Start a major rewrite of CheckBufferOverrun. For now only the 'array index' and 'buffer overflow' checks are rewritten.
There are important TODOs still; for instance adding CTU support using our CTU infrastructure, add handling of pointers (maybe I'll use FwdAnalysis for this), add handling of multidimensional arrays, etc..
This commit is contained in:
Daniel Marjamäki
parent
34711bcb93
commit
729f57d8f1
File diff suppressed because it is too large
Load Diff
|
|
@ -75,243 +75,42 @@ public:
|
|||
|
||||
void runSimplifiedChecks(const Tokenizer *tokenizer, const Settings *settings, ErrorLogger *errorLogger) OVERRIDE {
|
||||
CheckBufferOverrun checkBufferOverrun(tokenizer, settings, errorLogger);
|
||||
checkBufferOverrun.checkGlobalAndLocalVariable();
|
||||
if (tokenizer && tokenizer->isMaxTime())
|
||||
return;
|
||||
checkBufferOverrun.checkStructVariable();
|
||||
checkBufferOverrun.checkBufferAllocatedWithStrlen();
|
||||
checkBufferOverrun.checkInsecureCmdLineArgs();
|
||||
checkBufferOverrun.arrayIndexThenCheck();
|
||||
checkBufferOverrun.negativeArraySize();
|
||||
checkBufferOverrun.arrayIndex();
|
||||
checkBufferOverrun.bufferOverflow();
|
||||
}
|
||||
|
||||
void runChecks(const Tokenizer *tokenizer, const Settings *settings, ErrorLogger *errorLogger) OVERRIDE {
|
||||
CheckBufferOverrun checkBufferOverrun(tokenizer, settings, errorLogger);
|
||||
checkBufferOverrun.bufferOverrun();
|
||||
checkBufferOverrun.checkStringArgument();
|
||||
(void)tokenizer;
|
||||
(void)settings;
|
||||
(void)errorLogger;
|
||||
}
|
||||
|
||||
/** @brief %Check for buffer overruns (single pass, use ast and valueflow) */
|
||||
void bufferOverrun();
|
||||
|
||||
/** @brief Using array index before bounds check */
|
||||
void arrayIndexThenCheck();
|
||||
|
||||
/** @brief negative size for array */
|
||||
void negativeArraySize();
|
||||
|
||||
/**
|
||||
* @brief Get minimum length of format string result
|
||||
* @param input_string format string
|
||||
* @param parameters given parameters to sprintf
|
||||
* @return minimum length of resulting string
|
||||
*/
|
||||
static MathLib::biguint countSprintfLength(const std::string &input_string, const std::list<const Token*> ¶meters);
|
||||
|
||||
/** Check for buffer overruns - locate struct variables and check them with the .._CheckScope function */
|
||||
void checkStructVariable();
|
||||
|
||||
/** Check for buffer overruns - locate global variables and local function variables and check them with the checkScope function */
|
||||
void checkGlobalAndLocalVariable();
|
||||
|
||||
/** Check for buffer overruns due to allocating strlen(src) bytes instead of (strlen(src)+1) bytes before copying a string */
|
||||
void checkBufferAllocatedWithStrlen();
|
||||
|
||||
/** Check string argument buffer overruns */
|
||||
void checkStringArgument();
|
||||
|
||||
/** Check for buffer overruns due to copying command-line args to fixed-sized buffers without bounds checking */
|
||||
void checkInsecureCmdLineArgs();
|
||||
|
||||
/** Information about N-dimensional array */
|
||||
class CPPCHECKLIB ArrayInfo {
|
||||
private:
|
||||
/** number of elements of array */
|
||||
std::vector<MathLib::bigint> mNum;
|
||||
|
||||
/** full name of variable as pattern */
|
||||
std::string mVarName;
|
||||
|
||||
/** size of each element in array */
|
||||
MathLib::bigint mElementSize;
|
||||
|
||||
/** declaration id */
|
||||
unsigned int mDeclarationId;
|
||||
|
||||
public:
|
||||
ArrayInfo();
|
||||
ArrayInfo(const Variable *var, const SymbolDatabase *symbolDatabase, const unsigned int forcedeclid = 0);
|
||||
|
||||
/**
|
||||
* Create array info with specified data
|
||||
* The intention is that this is only a temporary solution.. all
|
||||
* checking should be based on ArrayInfo from the start and then
|
||||
* this will not be needed as the declare can be used instead.
|
||||
*/
|
||||
ArrayInfo(unsigned int id, const std::string &name, MathLib::bigint size1, MathLib::bigint n);
|
||||
|
||||
/** Create a copy ArrayInfo where the number of elements have been limited by a value */
|
||||
ArrayInfo limit(MathLib::bigint value) const;
|
||||
|
||||
/** array sizes */
|
||||
const std::vector<MathLib::bigint> &num() const {
|
||||
return mNum;
|
||||
}
|
||||
|
||||
/** array size */
|
||||
MathLib::bigint num(std::size_t index) const {
|
||||
return mNum[index];
|
||||
}
|
||||
void num(std::size_t index, MathLib::bigint number) {
|
||||
mNum[index] = number;
|
||||
}
|
||||
|
||||
/** size of each element */
|
||||
MathLib::bigint element_size() const {
|
||||
return mElementSize;
|
||||
}
|
||||
|
||||
/** Variable name */
|
||||
unsigned int declarationId() const {
|
||||
return mDeclarationId;
|
||||
}
|
||||
void declarationId(unsigned int id) {
|
||||
mDeclarationId = id;
|
||||
}
|
||||
|
||||
/** Variable name */
|
||||
const std::string &varname() const {
|
||||
return mVarName;
|
||||
}
|
||||
void varname(const std::string &name) {
|
||||
mVarName = name;
|
||||
}
|
||||
|
||||
MathLib::bigint numberOfElements() const;
|
||||
MathLib::bigint totalIndex(const std::vector<ValueFlow::Value> &indexes) const;
|
||||
};
|
||||
|
||||
/** Check for buffer overruns (based on ArrayInfo) */
|
||||
void checkScope(const Token *tok, const ArrayInfo &arrayInfo);
|
||||
void checkScope(const Token *tok, std::map<unsigned int, ArrayInfo> arrayInfos);
|
||||
void checkScope_inner(const Token *tok, const ArrayInfo &arrayInfo);
|
||||
|
||||
/** Check for buffer overruns */
|
||||
void checkScope(const Token *tok, const std::vector<const std::string*> &varname, const ArrayInfo &arrayInfo);
|
||||
|
||||
/**
|
||||
* Helper function for checkFunctionCall - check a function parameter
|
||||
* \param ftok token for the function name
|
||||
* \param paramIndex on what parameter is the array used
|
||||
* \param arrayInfo the array information
|
||||
* \param callstack call stack. This is used to prevent recursion and to provide better error messages. Pass a empty list from checkScope etc.
