte *)(p + 1);
 }
 
 std::byte* test20(
   std::byte *x
 ) {
   int *p = reinterpret_cast<int*>(x);
-  // GOOD [FALSE POSITIVE cpp/suspicious-pointer-scaling]: like char*, std::byte*
-  // is a generic pointer type, so assume that it is really an int*.
-  return reinterpret_cast<std::byte*>(p + 1); // $ Alert[cpp/suspicious-pointer-scaling]
+  // GOOD: like char*, std::byte* is a generic pointer type,
+  // so assume that it is really an int*.
+  return reinterpret_cast<std::byte*>(p + 1);
 }