C++: Another attempt to make the fix more solid. I believe it can't produce negative numbers now.

Author: geoffw0

cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

@@ -92,12 +92,7 @@ private int getSize(VariableAccess va) {
       // buffer is `12 - 4 = 8`.
       c = getRootType(va) and
       // we calculate the size based on the last field, to avoid including any padding after it
-      trueSize =
-        max(Field f |
-          f.getDeclaringType*() = c
-        |
-          f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()
-        ) and
+      trueSize = max(Field f | | f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()) and
       result = trueSize - v.(Field).getOffsetInClass(c)
     )
   )