diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index b0aaafbfa..7359690ec 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -182,11 +182,8 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vectornext(); @@ -584,8 +581,8 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector 0 && Token::Match(tok, "strcpy|strcat ( %varid% , %str% )", varid)) || (varid == 0 && Token::Match(tok, ("strcpy|strcat ( " + varnames + " , %str% )").c_str()))) { - size_t len = Token::getStrLength(tok->tokAt(varc + 4)); - if (len >= static_cast(total_size)) + long len = Token::getStrLength(tok->tokAt(varc + 4)); + if (len < 0 || len >= total_size) { bufferOverrun(tok, varid > 0 ? "" : varnames.c_str()); continue; @@ -597,8 +594,8 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vectorstrAt(6))) { - size_t len = MathLib::toLongNumber(tok->strAt(6)); - if (len > static_cast(total_size)) + long len = MathLib::toLongNumber(tok->strAt(6)); + if (len < 0 || len > total_size) { bufferOverrun(tok); continue; @@ -610,8 +607,8 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vectorstrAt(4))) { - size_t len = MathLib::toLongNumber(tok->strAt(4)); - if (len > static_cast(total_size)) + long len = MathLib::toLongNumber(tok->strAt(4)); + if (len < 0 || len > total_size) { bufferOverrun(tok); continue; @@ -622,7 +619,7 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector 0 && Token::Match(tok, "strncat ( %varid% , %any% , %num% )", varid)) { int n = MathLib::toLongNumber(tok->strAt(6)); - if (n >= total_size) + if (n < 0 || n >= total_size) strncatUsage(tok); }