87daf5783e
buffer overflow: clean up old checking for negative index
2014-03-25 20:37:32 +01:00
c8004a8d31
Buffer overruns: Use ValueFlow to detect negative index
2014-03-25 18:22:22 +01:00
aa05bf0f16
ValueFlow: Improved abstract interpretation
2014-03-24 06:48:06 +01:00
dbc8273cb7
ValueFlow: improved abstract interpretation of for loops
2014-03-24 00:16:02 +01:00
b6276058da
Value Flow: Improved abstract interpretation of arithmetical expressions
2014-03-22 19:02:33 +01:00
49b25b05d9
Fixed crash in CheckBufferOverrun on garbage code ( #5595 )
2014-03-21 13:20:44 +01:00
e240282443
Value Flow: Another try with the abstract interpretation of for loops
2014-03-17 18:43:47 +01:00
8c3f2c2ad9
Revert 894a65b0. abstract interpretation of for loops. there was some crashes and performance problems. I will fix those problems when I have time and recommit.
2014-03-16 08:38:52 +01:00
894a65b0b1
ValueFlow: Refactor the for-loop handling. Use abstract interpretation.
2014-03-15 11:29:33 +01:00
7fa73c0d64
Merge pull request #256 from xypron/5505
...
5505: FP: Array accessed out of bounds
2014-03-09 08:47:18 +01:00
bd67db96f1
5505: FP: Array accessed out of bounds
...
CheckBufferOverrun::checkFunctionParameter alreacy considered usage of a
function parameter inside an if block as a special case.
With the patch the same is done for switch statements.
A test is added.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2014-03-07 19:51:13 +01:00
fd3a8a2a18
Update copyright
2014-02-15 07:45:39 +01:00
6ca7daec10
Fixed #389 : Providing negative value to memory allocation function.
2014-02-01 22:38:29 +01:00
9aa9530e0d
Fixed #5426 (crash: btrfs-progs cmds-inspect.c)
2014-01-31 06:19:36 +01:00
abe8439917
Fixed #5416 (False positive: Array accessed at index, which is out of bounds.)
2014-01-28 16:55:10 +01:00
0dbb86f0cb
Cleanup ExecutionPath from CheckBufferOverrun
2014-01-22 21:25:37 +01:00
b91f42453b
value flow: improved handling of cast
2014-01-20 22:26:55 +01:00
3e23e243f6
BufferOverflow: Updated message for out of bounds array index or redundant condition
2014-01-17 19:44:45 +01:00
18d6285ad2
BufferOverrun: Improved error message when array index is used before checking that its in limits
2014-01-17 18:56:46 +01:00
30cae358d8
Removed the --value-flow flag. ValueFlow analysis will always be enabled from now on.
2014-01-17 18:07:05 +01:00
0b4de97e2b
value flow: Use ValueFlow in CheckBufferOverrun
2014-01-16 19:23:14 +01:00
a1b0d190df
Fixed #3688 (false positive: (inconclusive, posix) (warning) The buffer 'cBuffer' is not zero-terminated after the call to readlink().)
2014-01-02 10:46:19 +01:00
32be4094e7
Symbol database: only put variables in variable list
2013-12-31 17:51:56 +01:00
4f0121ee2f
Splitted simplification out of tokenize()
2013-12-30 17:45:28 +01:00
fe75686595
Ticket #5203 : Don't crash when checking buffer overrun for invalid code.
2013-11-30 07:40:32 +01:00
946722faf0
Fixed #4968 (False positive: Structure with 'read' member is confused with read() function.)
2013-10-05 18:25:44 +02:00
450442287c
Fixed #4974 (CheckBufferOverrun::writeOutsideBufferSize() too strict)
2013-08-25 18:46:07 +02:00
5ce7189bc0
Merge pull request #166 from last5bits/ticket4213
...
Fixing #4213 arrayIndexThenCheck and adding tests
2013-08-23 22:36:30 -07:00
d24a321ba2
Fixing #4213 arrayIndexThenCheck and adding tests
2013-08-23 19:04:01 +04:00
64733d9e63
astyle formatting
2013-08-10 12:32:59 +02:00
ad33d95ec1
Ticket #4764 : properly handle template instantiations with only default parameters.
