RULE-6-9-2 / A3-9-1: False positives for variables declared with auto that deduce to fixed-width types #1145

Affected rules

• RULE-6-9-2
• A3-9-1

Description

RULE-6-9-2 ("The names of the standard integer types should not be used") and AUTOSAR A3-9-1 share the query logic in VariableWidthIntegerTypesUsed.qll. The rule's intent is to prevent programmers from explicitly using variable-width integer type names (e.g., int, unsigned long) in declarations. Instead, fixed-width types from <cstdint> (e.g., std::uint32_t, std::int64_t) should be used.

The query currently produces false positives for variables declared with auto or decltype(auto) when the deduced type resolves through a fixed-width typedef to a built-in integer type. In these cases, the programmer never explicitly wrote a variable-width type name — they used auto, and the type was deduced from context (e.g., from a function returning std::uint32_t).

Example

using ID= std::uint32_t;

std::optional<ID> get_context_id();

void process() {
    const auto id = get_context_id();
    const auto value = id.value();  // Flagged: "Variable 'value' has variable-width type."
}