|
||||
*/
|
||||
void checkFunctionParameter(const Token &ftok, const unsigned int paramIndex, const ArrayInfo &arrayInfo, const std::list<const Token *>& callstack);
|
||||
|
||||
/**
|
||||
* Helper function that checks if the array is used and if so calls the checkFunctionCall
|
||||
* @param tok token that matches "%name% ("
|
||||
* @param arrayInfo the array information
|
||||
* \param callstack call stack. This is used to prevent recursion and to provide better error messages. Pass a empty list from checkScope etc.
|
||||
*/
|
||||
void checkFunctionCall(const Token *tok, const ArrayInfo &arrayInfo, std::list<const Token *> callstack);
|
||||
|
||||
void arrayIndexOutOfBoundsError(const Token *tok, const ArrayInfo &arrayInfo, const std::vector<MathLib::bigint> &index);
|
||||
void arrayIndexOutOfBoundsError(const Token *tok, const ArrayInfo &arrayInfo, const std::vector<ValueFlow::Value> &index);
|
||||
|
||||
/* data for multifile checking */
|
||||
class MyFileInfo : public Check::FileInfo {
|
||||
public:
|
||||
std::string toString() const OVERRIDE;
|
||||
|
||||
struct ArrayUsage {
|
||||
MathLib::bigint index;
|
||||
std::string fileName;
|
||||
unsigned int linenr;
|
||||
};
|
||||
|
||||
/* key:arrayName */
|
||||
std::map<std::string, ArrayUsage> arrayUsage;
|
||||
|
||||
/* key:arrayName, data:arraySize */
|
||||
std::map<std::string, MathLib::bigint> arraySize;
|
||||
};
|
||||
|
||||
/** @brief Parse current TU and extract file info */
|
||||
Check::FileInfo *getFileInfo(const Tokenizer *tokenizer, const Settings *settings) const OVERRIDE;
|
||||
|
||||
Check::FileInfo * loadFileInfoFromXml(const tinyxml2::XMLElement *xmlElement) const OVERRIDE;
|
||||
|
||||
/** @brief Analyse all file infos for all TU */
|
||||
bool analyseWholeProgram(const CTU::FileInfo *ctu, const std::list<Check::FileInfo*> &fileInfo, const Settings& settings, ErrorLogger &errorLogger) OVERRIDE;
|
||||
|
||||
/**
|
||||
* Calculates sizeof value for given type.
|
||||
* @param type Token which will contain e.g. "int", "*", or string.
|
||||
* @return sizeof for given type, or 0 if it can't be calculated.
|
||||
*/
|
||||
unsigned int sizeOfType(const Token *type) const;
|
||||
|
||||
private:
|
||||
static bool isArrayOfStruct(const Token* tok, int &position);
|
||||
void arrayIndexOutOfBoundsError(const std::list<const Token *> &callstack, const ArrayInfo &arrayInfo, const std::vector<MathLib::bigint> &index);
|
||||
void bufferOverrunError(const Token *tok, const std::string &varnames = emptyString);
|
||||
void bufferOverrunError(const std::list<const Token *> &callstack, const std::string &varnames = emptyString);
|
||||
void strncatUsageError(const Token *tok);
|
||||
void negativeMemoryAllocationSizeError(const Token *tok); // provide a negative value to memory allocation function
|
||||
void negativeArraySizeError(const Token *tok);
|
||||
void outOfBoundsError(const Token *tok, const std::string &what, const bool show_size_info, const MathLib::bigint &supplied_size, const MathLib::bigint &actual_size);
|
||||
void sizeArgumentAsCharError(const Token *tok);
|
||||
void terminateStrncpyError(const Token *tok, const std::string &varname);
|
||||
void bufferNotZeroTerminatedError(const Token *tok, const std::string &varname, const std::string &function);
|
||||
void negativeIndexError(const Token *tok, MathLib::bigint index);
|
||||
void negativeIndexError(const Token *tok, const ValueFlow::Value &index);
|
||||
void cmdLineArgsError(const Token *tok);
|
||||
void pointerOutOfBoundsError(const Token *tok, const Token *index=nullptr, const MathLib::bigint indexvalue=0);
|
||||
void arrayIndexThenCheckError(const Token *tok, const std::string &indexName);
|
||||
void possibleBufferOverrunError(const Token *tok, const std::string &src, const std::string &dst, bool cat);
|
||||
void argumentSizeError(const Token *tok, const std::string &functionName, const std::string &varname);
|
||||
|
||||
void valueFlowCheckArrayIndex(const Token * const tok, const ArrayInfo &arrayInfo);
|
||||
|
||||
public:
|
||||
void getErrorMessages(ErrorLogger *errorLogger, const Settings *settings) const OVERRIDE {
|
||||
CheckBufferOverrun c(nullptr, settings, errorLogger);
|
||||
const std::vector<MathLib::bigint> indexes(2, 1);
|
||||
c.arrayIndexOutOfBoundsError(nullptr, ArrayInfo(0, "array", 1, 2), indexes);
|
||||
c.bufferOverrunError(nullptr, std::string("buffer"));
|
||||
c.strncatUsageError(nullptr);
|
||||
c.outOfBoundsError(nullptr, "index", true, 2, 1);
|
||||
c.sizeArgumentAsCharError(nullptr);
|
||||
c.terminateStrncpyError(nullptr, "buffer");
|
||||
c.bufferNotZeroTerminatedError(nullptr, "buffer", "strncpy");
|
||||
c.negativeIndexError(nullptr, -1);
|
||||
c.cmdLineArgsError(nullptr);
|
||||
c.pointerOutOfBoundsError(nullptr, nullptr, 0);
|
||||
c.arrayIndexThenCheckError(nullptr, "index");
|
||||
c.possibleBufferOverrunError(nullptr, "source", "destination", false);
|
||||
c.argumentSizeError(nullptr, "function", "array");
|
||||
c.negativeMemoryAllocationSizeError(nullptr);
|
||||
c.negativeArraySizeError(nullptr);
|
||||
c.reportError(nullptr, Severity::warning, "arrayIndexOutOfBoundsCond", "Array 'x[10]' accessed at index 20, which is out of bounds. Otherwise condition 'y==20' is redundant.", CWE119, false);
|
||||
c.arrayIndexError(nullptr, nullptr, nullptr);
|
||||
