diff --git a/CheckBufferOverrun.cpp b/CheckBufferOverrun.cpp index fdfbea7a6..c08fd848f 100644 --- a/CheckBufferOverrun.cpp +++ b/CheckBufferOverrun.cpp @@ -292,13 +292,30 @@ static void CheckBufferOverrun_LocalVariable() else if (tok->str[0]=='}') indentlevel--; - else if (indentlevel > 0 && Match(tok, "%type% %var% [ %num% ] ;")) + else if (indentlevel > 0) { - const char *varname[2]; - varname[0] = getstr(tok,1); - varname[1] = 0; - unsigned int size = strtoul(getstr(tok,3), NULL, 10); - int total_size = size * SizeOfType(tok->str); + const char *varname[2] = {0}; + unsigned int size = 0; + const char *type = 0; + + if (Match(tok, "%type% %var% [ %num% ] ;")) + { + varname[0] = getstr(tok,1); + size = strtoul(getstr(tok,3), NULL, 10); + type = tok->str; + } + else if (indentlevel > 0 && Match(tok, "[*;{}] %var% = new %type% [ %num% ]")) + { + varname[0] = getstr(tok,1); + size = strtoul(getstr(tok,6), NULL, 10); + type = getstr(tok, 4); + } + else + { + continue; + } + + int total_size = size * SizeOfType(type); if (total_size == 0) continue; diff --git a/tests.cpp b/tests.cpp index c5ce819c9..8a3efcbf2 100644 --- a/tests.cpp +++ b/tests.cpp @@ -208,6 +208,14 @@ static void buffer_overrun() check( CheckBufferOverrun, __LINE__, code, "[test.cpp:5]: Array index out of bounds\n" ); + code = "void f()\n" + "{\n" + " char *str = new char[0x10];\n" + " str[15] = 0;\n" + " str[16] = 0;\n" + "}\n"; + check( CheckBufferOverrun, __LINE__, code, "[test.cpp:5]: Array index out of bounds\n" ); + code = "void f()\n" "{\n" @@ -455,6 +463,7 @@ static void memleak_in_function() // * for/while.. // * mismatching allocation and deallocation // * garbage collection + // * arrays // * struct members // * function calls @@ -610,6 +619,18 @@ static void memleak_in_function() check( CheckMemoryLeak, __LINE__, code, "" ); + /* TODO + code = "void f()\n" + "{\n" + " char *str;\n" + " for (int i = 0; i < 10; ++i)\n" + " str = strdup(\"hello\");\n" + " free(str);\n" + "}\n"; + check( CheckMemoryLeak, __LINE__, code, "[test.cpp:5]: Memory leak: str" ); + */ + + code = "void f()\n" "{\n" " for (int i = 0; i < j; i++)\n" @@ -679,6 +700,22 @@ static void memleak_in_function() + //////////////////////////////////////////////// + // arrays + //////////////////////////////////////////////// + + + /* TODO + code = "static void f()\n" + "{\n" + " char *str[10];\n" + " str[0] = strdup(\"hello\");\n" + "}\n"; + check( CheckMemoryLeak, __LINE__, code, "[test.cpp:3]: Memory leak: str[0]\n" ); + */ + + + //////////////////////////////////////////////// // struct members ////////////////////////////////////////////////