walkero
/
cppcheck
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fixed #1850 (An access to a nested std::map via a negative integer key is reported as 'Array index out of bounds')

This commit is contained in:
Daniel Marjamäki 2010-07-14 12:24:07 +02:00
parent 233432a888
commit bea714445a
2 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/checkbufferoverrun.cpp
View File

@ -1596,15 +1596,15 @@ void CheckBufferOverrun::negativeIndex()
const long index = MathLib::toLongNumber(tok->next()->str()); const long index = MathLib::toLongNumber(tok->next()->str());
if (index < 0) if (index < 0)
{ {
// Multidimensional index => error // Negative index. Check if it's an array.
if (Token::simpleMatch(tok->previous(), "]") || Token::simpleMatch(tok->tokAt(3), "[")) const Token *tok2 = tok;
negativeIndexError(tok, index); while (Token::simpleMatch(tok2->previous(), "]"))
tok2 = tok2->previous()->link();
// 1-dimensional array => error if (tok2->previous() && tok2->previous()->varId())
else if (tok->previous() && tok->previous()->varId())
{ {
const Token *tok2 = Token::findmatch(_tokenizer->tokens(), "%varid%", tok->previous()->varId()); const Token *tok3 = Token::findmatch(_tokenizer->tokens(), "%varid%", tok2->previous()->varId());
if (tok2 && Token::Match(tok2->next(), "[ %any% ] ;")) if (tok3 && Token::Match(tok3->next(), "[ %any% ] ;|["))
negativeIndexError(tok, index); negativeIndexError(tok, index);
} }
} }

7
test/testbufferoverrun.cpp
View File

@ -1155,6 +1155,13 @@ private:
" if (p[-1]);\n" " if (p[-1]);\n"
"}\n"); "}\n");
ASSERT_EQUALS("", errout.str()); ASSERT_EQUALS("", errout.str());
// ticket #1850
check("int f(const std::map<int, std::map<int,int> > &m)\n"
"{\n"
" return m[0][-1];\n"
"}\n");
ASSERT_EQUALS("", errout.str());
} }
void array_index_for_decr() void array_index_for_decr()