c.negativeIndexError(nullptr, nullptr, nullptr);
|
||||
}
|
||||
|
||||
private:
|
||||
|
||||
void arrayIndex();
|
||||
void arrayIndexError(const Token *tok, const Variable *var, const ValueFlow::Value *index);
|
||||
void negativeIndexError(const Token *tok, const Variable *var, const ValueFlow::Value *negativeValue);
|
||||
|
||||
void bufferOverflow();
|
||||
void bufferOverflowError(const Token *tok);
|
||||
|
||||
size_t getBufferSize(const Token *bufTok) const;
|
||||
|
||||
static std::string myName() {
|
||||
return "Bounds checking";
|
||||
}
|
||||
|
||||
std::string classInfo() const OVERRIDE {
|
||||
return "Out of bounds checking:\n"
|
||||
"- Array index out of bounds detection by value flow analysis\n"
|
||||
"- Dangerous usage of strncat()\n"
|
||||
"- char constant passed as size to function like memset()\n"
|
||||
"- strncpy() leaving string unterminated\n"
|
||||
"- Accessing array with negative index\n"
|
||||
"- Unsafe usage of main(argv, argc) arguments\n"
|
||||
"- Accessing array with index variable before checking its value\n"
|
||||
"- Check for large enough arrays being passed to functions\n"
|
||||
"- Allocating memory with a negative size\n";
|
||||
"- Array index out of bounds\n"
|
||||
"- Buffer overflow\n"
|
||||
"- Dangerous usage of strncat()\n";
|
||||
}
|
||||
};
|
||||
/// @}
|
||||
|
|
|
|||
|
|
@ -648,13 +648,13 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co
|
|||
|
||||
ArgumentChecks::MinSize::Type type;
|
||||
if (strcmp(typeattr,"strlen")==0)
|
||||
type = ArgumentChecks::MinSize::STRLEN;
|
||||
type = ArgumentChecks::MinSize::Type::STRLEN;
|
||||
else if (strcmp(typeattr,"argvalue")==0)
|
||||
type = ArgumentChecks::MinSize::ARGVALUE;
|
||||
type = ArgumentChecks::MinSize::Type::ARGVALUE;
|
||||
else if (strcmp(typeattr,"sizeof")==0)
|
||||
type = ArgumentChecks::MinSize::SIZEOF;
|
||||
type = ArgumentChecks::MinSize::Type::SIZEOF;
|
||||
else if (strcmp(typeattr,"mul")==0)
|
||||
type = ArgumentChecks::MinSize::MUL;
|
||||
type = ArgumentChecks::MinSize::Type::MUL;
|
||||
else
|
||||
return Error(BAD_ATTRIBUTE_VALUE, typeattr);
|
||||
|
||||
|
|
@ -664,9 +664,9 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co
|
|||
if (strlen(argattr) != 1 || argattr[0]<'0' || argattr[0]>'9')
|
||||
return Error(BAD_ATTRIBUTE_VALUE, argattr);
|
||||
|
||||
ac.minsizes.reserve(type == ArgumentChecks::MinSize::MUL ? 2 : 1);
|
||||
ac.minsizes.reserve(type == ArgumentChecks::MinSize::Type::MUL ? 2 : 1);
|
||||
ac.minsizes.emplace_back(type,argattr[0]-'0');
|
||||
if (type == ArgumentChecks::MinSize::MUL) {
|
||||
if (type == ArgumentChecks::MinSize::Type::MUL) {
|
||||
const char *arg2attr = argnode->Attribute("arg2");
|
||||
if (!arg2attr)
|
||||
return Error(MISSING_ATTRIBUTE, "arg2");
|
||||
|
|
@ -1118,9 +1118,11 @@ int Library::returnValueContainer(const Token *ftok) const
|
|||
return it != mReturnValueContainer.end() ? it->second : -1;
|
||||
}
|
||||
|
||||
bool Library::hasminsize(const std::string &functionName) const
|
||||
bool Library::hasminsize(const Token *ftok) const
|
||||
{
|
||||
const std::map<std::string, Function>::const_iterator it1 = functions.find(functionName);
|
||||
if (isNotLibraryFunction(ftok))
|
||||
return false;
|
||||
const std::map<std::string, Function>::const_iterator it1 = functions.find(getFunctionName(ftok));
|
||||
if (it1 == functions.cend())
|
||||
return false;
|
||||
for (std::map<int, ArgumentChecks>::const_iterator it2 = it1->second.argumentChecks.cbegin(); it2 != it1->second.argumentChecks.cend(); ++it2) {
|
||||
|
|
|
|||
|
|
@ -322,7 +322,7 @@ public:
|
|||
return arg && arg->iteratorInfo.it ? &arg->iteratorInfo : nullptr;
|
||||
}
|
||||
|
||||
bool hasminsize(const std::string &functionName) const;
|
||||
bool hasminsize(const Token *ftok) const;
|
||||
|
||||
const std::vector<ArgumentChecks::MinSize> *argminsizes(const Token *ftok, int argnr) const {
|
||||
const ArgumentChecks *arg = getarg(ftok, argnr);
|
||||
|
|
|
|||
|
|
@ -90,9 +90,10 @@ private:
|
|||
TEST_CASE(array_index_1);
|
||||
TEST_CASE(array_index_2);
|
||||
TEST_CASE(array_index_3);
|
||||
// TODO string TEST_CASE(array_index_4);
|
||||
TEST_CASE(array_index_6);
|
||||
TEST_CASE(array_index_7);
|
||||
TEST_CASE(array_index_9);
|
||||
// TODO CTU TEST_CASE(array_index_9);
|
||||
TEST_CASE(array_index_11);
|
||||
TEST_CASE(array_index_12);
|
||||
TEST_CASE(array_index_13);
|
||||
|
|
@ -116,7 +117,7 @@ private:
|
|||
TEST_CASE(array_index_31); // ticket #2120 - out of bounds in subfunction when type is unknown
|
||||
TEST_CASE(array_index_32);
|
||||
TEST_CASE(array_index_33); // ticket #3044
|
||||
TEST_CASE(array_index_34); // ticket #3063
|
||||
// TODO multidim TEST_CASE(array_index_34); // ticket #3063
|
||||
TEST_CASE(array_index_35); // ticket #2889
|
||||
TEST_CASE(array_index_36); // ticket #2960
|
||||
TEST_CASE(array_index_37);
|
||||
|
|
@ -124,13 +125,13 @@ private:
|
|||
TEST_CASE(array_index_39);
|
||||
TEST_CASE(array_index_40); // loop variable calculation, taking address
|
||||
TEST_CASE(array_index_41); // structs with the same name
|
||||
TEST_CASE(array_index_42);
|
||||
// TODO malloc TEST_CASE(array_index_42);
|
||||
TEST_CASE(array_index_43); // struct with array
|
||||
TEST_CASE(array_index_44); // #3979
|
||||
TEST_CASE(array_index_45); // #4207 - calling function with variable number of parameters (...)
