walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix #9788 ctu: false negative array index out of bounds for array arguments (#4277)

This commit is contained in:
chrchr-github 2022-07-13 21:08:51 +02:00 committed by GitHub
parent 49117f5aeb
commit 6eab3cb8bd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/ctu.cpp
View File

@ -439,7 +439,7 @@ static std::list<std::pair<const Token *, MathLib::bigint>> getUnsafeFunction(co
{
std::list<std::pair<const Token *, MathLib::bigint>> ret;
const Variable * const argvar = scope->function->getArgumentVar(argnr);
if (!argvar->isPointer() && !argvar->isReference())
if (!argvar->isArrayOrPointer() && !argvar->isReference())
return ret;
for (const Token *tok2 = scope->bodyStart; tok2 != scope->bodyEnd; tok2 = tok2->next()) {
if (Token::Match(tok2, ")|else {")) {

12
test/testbufferoverrun.cpp
View File

@ -5058,6 +5058,18 @@ private:
" get_mac_address(macstrbuf);\n"
"}");
ASSERT_EQUALS("", errout.str());
// #9788
ctu("void f1(char *s) { s[2] = 'B'; }\n"
"void f2(char s[]) { s[2] = 'B'; }\n"
"void g() {\n"
" char str[2];\n"
" f1(str);\n"
" f2(str);\n"
"}\n");
ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:1]: (error) Array index out of bounds; 's' buffer size is 2 and it is accessed at offset 2.\n"
"[test.cpp:6] -> [test.cpp:2]: (error) Array index out of bounds; 's' buffer size is 2 and it is accessed at offset 2.\n",
errout.str());
}
void ctu_variable() {