2013-08-10 12:00:16 +02:00
a9a5dc0354
Updated to AStyle 2.03, require this version
2013-08-07 16:27:37 +02:00
d6be4559cd
Fixed #4840 (false negative: buffer access out of bounds)
2013-06-25 06:37:51 +02:00
a861817a01
Fixed #4751 (CheckBufferOverrun: better handling when struct member instance doesn't have same varid as struct member declaration)
2013-05-28 16:52:23 +02:00
ea60c5b14b
CheckBufferOverrun: Code cleanup
2013-05-05 08:14:19 +02:00
4e65800adf
TestRunner: Updated warning message when there is unsimplified code
2013-04-16 16:54:19 +02:00
393c75af70
Simplified remaining TestBufferOverrun test cases
2013-04-13 15:49:15 +02:00
cbe2cdafcf
Simplify TestBufferOverrun test cases (casts, pointer addition, calculation)
2013-04-13 13:58:21 +02:00
fe911f92e1
Simplify TestBufferOverrun test cases (known variable value)
2013-04-13 13:13:13 +02:00
78d3aef40e
Simplified TestBufferOverrun test cases (sizeof, known variable value)
2013-04-13 11:01:19 +02:00
3b880f9e2e
Simplified TestBufferOverrun test cases (sizeof, known variables, casts, etc)
2013-04-13 08:19:14 +02:00
7871f16e9d
Simplified TestBufferOverrun::readlink test cases (sizeof)
2013-04-13 07:31:15 +02:00
6afdd1b7c0
Simplified TestBufferOverrun::readlinkat test cases (sizeof, known variables)
2013-04-13 07:22:01 +02:00
cdce755471
Removed duplicate unit tests in testbufferoverrun.cpp
2013-04-12 12:17:08 -07:00
c487ea843d
Better fix for #4706 : Use Token::nextArgument() properly. Removed redundant ' in message
2013-04-09 08:30:53 -07:00
ba8cca8fa9
#4706 fix crash when a struct member is used as first argument. Replaced Token::nexArgument with %any% in Token::Match call. Added unittests in testing Token::nexArgument.
2013-04-04 15:12:18 +02:00
54d398c7dd
unittests: removed not needed '\n' at the end of testcases.
2013-03-19 09:18:58 +01:00
ff826d7c62
#4664 : new check: (POSIX) write outside buffer size.
2013-03-19 08:22:48 +01:00
096fa2f771
Fixed #4380
2013-03-14 10:18:48 -07:00
61d9424631
astyle formatting
2013-03-14 11:10:12 +01:00
cd1392749c
Removed not needed '\n' at the end of testcases in testbufferoverrun.cpp. No functional changes.
2013-03-14 09:45:47 +01:00
c8798b2207
#3838 added more testcases.
2013-03-14 09:36:38 +01:00
19c430530f
#3838 added another testcase to avoid a FP.
2013-03-14 09:21:31 +01:00
4b9b87e310
Fixed #4646 (false positive: (style, inconclusive) Technically the member function 'C<T>::operator+=' can be const.)
2013-03-14 06:34:12 +01:00
34b3fe6af0
#1659 added TODO-testcases.
2013-03-13 10:55:20 +01:00
14feaa8d39
Refactorizations:
...
- Fixed lots of cppcheck messages about functions that can be const or static
- Fixed possible nullpointer dereference message in symboldatabase.cpp
- Replaced tokAt(+-1) by next()/previous()
2013-03-12 07:42:00 -07:00
d78c06dc3f
Replaced _settings->isEnabled("style") by _settings->isEnabled("warning") wherever warnings are issued
2013-03-03 02:41:59 -08:00
27f7917349
Changed severity and message formatting of argumentSize message.
2013-02-16 00:52:27 -08:00
3b08b410a2
Symbol database: Improved function lookup (a.b.f()). Ticket: #4494
2013-01-25 06:49:04 +01:00
5d5f7085bf
Updating year 2012 -> 2013 to .cpp and .h files and man page.