|
||||
TEST_CASE(array_index_46); // #4840 - two-statement for loop
|
||||
TEST_CASE(array_index_47); // #5849
|
||||
TEST_CASE(array_index_multidim);
|
||||
// TODO multidim TEST_CASE(array_index_multidim);
|
||||
TEST_CASE(array_index_switch_in_for);
|
||||
TEST_CASE(array_index_for_in_for); // FP: #2634
|
||||
TEST_CASE(array_index_calculation);
|
||||
|
|
@ -148,7 +149,7 @@ private:
|
|||
TEST_CASE(array_index_vla_for); // #3221: access VLA inside for
|
||||
TEST_CASE(array_index_extern); // FP when using 'extern'. #1684
|
||||
TEST_CASE(array_index_cast); // FP after cast. #2841
|
||||
TEST_CASE(array_index_string_literal);
|
||||
// TODO string pointer TEST_CASE(array_index_string_literal);
|
||||
TEST_CASE(array_index_same_struct_and_var_name); // #4751 - not handled well when struct name and var name is same
|
||||
TEST_CASE(array_index_valueflow);
|
||||
TEST_CASE(array_index_valueflow_pointer);
|
||||
|
|
@ -159,7 +160,7 @@ private:
|
|||
TEST_CASE(buffer_overrun_3);
|
||||
TEST_CASE(buffer_overrun_4);
|
||||
TEST_CASE(buffer_overrun_5);
|
||||
TEST_CASE(buffer_overrun_6);
|
||||
// TODO strcat TEST_CASE(buffer_overrun_6);
|
||||
TEST_CASE(buffer_overrun_7);
|
||||
TEST_CASE(buffer_overrun_8);
|
||||
TEST_CASE(buffer_overrun_9);
|
||||
|
|
@ -173,12 +174,11 @@ private:
|
|||
TEST_CASE(buffer_overrun_24); // index variable is changed in for-loop
|
||||
TEST_CASE(buffer_overrun_26); // #4432 (segmentation fault)
|
||||
TEST_CASE(buffer_overrun_27); // #4444 (segmentation fault)
|
||||
TEST_CASE(buffer_overrun_28); // Out of bound char array access
|
||||
TEST_CASE(buffer_overrun_29); // #7083: false positive: typedef and initialization with strings
|
||||
TEST_CASE(buffer_overrun_30); // #6367
|
||||
TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch
|
||||
TEST_CASE(buffer_overrun_function_array_argument);
|
||||
TEST_CASE(possible_buffer_overrun_1); // #3035
|
||||
// TODO CTU TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch
|
||||
// TODO TEST_CASE(buffer_overrun_function_array_argument);
|
||||
// TODO alloca TEST_CASE(possible_buffer_overrun_1); // #3035
|
||||
TEST_CASE(buffer_overrun_readSizeFromCfg);
|
||||
|
||||
TEST_CASE(valueflow_string); // using ValueFlow string values in checking
|
||||
|
|
@ -188,41 +188,41 @@ private:
|
|||
// char a[10];
|
||||
// char *p1 = a + 10; // OK
|
||||
// char *p2 = a + 11 // UB
|
||||
TEST_CASE(pointer_out_of_bounds_1);
|
||||
TEST_CASE(pointer_out_of_bounds_2);
|
||||
TEST_CASE(pointer_out_of_bounds_3);
|
||||
TEST_CASE(pointer_out_of_bounds_sub);
|
||||
// TODO TEST_CASE(pointer_out_of_bounds_1);
|
||||
// TODO TEST_CASE(pointer_out_of_bounds_2);
|
||||
// TODO TEST_CASE(pointer_out_of_bounds_3);
|
||||
// TODO TEST_CASE(pointer_out_of_bounds_sub);
|
||||
|
||||
TEST_CASE(strncat1);
|
||||
TEST_CASE(strncat2);
|
||||
TEST_CASE(strncat3);
|
||||
// TODO TEST_CASE(strncat1);
|
||||
// TODO TEST_CASE(strncat2);
|
||||
// TODO TEST_CASE(strncat3);
|
||||
|
||||
TEST_CASE(strcat1);
|
||||
TEST_CASE(strcat2);
|
||||
TEST_CASE(strcat3);
|
||||
// TODO TEST_CASE(strcat1);
|
||||
// TODO TEST_CASE(strcat2);
|
||||
// TODO TEST_CASE(strcat3);
|
||||
|
||||
TEST_CASE(varid1);
|
||||
TEST_CASE(varid2); // ticket #4764
|
||||
|
||||
TEST_CASE(assign1);
|
||||
|
||||
TEST_CASE(alloc_new); // Buffer allocated with new
|
||||
TEST_CASE(alloc_malloc); // Buffer allocated with malloc
|
||||
TEST_CASE(alloc_string); // statically allocated buffer
|
||||
TEST_CASE(alloc_alloca); // Buffer allocated with alloca
|
||||
// TODO TEST_CASE(alloc_new); // Buffer allocated with new
