walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

buffer overruns: added tests and improved the checking

This commit is contained in:
Daniel Marjamäki 2008-08-12 06:39:41 +00:00
parent 0f83b0b9ea
commit a282495c2a
2 changed files with 60 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
CheckBufferOverrun.cpp
View File

@ -292,13 +292,30 @@ static void CheckBufferOverrun_LocalVariable()
else if (tok->str[0]=='}')
indentlevel--;
else if (indentlevel > 0 && Match(tok, "%type% %var% [ %num% ] ;"))
else if (indentlevel > 0)
{
const char *varname[2];
varname[0] = getstr(tok,1);
varname[1] = 0;
unsigned int size = strtoul(getstr(tok,3), NULL, 10);
int total_size = size * SizeOfType(tok->str);
const char *varname[2] = {0};
unsigned int size = 0;
const char *type = 0;
if (Match(tok, "%type% %var% [ %num% ] ;"))
{
varname[0] = getstr(tok,1);
size = strtoul(getstr(tok,3), NULL, 10);
type = tok->str;
}
else if (indentlevel > 0 && Match(tok, "[*;{}] %var% = new %type% [ %num% ]"))
{
varname[0] = getstr(tok,1);
size = strtoul(getstr(tok,6), NULL, 10);
type = getstr(tok, 4);
}
else
{
continue;
}
int total_size = size * SizeOfType(type);
if (total_size == 0)
continue;

37
tests.cpp
View File

@ -208,6 +208,14 @@ static void buffer_overrun()
check( CheckBufferOverrun, __LINE__, code, "[test.cpp:5]: Array index out of bounds\n" );
code = "void f()\n"
"{\n"
" char *str = new char[0x10];\n"
" str[15] = 0;\n"
" str[16] = 0;\n"
"}\n";
check( CheckBufferOverrun, __LINE__, code, "[test.cpp:5]: Array index out of bounds\n" );
code = "void f()\n"
"{\n"
@ -455,6 +463,7 @@ static void memleak_in_function()
// * for/while..
// * mismatching allocation and deallocation
// * garbage collection
// * arrays
// * struct members
// * function calls
@ -610,6 +619,18 @@ static void memleak_in_function()
check( CheckMemoryLeak, __LINE__, code, "" );
/* TODO
code = "void f()\n"
"{\n"
" char *str;\n"
" for (int i = 0; i < 10; ++i)\n"
" str = strdup(\"hello\");\n"
" free(str);\n"
"}\n";
check( CheckMemoryLeak, __LINE__, code, "[test.cpp:5]: Memory leak: str" );
*/
code = "void f()\n"
"{\n"
" for (int i = 0; i < j; i++)\n"
@ -679,6 +700,22 @@ static void memleak_in_function()
////////////////////////////////////////////////
// arrays
////////////////////////////////////////////////
/* TODO
code = "static void f()\n"
"{\n"
" char *str[10];\n"
" str[0] = strdup(\"hello\");\n"
"}\n";
check( CheckMemoryLeak, __LINE__, code, "[test.cpp:3]: Memory leak: str[0]\n" );
*/
////////////////////////////////////////////////
// struct members
////////////////////////////////////////////////