2013-01-01 18:29:08 +02:00
4708be09f5
Fixed #4444 (segmentation fault)
2012-12-28 11:15:18 +01:00
735069e3a7
Fixed unit tests
2012-12-26 12:50:59 +01:00
ce380301fd
Fixed #4432 (Crash on parsing PHP interpreter)
2012-12-26 08:29:10 +01:00
7f6a10599b
Fixed #4262 (Small Request/Suggestion for checks on array size of args (bounty offer))
2012-12-22 09:23:34 +01:00
365a260ddc
Fixed #4398 (False negative: out of bounds (for loop))
2012-12-22 08:00:05 +01:00
4737966caf
Unit test cleanup: Removed some empty lines and whitespaces before \n.
2012-12-06 10:19:22 -08:00
031adef6ea
Array index checking: Fixed TODO comment (false negatives when using ?:)
2012-11-30 09:01:15 +01:00
68240fffc6
Fixed #4228 ((error) Internal error. Token::Match called with varid 0 (multiple declarations in for loop))
2012-09-23 17:15:39 +02:00
ec01cc811e
Second fix for #4207 (Internal error. Token::Match called with varid 0)
2012-09-23 13:25:28 +02:00
a17f37c67d
CheckBufferOverrun: Better handling of functions with variable arguments
2012-09-22 16:19:19 +02:00
3c14e4b52a
test: tabs to spaces, remove trailing spaces and extra empty lines at the end of files
2012-09-17 13:51:40 +02:00
a99515ca91
Fixed #3933 (Negative array index issue (because sizeof struct is assumed to be 100))
2012-09-16 08:20:43 +02:00
6b56b4a9d3
Show that inconclusive message is inconclusive
2012-09-07 16:11:15 +02:00
3032ded9aa
replaced tabs with spaces
2012-09-05 19:46:44 +02:00
4202866100
Fixed #4096 (Improve check: Buffer overrun in for loop, postfix increment in array access)
2012-09-01 19:17:28 +02:00
8afdde0b5e
Fixed #3931 (FP: Buffer access out-of-bounds)
2012-08-12 17:06:54 +02:00
9834888f19
Removed some duplicate tests and a redundant variable
2012-07-25 01:34:54 -07:00
4312d31b87
#3979 added todo testcases
2012-07-19 09:44:06 +02:00
2103811291
Refactorizations in testrunner:
...
- Removed unnecessary space characters
- Removed comments from test cases which are not preprocessed
2012-07-16 05:02:33 -07:00
639f15645a
Message refactorization: checkbufferoverrun.cpp (2), checkclass.cpp, checkexceptionsafety.h
2012-07-09 02:11:05 -07:00
ed7e950671
Message refactorization: checkbufferoverrun.cpp
2012-07-08 06:51:24 -07:00
848fd59cbd
Fixed #3913 (boundcheck, false positive continue in loop)
2012-07-08 14:34:47 +02:00
43c060b630
Removed preprocessor directives from tests that aren't preprocessed before being tokenized.
2012-07-07 11:21:08 -07:00
5de82c1c42
Updated arrayIndexOutOfBounds error message. Thank you Kimmo for the suggestion.
2012-06-23 09:51:32 +02:00
4e98cb3ed9
Fixed #3907 (improve check: detect buffer overrun when using && or || in for loop)
2012-06-23 09:23:14 +02:00
ac524c56ad
Reviewed handling of unknown types in ExecutionPathBufferOverrun
2012-06-23 08:15:59 +02:00
7d59d86ed6
Fixed #3893 (Improve check: Array index out of bounds not detected when down conting)
2012-06-16 17:44:51 +02:00
ffb9342084
Added array index out of bounds tests to testsuite.
2012-05-23 23:59:14 +02:00
b3d862e27e
#3838 added todo-testcase
2012-05-23 23:32:58 +02:00
ec00824fd3
Fixed #3357 :
...
- Print "inconclusive" tag in cli
- Fixed inconclusive handling in checkbufferoverrun.cpp
- Merged reportInconclusiveError into reportError by adding an additional parameter "bool inconclusive" which is false per default
2012-05-06 10:37:41 -07:00
4dcb2ef57b
Refactorizations in test suite:
...
- Removed again one custom stringify implementation
- Avoided unnecessary std::string creation in testbufferoverrun.cpp
2012-04-16 20:02:52 +02:00
b37cf11d20
Refactorizations:
...
