C++: Improve and promote cpp/overflow-buffer

[geoffw0]

Improve and promote "Call to memory access function may overflow buffer" (cpp/overflow-buffer).

• fix an issue where references to array expressions inside offsetof expressions were being misinterpreted as accesses.
• promote the query onto security-extended (by increasing the severity to warning and setting the precision to medium).
• added some test cases along the way, inspired by real world results / FPs found using MRVA.
  • I actually found three classes of false positives in the real world results, but only decided to fix one of them. For the other two, I believe it will be more challenging to determine which are TP vs FP cases. If we want to promote the query to high precision (code scanning suite) at some point, we will probably need to do something with these.

PR Overview

This PR improves and promotes the "Call to memory access function may overflow buffer" query by fixing its handling of array expressions within offsetof and adjusting its severity and precision for the security-extended suite.

• Updated change note in cpp/ql/src documenting the security-extended promotion of cpp/overflow-buffer.
• Added a change note in cpp/ql/lib for fixing the getBufferSize predicate issue.

Reviewed Changes

File	Description
cpp/ql/src/change-notes/2025-02-20-overflow-buffer.md	Added change note to promote cpp/overflow-buffer to security-extended.
cpp/ql/lib/change-notes/2025-02-20-getbuffersize.md	Documented the fix for getBufferSize misinterpreting array expressions.

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more