diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index 2dc2a5e21..066117d77 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -1297,6 +1297,10 @@ void CheckBufferOverrun::checkGlobalAndLocalVariable() negativeMemoryAllocationSizeError(tok); } + /** @todo false negatives: this may be too conservative */ + if (!var || !var->isPointer() || var->typeStartToken()->next() != var->typeEndToken()) + continue; + // malloc() gets count of bytes and not count of // elements, so we should calculate count of elements // manually diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index 5694e9d1e..6d9bda351 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -3093,6 +3093,13 @@ private: " tab4[20] = 0;\n" "}"); ASSERT_EQUALS("[test.cpp:4]: (error) Array 'tab4[20]' accessed at index 20, which is out of bounds.\n", errout.str()); + + check("void f() {\n" // #8721 + " unsigned char **cache = malloc(32);\n" + " cache[i] = malloc(65536);\n" + " cache[i][0xFFFF] = 0;\n" + "}"); + ASSERT_EQUALS("", errout.str()); } // statically allocated buffer