- Increased encapsulation by making some functions private
- Removed redundant function CheckBufferOverrun::ArrayInfo::declare
- Avoided copy of ArrayInfo object
- Removed unnecessary and suspicious "if(sizeof(int) == 4)"
2012-03-27 19:40:39 +02:00
2be85e9d37
Fixed #3538 (false positive caused by bad tokenizer simplification)
2012-02-01 21:13:26 +01:00
aaa6070fc9
Run astyle.
2012-01-31 18:43:11 +01:00
86a5a9a7bf
fixed wrong testcase
2012-01-31 16:48:05 +01:00
c1e2802175
ticket 3569: added further testcases
2012-01-31 16:25:57 +01:00
7110fa2c0c
added tests for ticket #3569
2012-01-31 16:13:28 +01:00
8cae17fda8
Update year to 2012
2012-01-01 01:05:37 +02:00
7c95c6f680
Array index out of bounds: Added test case for #3428 (same name of structs)
2011-12-18 16:43:46 +01:00
772b8cc37d
Array index out of bounds: Avoid false positives when there are duplicate names for structs
2011-12-18 08:12:42 +01:00
5f712cc213
Array index out of bounds: Fixed false positive when taking address beyond array using calculated array index
2011-12-17 21:35:12 +01:00
95123854ba
Array index out of bounds: Fixed false positive when size is not known.
2011-12-17 13:20:42 +01:00
497c54a1a7
Fixed #3168 (false negative: buffer overflow in subfunction)
2011-12-11 08:16:58 +01:00
ee39f6402c
reverted fix for #3168 , I'll rewrite it
2011-12-10 20:46:10 +01:00
897e8637b4
Fixed #3168 (false negative: buffer overflow in subfunction)
2011-12-10 19:26:12 +01:00
1bef8d1247
Tokenizer: Code cleanups
2011-12-08 17:42:26 +01:00
4884a1dfe0
sanity check for ticket #3387 ( buffer access out of bounds)
2011-12-06 20:53:56 +01:00
344d7e2f34
Fixed #3283 (False negative: array index out of bounds not found for constant string and known array index value)
2011-11-30 19:17:09 -08:00
e0b50719f4
Fixed #909 (improve check: out of bounds of memchr function and out of bounds check)
2011-11-27 07:54:52 +01:00
603a37b08a
added testcase for ticket #3273
2011-11-01 11:52:39 +01:00
dc29d43e83
astyle formatting
2011-10-29 20:27:50 +02:00
d7be62a6f9
Fixed #3221 (FP: Array 'arr[2147483648]' index 0 out of bounds in loop when size unknown to cppcheck)
2011-10-29 20:26:24 +02:00
3413ffef3e
Refactor readlink() buffer check to also handle readlinkat()
2011-10-24 21:23:18 +02:00
b332ea8222
Fixed #3204 (Refactor standards support in Settings)
2011-10-22 09:45:48 +02:00
a52b73f9f9
Fix #3208 (Simplify pointer to standard type, C only)
...
The symbol database is unavailable during token simplification
and &data[0] might return something completely different for C++.
Moved code_is_c() from checkOther to Tokenizer.