|
||||
// TODO TEST_CASE(alloc_malloc); // Buffer allocated with malloc
|
||||
// TODO TEST_CASE(alloc_string); // statically allocated buffer
|
||||
// TODO TEST_CASE(alloc_alloca); // Buffer allocated with alloca
|
||||
|
||||
TEST_CASE(countSprintfLength);
|
||||
// TODO TEST_CASE(countSprintfLength);
|
||||
TEST_CASE(minsize_argvalue);
|
||||
TEST_CASE(minsize_sizeof);
|
||||
TEST_CASE(minsize_strlen);
|
||||
TEST_CASE(minsize_mul);
|
||||
TEST_CASE(unknownType);
|
||||
|
||||
TEST_CASE(terminateStrncpy1);
|
||||
TEST_CASE(terminateStrncpy2);
|
||||
TEST_CASE(terminateStrncpy3);
|
||||
TEST_CASE(terminateStrncpy4);
|
||||
TEST_CASE(recursive_long_time);
|
||||
// TODO strncpy TEST_CASE(terminateStrncpy1);
|
||||
// TODO strncpy TEST_CASE(terminateStrncpy2);
|
||||
// TODO strncpy TEST_CASE(terminateStrncpy3);
|
||||
// TODO strncpy TEST_CASE(terminateStrncpy4);
|
||||
// TODO strncpy TEST_CASE(recursive_long_time);
|
||||
|
||||
TEST_CASE(crash1); // Ticket #1587 - crash
|
||||
TEST_CASE(crash2); // Ticket #3034 - crash
|
||||
|
|
@ -231,25 +231,19 @@ private:
|
|||
TEST_CASE(crash5); // Ticket #8644 - crash
|
||||
TEST_CASE(crash6); // Ticket #9024 - crash
|
||||
|
||||
TEST_CASE(executionPaths1);
|
||||
TEST_CASE(executionPaths2);
|
||||
TEST_CASE(executionPaths3); // no FP for function parameter
|
||||
TEST_CASE(executionPaths5); // Ticket #2920 - False positive when size is unknown
|
||||
TEST_CASE(executionPaths6); // unknown types
|
||||
|
||||
TEST_CASE(insecureCmdLineArgs);
|
||||
TEST_CASE(checkBufferAllocatedWithStrlen);
|
||||
// TODO TEST_CASE(insecureCmdLineArgs);
|
||||
// TODO TEST_CASE(checkBufferAllocatedWithStrlen);
|
||||
|
||||
TEST_CASE(scope); // handling different scopes
|
||||
|
||||
TEST_CASE(getErrorMessages);
|
||||
|
||||
// Access array and then check if the used index is within bounds
|
||||
TEST_CASE(arrayIndexThenCheck);
|
||||
// TODO TEST_CASE(arrayIndexThenCheck);
|
||||
|
||||
TEST_CASE(bufferNotZeroTerminated);
|
||||
// TODO TEST_CASE(bufferNotZeroTerminated);
|
||||
|
||||
TEST_CASE(negativeMemoryAllocationSizeError) // #389
|
||||
// TODO TEST_CASE(negativeMemoryAllocationSizeError) // #389
|
||||
TEST_CASE(negativeArraySize);
|
||||
}
|
||||
|
||||
|
|
@ -360,6 +354,10 @@ private:
|
|||
" return y;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("int x[5];\n"
|
||||
"int a = x[10];\n");
|
||||
ASSERT_EQUALS("[test.cpp:2]: (error) Array 'x[5]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -373,6 +371,16 @@ private:
|
|||
TODO_ASSERT_EQUALS("[test.cpp:4]: (error) Array 'str[16]' accessed at index 16, which is out of bounds.\n", "", errout.str());
|
||||
}
|
||||
|
||||
void array_index_4() {
|
||||
check("char c = \"abc\"[4];");
|
||||
ASSERT_EQUALS("[test.cpp:1]: (error) Array index out of bounds: \"abc\"\n", errout.str());
|
||||
|
||||
check("p = &\"abc\"[4];");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("char c = \"\\0abc\"[2];");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void array_index_3() {
|
||||
check("void f()\n"
|
||||
|
|
@ -477,8 +485,7 @@ private:
|
|||
" struct ABC* x = malloc(sizeof(struct ABC) + 10);\n"
|
||||
" x->str[1] = 0;"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:10]: (error) Array 'x->str[1]' accessed at index 1, which is out of bounds.\n"
|
||||
"[test.cpp:10]: (error) Array 'x.str[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
TODO_ASSERT_EQUALS("error", "", errout.str());
|
||||
|
||||
// This is not out of bounds because it is a variable length array
|
||||
// and the index is within the memory allocated.