2011-10-16 08:09:57 +02:00
7ae39f13cc
Fixed #3198 (Add check for readlink())
2011-10-14 19:45:51 +02:00
6f8e42a5af
changed the astyle formatting flags
2011-10-13 20:53:06 +02:00
b73896bcc5
Fixed #3163 (Out of bounds pointer arithmetic not reset)
2011-10-12 20:54:39 +02:00
abd2525339
Fixed #3161 (Show buffers size info for snprintf() buffer overruns)
2011-10-05 20:17:57 +02:00
65b0fb4519
fix #3153 (false positive buffer access out-of-bounds)
2011-09-30 17:28:59 -04:00
ac070b90f2
fix for loop false positives when zero length arrays present
2011-09-22 21:23:40 -04:00
b349d36c50
fix #3124 (FP: Buffer access out-of-bounds when memset two dimension array (a[5][6]))
2011-09-19 20:32:50 -04:00
3f517b5f23
partial fix for #2960 (false negative: buffer access out of bounds)
2011-09-11 21:51:05 -04:00
40009d091d
add multi-dimension array support to second checkScope and use it for member arrays
2011-09-11 20:42:57 -04:00
0d6592dd2e
use correct checkScope function in CheckBufferOverrun for single dimension member arrays
2011-09-11 19:21:13 -04:00
19928e26d1
refactor to unify functionally identical code in CheckBufferOverrun::checkScope()
2011-09-11 14:00:53 -04:00
547a79d4fe
calculate array size for variable length structures with array at end in CheckBufferOverrun::checkStructVariable() when possible
2011-09-10 10:14:32 -04:00
b0eab2587d
better detection of variable sized structure in CheckBufferOverrun::checkStructVariable()
2011-09-09 08:37:24 -04:00
27bfa2a346
fix some CheckBufferOverrun::checkStructVariable() flase negatives for possible variable length structs
2011-09-09 07:46:06 -04:00
16924c7c7a
fix #3094 (Buffer access out-of-bounds in struct variable)
2011-09-09 07:16:39 -04:00
812a17f294
fix one of the TODO testcases added for #3094 (Buffer access out-of-bounds in struct variable)
2011-09-08 22:44:25 -04:00
65b1a4df19
add soem test cases for #3094 (Buffer access out-of-bounds in struct variable)
2011-09-08 22:41:18 -04:00
7451c5cece
warn when buffer is not zero terminated after memmove
2011-09-05 15:59:41 -04:00
f5d71d1ac5
warn when buffer is not zero terminated after memcpy
2011-09-05 15:41:37 -04:00
3c8988e7a5
warn when buffer is not zero terminated after strncpy
2011-09-05 15:19:38 -04:00
fe85b8779e
fix #2528 (false negative: buffer access out of bounds)
2011-09-04 21:39:52 -04:00
50688b28fd
fix #2889 (false negative: buffer access out of bounds on local struct member)
2011-09-04 19:54:57 -04:00
c2b76cd41f
add some variable length array tests
2011-09-04 14:39:24 -04:00
e782d98241
final fix for #3063 (false negative: multi dimensional arrays not well supported)
2011-09-03 21:51:00 -04:00
d23c58d387
enable: break out 'performance' and 'portability' from the 'style' id. Ticket: #3074
2011-09-03 15:30:30 +02:00
d749e28dc0
another partial fix for #3063 (false negative: multi dimensional arrays not well supported)
2011-09-02 21:07:29 -04:00
d85410de8c
partial fix for #3063 (false negative: multi dimensional arrays not well supported)
2011-09-02 19:35:09 -04:00
ef30da51bf
Fixed #3034 (Cppcheck crash on specific file (truecrypt).)
2011-08-29 19:16:52 +02:00
cf6d04de74
fix #3044 (Symbol database: handle multidim array with unknown dimension 'char a[][4]')
2011-08-28 11:40:55 -04:00
d643397a7e
better message for strncpy zero-terminated check
2011-08-28 09:06:51 -04:00
8c093d0f8a
refactor CheckBufferOverrun::checkScope strncpy check and change experimental to inconclusive
2011-08-27 21:18:39 -04:00
c4fdb8d113
better test for symbol database bug fixed in last commit
2011-08-24 06:53:27 -04:00
8c1efe9bb6
improve message for #3035 (false negative: strcpy(dst, src) where src is bigger than dst)
2011-08-21 15:18:41 -04:00
67e8731a96
partial fix for #3035 (false negative: strcpy(dst, src) where src is bigger than dst)
2011-08-21 14:44:55 -04:00
a30da73d3e
fix #2986 (segmentation fault of cppcheck ( x[y] ))
2011-08-09 19:45:18 -04:00
Daniel Marjamäki
PKEuS
Heinrich Schuchardt
Martin Ettl
Simon Martin
Alexander Mai
Alexey Zhikhartsev
Lucas Manuel Rodriguez
Thomas Jarosch
Robert Reif
Reijo Tomperi
XhmikosR
Deepak Gupta
Daniel Marjamäki
Edoardo Prezioso
Ettl Martin
Zachary Blair
Marek Zmysłowski