|
||||
|
|
@ -561,7 +568,7 @@ private:
|
|||
" struct ABC x;\n"
|
||||
" x.str[1] = 0;"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:9]: (error) Array 'x.str[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
TODO_ASSERT_EQUALS("[test.cpp:9]: (error) Array 'x.str[1]' accessed at index 1, which is out of bounds.\n", "", errout.str());
|
||||
|
||||
check("struct foo\n"
|
||||
"{\n"
|
||||
|
|
@ -600,11 +607,11 @@ private:
|
|||
"{\n"
|
||||
" abc->str[10] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Array 'abc->str[10]' accessed at index 10, which is out of bounds.\n"
|
||||
"[test.cpp:8]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Array 'abc->str[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_9() {
|
||||
// Cross translation unit analysis
|
||||
check("static void memclr( char *data )\n"
|
||||
"{\n"
|
||||
" data[10] = 0;\n"
|
||||
|
|
@ -688,8 +695,7 @@ private:
|
|||
" abc->str[10] = 0;\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:13]: (error) Array 'abc->str[10]' accessed at index 10, which is out of bounds.\n"
|
||||
"[test.cpp:13]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:13]: (error) Array 'abc->str[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_12() {
|
||||
|
|
@ -931,7 +937,7 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[" + charMaxPlusOne.str() + "] = 0;\n" // 128/256 > CHAR_MAX
|
||||
"}\n").c_str());
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a["+charMaxPlusOne.str()+"]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a["+charMaxPlusOne.str()+"]' accessed at index "+charMaxPlusOne.str()+", which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(signed char n) {\n"
|
||||
|
|
@ -939,7 +945,7 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[128] = 0;\n" // 128 > SCHAR_MAX
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[128]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a[128]' accessed at index 128, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(unsigned char n) {\n"
|
||||
|
|
@ -947,7 +953,7 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[256] = 0;\n" // 256 > UCHAR_MAX
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[256]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a[256]' accessed at index 256, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(short n) {\n"
|
||||
|
|
@ -955,7 +961,7 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[32768] = 0;\n" // 32768 > SHRT_MAX
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[32768]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a[32768]' accessed at index 32768, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(unsigned short n) {\n"
|
||||
|
|
@ -963,7 +969,7 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[65536] = 0;\n" // 65536 > USHRT_MAX
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[65536]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a[65536]' accessed at index 65536, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(signed short n) {\n"
|
||||
|
|
@ -971,26 +977,26 @@ private:
|
|||
" a[-1] = 0;\n" // negative index
|
||||
" a[32768] = 0;\n" // 32768 > SHRT_MAX
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n"
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[32768]' accessed at index -1, which is out of bounds.\n"
|
||||
"[test.cpp:4]: (error) Array 'a[32768]' accessed at index 32768, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(int n) {\n"
|
||||
" int a[n];\n" // n <= INT_MAX
|
||||
" a[-1] = 0;\n" // negative index
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[2147483648]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(unsigned int n) {\n"
|
||||
" int a[n];\n" // n <= UINT_MAX
|
||||
" a[-1] = 0;\n" // negative index
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[4294967296]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(signed int n) {\n"
|
||||
" int a[n];\n" // n <= INT_MAX
|
||||
" a[-1] = 0;\n" // negative index
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[2147483648]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_25() { // #1536
|
||||
|
|
@ -1026,7 +1032,7 @@ private:
|
|||
" for (int i = 0; i < 10; i++)\n"
|
||||
" a[i-1] = a[i];\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_28() {
|
||||
|
|
@ -1089,7 +1095,7 @@ private:
|
|||
" struct s1 obj;\n"
|
||||
" x(obj.delay, 123);\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:11] -> [test.cpp:6]: (error) Array 'obj.delay[3]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
// TODO CTU ASSERT_EQUALS("[test.cpp:11] -> [test.cpp:6]: (error) Array 'obj.delay[3]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("struct s1 {\n"
|
||||
" float a[0];\n"
|
||||
|
|
@ -1112,7 +1118,7 @@ private:
|
|||
" }\n"
|
||||
" int m_x[1];\n"
|
||||
"};");
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'm_x[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
// TODO [1] ASSERT_EQUALS("[test.cpp:7]: (error) Array 'm_x[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_33() {
|
||||
|
|
@ -1185,14 +1191,14 @@ private:
|
|||
" struct Struct { unsigned m_Var[1]; } s;\n"
|
||||
" s.m_Var[1] = 1;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 's.m_Var[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:3]: (error) Array 's.m_Var[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("struct Struct { unsigned m_Var[1]; };\n"
|
||||
"void f() {\n"
|
||||
" struct Struct s;\n"
|
||||
" s.m_Var[1] = 1;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 's.m_Var[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:4]: (error) Array 's.m_Var[1]' accessed at index 1, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("struct Struct { unsigned m_Var[1]; };\n"
|
||||
"void f() {\n"
|
||||
|
|
@ -1354,8 +1360,7 @@ private:
|
|||
" y = var[ 0 ].arr[ 3 ];\n" // <-- array access out of bounds
|
||||
" return y;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:10]: (error) Array 'var[0].arr[3]' accessed at index 3, which is out of bounds.\n"
|
||||
"[test.cpp:10]: (error) Array 'var.arr[3]' accessed at index 3, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:10]: (error) Array 'var[0].arr[3]' accessed at index 3, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("int f( )\n"
|
||||
"{\n"
|
||||
|
|
@ -1399,8 +1404,7 @@ private:
|
|||
"var[0].var[ 2 ] = 2;\n"
|
||||
"var[0].var[ 4 ] = 4;\n" // <-- array access out of bounds
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:9]: (error) Array 'var[0].var[3]' accessed at index 4, which is out of bounds.\n"
|
||||
"[test.cpp:9]: (error) Array 'var.var[3]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:9]: (error) Array 'var[0].var[3]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f( ) {\n"
|
||||
"struct S{\n"
|
||||
|
|
@ -1436,7 +1440,7 @@ private:
|
|||
" int * p = &ab[10].a[0]; \n"
|
||||
" return 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 'ab[1]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:4]: (error) Array 'ab[1]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_44() { // #3979 (false positive)
|
||||
|
|
@ -1744,14 +1748,14 @@ private:
|
|||
" char data[8];\n"
|
||||
" data[-1] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 'data[8]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f()\n"
|
||||
"{\n"
|
||||
" char data[8][4];\n"
|
||||
" data[5][-1] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
// TODO multidim ASSERT_EQUALS("[test.cpp:4]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
|
||||
// #1614 - negative index is ok for pointers
|
||||
check("void foo(char *p)\n"
|
||||
|
|
@ -1827,8 +1831,8 @@ private:
|
|||
" val[i+1] = val[i];\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array index -9994 is out of bounds.\n"
|
||||
"[test.cpp:5]: (error) Array index -9995 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'val[5]' accessed at index -9994, which is out of bounds.\n"
|
||||
"[test.cpp:5]: (error) Array 'val[5]' accessed at index -9995, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -1907,7 +1911,7 @@ private:
|
|||
" a[i - 1] = 0;\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'a[2]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_for() {
|
||||
|
|
@ -1981,7 +1985,7 @@ private:
|
|||
" a[i-1] = 0;\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array index -1 is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index -1, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_for_varid0() { // #4228: No varid for counter variable
|
||||
|
|
@ -2031,7 +2035,7 @@ private:
|
|||
" char x[2];\n"
|
||||
" f1(x);\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:6] -> [test.cpp:2]: (error) Array 'x[2]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
// TODO CTU ASSERT_EQUALS("[test.cpp:6] -> [test.cpp:2]: (error) Array 'x[2]' accessed at index 4, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_string_literal() {
|
||||
|
|
@ -2097,8 +2101,7 @@ private:
|
|||
" struct tt *tt=x;\n"
|
||||
" tt->name[22] = 123;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'tt->name[21]' accessed at index 22, which is out of bounds.\n"
|
||||
"[test.cpp:7]: (error) Array 'tt.name[21]' accessed at index 22, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'tt->name[21]' accessed at index 22, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void array_index_valueflow() {
|
||||
|
|
@ -2107,7 +2110,7 @@ private:
|
|||
" str[i] = 0;\n"
|
||||
" if (i==10) {}\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (warning) Either the condition 'i==10' is redundant or the array 'str[3]' is accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:3]: (warning) Either the condition 'i==10' is redundant or the array 'str[3]' is accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(int i) {\n"
|
||||
" char str[3];\n"
|
||||
|
|
@ -2116,7 +2119,7 @@ private:
|
|||
" case 10: break;\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:5]: (warning) Either the switch case 'case 10' is redundant or the array 'str[3]' is accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:3]: (warning) Either the switch case 'case 10' is redundant or the array 'str[3]' is accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f() {\n"
|
||||
" char str[3];\n"
|
||||
|
|
@ -2146,7 +2149,7 @@ private:
|
|||
" int *p = a;\n"
|
||||
" p[20] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (error) Array 'a[10]' accessed at index 20, which is out of bounds.\n", errout.str());
|
||||
// TODO pointer ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (error) Array 'a[10]' accessed at index 20, which is out of bounds.\n", errout.str());
|
||||
|
||||
{
|
||||
// address of
|
||||
|
|
@ -2155,7 +2158,7 @@ private:
|
|||
" int *p = a;\n"
|
||||
" p[10] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (error) Array 'a[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
// TODO pointer ASSERT_EQUALS("[test.cpp:3] -> [test.cpp:4]: (error) Array 'a[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f() {\n"
|
||||
" int a[10];\n"
|
||||
|
|
@ -2190,7 +2193,7 @@ private:
|
|||
" a += 4;\n"
|
||||
" a[-1] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
// TODO ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void array_index_enum_array() { // #8439
|
||||
|
|
@ -2212,7 +2215,7 @@ private:
|
|||
"{\n"
|
||||
" strcpy( abc->str, \"abcdef\" );\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Buffer is accessed out of bounds: abc.str\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Buffer is accessed out of bounds: abc->str\n", errout.str());
|
||||
|
||||
check("struct ABC\n"
|
||||
"{\n"
|
||||
|
|
@ -2257,7 +2260,7 @@ private:
|
|||
" strcpy( abc->str, \"abcdef\" );\n"
|
||||
" free(abc);\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Buffer is accessed out of bounds: abc.str\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:8]: (error) Buffer is accessed out of bounds: abc->str\n", errout.str());
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -2543,18 +2546,6 @@ private:
|
|||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void buffer_overrun_28() {
|
||||
check("char c = \"abc\"[4];");
|
||||
ASSERT_EQUALS("[test.cpp:1]: (error) Buffer is accessed out of bounds: \"abc\"\n", errout.str());
|
||||
|
||||
check("p = &\"abc\"[4];");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("char c = \"\\0abc\"[2];");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
|
||||
// #7083: false positive: typedef and initialization with strings
|
||||
void buffer_overrun_29() {
|
||||
check("typedef char testChar[10]; \n"
|
||||
|
|
@ -2574,9 +2565,7 @@ private:
|
|||
" return s->m[sizeof(s->m)];\n"
|
||||
"}\n"
|
||||
);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 's->m[9]' accessed at index 36, which is out of bounds.\n"
|
||||
"[test.cpp:3]: (error) Array 's.m[9]' accessed at index 36, which is out of bounds.\n",
|
||||
errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Array 's->m[9]' accessed at index 36, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -2778,7 +2767,7 @@ private:
|
|||
" if (cond) x = \"abcde\";\n"
|
||||
" return x[20];\n" // <- array index out of bounds when x is "abcde"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 'x[6]' accessed at index 20, which is out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:4]: (error) Array 'x[6]' accessed at index 20, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void pointer_out_of_bounds_1() {
|
||||
|
|
@ -2987,8 +2976,7 @@ private:
|
|||
" Fred *f; f = new Fred;\n"
|
||||
" return f->c[10];\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'f->c[10]' accessed at index 10, which is out of bounds.\n"
|
||||
"[test.cpp:5]: (error) Array 'f.c[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
ASSERT_EQUALS("[test.cpp:5]: (error) Array 'f->c[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("static const size_t MAX_SIZE = UNAVAILABLE_TO_CPPCHECK;\n"
|
||||
"struct Thing { char data[MAX_SIZE]; };\n"
|
||||
|
|
@ -3154,7 +3142,7 @@ private:
|
|||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 's[10]' accessed at index 10, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
/*
|
||||
void countSprintfLength() const {
|
||||
std::list<const Token*> unknownParameter(1, nullptr);
|
||||
|
||||
|
|
@ -3225,7 +3213,7 @@ private:
|
|||
ASSERT_EQUALS(15, CheckBufferOverrun::countSprintfLength("str%s%d%d", multipleParams));
|
||||
ASSERT_EQUALS(26, CheckBufferOverrun::countSprintfLength("str%-6s%08ld%08ld", multipleParams));
|
||||
}
|
||||
|
||||
*/
|
||||
void minsize_argvalue() {
|
||||
Settings settings;
|
||||
const char xmldata[] = "<?xml version=\"1.0\"?>\n"
|
||||
|
|
@ -3269,14 +3257,14 @@ private:
|
|||
" char s[10];\n"
|
||||
" mymemset(s, 0, '*');\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (warning) The size argument is given as a char constant.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:3]: (warning) The size argument is given as a char constant.\n", errout.str());
|
||||
|
||||
// ticket #836
|
||||
check("void f(void) {\n"
|
||||
" char a[10];\n"
|
||||
" mymemset(a+5, 0, 10);\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds: a\n", errout.str());
|
||||
TODO_ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds: a\n", "", errout.str());
|
||||
|
||||
// Ticket #909
|
||||
check("void f(void) {\n"
|
||||
|
|
@ -3304,7 +3292,7 @@ private:
|
|||
" char b[5][6];\n"
|
||||
" mymemset(b, 0, 5 * 6);\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
// TODO ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("int main() {\n"
|
||||
" char b[5][6];\n"
|
||||
|
|
@ -3325,7 +3313,7 @@ private:
|
|||
check("void f() {\n"
|
||||
" mymemset(\"abc\", 0, 20);\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
|
||||
check("void f() {\n"
|
||||
" mymemset(temp, \"abc\", 4);\n"
|
||||
|
|
@ -3333,10 +3321,10 @@ private:
|
|||
ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("void f() {\n" // #6816 - fp when array has known string value
|
||||
" const char c[10] = \"c\";\n"
|
||||
" char c[10] = \"c\";\n"
|
||||
" mymemset(c, 0, 10);\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
// TODO ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void minsize_sizeof() {
|
||||
|
|
@ -3346,7 +3334,7 @@ private:
|
|||
" <function name=\"mystrncpy\">\n"
|
||||
" <noreturn>false</noreturn>\n"
|
||||
" <arg nr=\"1\">\n"
|
||||
" <minsize type=\"sizeof\" arg=\"2\"/>\n"
|
||||
" <minsize type=\"strlen\" arg=\"2\"/>\n"
|
||||
" <minsize type=\"argvalue\" arg=\"3\"/>\n"
|
||||
" </arg>\n"
|
||||
" <arg nr=\"2\"/>\n"
|
||||
|
|
@ -3392,7 +3380,7 @@ private:
|
|||
" char buf[5];\n"
|
||||
" a(buf);"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:1]: (error) Buffer is accessed out of bounds: buf\n", errout.str());
|
||||
// TODO CTU ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:1]: (error) Buffer is accessed out of bounds: buf\n", errout.str());
|
||||
}
|
||||
|
||||
void minsize_strlen() {
|
||||
|
|
@ -3445,7 +3433,7 @@ private:
|
|||
" char *str = new char[5];\n"
|
||||
" mysprintf(str, \"abcde\");\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(int condition) {\n"
|
||||
" char str[5];\n"
|
||||
|
|
@ -3464,20 +3452,20 @@ private:
|
|||
" struct Foo x;\n"
|
||||
" mysprintf(x.a, \"aa\");\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Buffer is accessed out of bounds: x.a\n", errout.str());
|
||||
TODO_ASSERT_EQUALS("[test.cpp:4]: (error) Buffer is accessed out of bounds: x.a\n", "", errout.str());
|
||||
|
||||
// ticket #900
|
||||
check("void f() {\n"
|
||||
" char *a = new char(30);\n"
|
||||
" mysprintf(a, \"a\");\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(char value) {\n"
|
||||
" char *a = new char(value);\n"
|
||||
" mysprintf(a, \"a\");\n"
|
||||
"}", settings);
|
||||
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
// TODO ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds.\n", errout.str());
|
||||
|
||||
// This is out of bounds if 'sizeof(ABC)' is 1 (No padding)
|
||||
check("struct Foo { char a[1]; };\n"
|
||||
|
|
@ -3485,7 +3473,7 @@ private:
|
|||
" struct Foo *x = malloc(sizeof(Foo));\n"
|
||||
" mysprintf(x.a, \"aa\");\n"
|
||||
"}", settings);
|
||||
TODO_ASSERT_EQUALS("error", "", errout.str());
|
||||
// TODO ASSERT_EQUALS("", errout.str());
|
||||
|
||||
check("struct Foo { char a[1]; };\n"
|
||||
"void f() {\n"
|
||||
|
|
@ -3710,76 +3698,6 @@ private:
|
|||
"}");
|
||||
}
|
||||
|
||||
void executionPaths1() {
|
||||
check("void f(int a)\n"
|
||||
"{\n"
|
||||
" int buf[10];\n"
|
||||
" int i = 5;\n"
|
||||
" if (a == 1)\n"
|
||||
" i = 1000;\n"
|
||||
" buf[i] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'buf[10]' accessed at index 1000, which is out of bounds.\n", errout.str());
|
||||
|
||||
check("void f(int a)\n"
|
||||
"{\n"
|
||||
" int buf[10][5];\n"
|
||||
" int i = 5;\n"
|
||||
" if (a == 1)\n"
|
||||
" i = 1000;\n"
|
||||
" buf[i][0] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("[test.cpp:7]: (error) Array 'buf[10][5]' index buf[1000][0] out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void executionPaths2() {
|
||||
check("void foo()\n"
|
||||
"{\n"
|
||||
" char a[64];\n"
|
||||
" int sz = sizeof(a);\n"
|
||||
" bar(&sz);\n"
|
||||
" a[sz] = 0;\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void executionPaths3() {
|
||||
check("void f(char *VLtext)\n"
|
||||
"{\n"
|
||||
" if ( x ) {\n"
|
||||
" return VLtext[0];\n"
|
||||
" } else {\n"
|
||||
" int wordlen = ab();\n"
|
||||
" VLtext[wordlen] = 0;\n"
|
||||
" }\n"
|
||||
"}");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void executionPaths5() {
|
||||
// No false positive
|
||||
check("class A {\n"
|
||||
" void foo() {\n"
|
||||
" int j = g();\n"
|
||||
" arr[j]=0;\n"
|
||||
" }\n"
|
||||
"\n"
|
||||
" int arr[2*BSize + 2];\n"
|
||||
"};");
|
||||
ASSERT_EQUALS("", errout.str());
|
||||
}
|
||||
|
||||
void executionPaths6() { // handling unknown type
|
||||
const char code[] = "void f() {\n"
|
||||
" u32 a[10];"
|
||||
" u32 i = 0;\n"
|
||||
" if (x) { i = 1000; }\n"
|
||||
" a[i] = 0;\n"
|
||||
"}";
|
||||
check(code);
|
||||
ASSERT_EQUALS("[test.cpp:4]: (error) Array 'a[10]' accessed at index 1000, which is out of bounds.\n", errout.str());
|
||||
}
|
||||
|
||||
void insecureCmdLineArgs() {
|
||||
check("int main(int argc, char *argv[])\n"
|
||||
"{\n"
|
||||
|
|
|
|||
Loading…
Reference in New Issue