Commit Graph

664 Commits

Author SHA1 Message Date
chrchr-github cea649761c
Fix FN buffer overrun with array of pointers (#3582) 2021-11-27 12:15:36 +01:00
Paul Fultz II 33ad30f4da
Fix 10617, 9824: conditions in expanded macro (#3578) 2021-11-25 18:40:15 +01:00
chrchr-github b211139dbd
Add test for #10092 (#3571) 2021-11-20 08:52:51 +01:00
Daniel Marjamäki f701a9361d chmod; Use 644 for source files 2021-11-17 08:25:25 +01:00
Paul Fultz II 8bff45281d
Fix 10599: regression- segmentation fault on template code (#3565) 2021-11-16 06:49:13 +01:00
chrchr-github 49d3e07b59
Add test case for #10137 (#3558) 2021-11-11 20:25:10 +01:00
chrchr-github 0d1d3b4ed0
Add regression test for #10458 (#3555) 2021-11-11 07:59:14 +01:00
Daniel Marjamäki a9a093e7cc Fixed #10367 (False positive; pointer out of bounds argv-1) 2021-09-15 08:29:10 +02:00
Paul Fultz II d4174a31ba
Fix 10414: FP 'The address of local variable 'single_value' might be accessed at non-zero index.' (regression) (#3447) 2021-09-06 07:15:46 +02:00
Paul Fultz II 98e22f6162
Fix 10413: FP arrayIndexOutOfBoundsCond after check (#3446) 2021-09-06 07:15:24 +02:00
Daniel Marjamäki 06249c08f3 argumentSize: Clarify error message 2021-08-29 15:38:58 +02:00
orbitcowboy 98a84b62a3 #2019: Added regression test 2021-08-22 20:01:25 +02:00
Daniel Marjamäki db57efa486 CheckBufferOverrun: Reimplement CheckBufferOverrun::argumentSize check 2021-08-22 16:37:41 +02:00
Paul Fultz II e0de48bb1d
Fix 7524: ValueFlow: false path for 'x<3' (#3393) 2021-08-16 09:19:07 +02:00
Paul Fultz II 7f358b2bed
Format with uncrustify (#3388) 2021-08-07 20:51:18 +02:00
Daniel Marjamäki 5e9feb7db1 astyle formatting 2021-08-04 20:32:30 +02:00
Paul Fultz II 6736ac7e3a
Revert "Formatted the code [ci skip]" (#3380)
This reverts commit 7a6d7f7c2d.
2021-08-03 17:53:30 +02:00
orbitcowboy 7a6d7f7c2d Formatted the code [ci skip] 2021-08-03 06:33:54 +02:00
chrchr-github ba00046732
Add test case for ticket #6884 (#3375)
* Add test case for ticket #9808

* Add test case for ticket #6884
2021-08-02 13:21:18 +02:00
Armin Müller fc90598077
Typos found by running "codespell" (#3324) 2021-07-02 17:41:51 +02:00
Paul Fultz II 668b88d7c0
Fix 10284: False positive; valueFlowBeforeCondition does not seem to care about increment (#3287) 2021-06-04 21:40:57 +02:00
Paul Fultz II b23c5aa742
Fix 10023: ValueFlow; Wrong result of post-increment in reverse analysis (#3289) 2021-06-04 17:20:21 +02:00
Daniel Marjamäki 3a498de306 extracttests; do not extract TestBufferOverrunterminateStrncpy tests 2021-05-24 13:17:29 +02:00
Daniel Marjamäki 5f6b56ada2 buffer overrun; Fixed false negative for dynamically allocated float buffer 2021-05-22 15:39:20 +02:00
Daniel Marjamäki 9a9f14bd8a Buffer overflow; Fixed FPs when array size is 1 2021-05-22 12:13:39 +02:00
Paul Fultz II 1e3ab460a3
Fix 10254: false positive: arrayIndexOutOfBounds in inline function (#3266) 2021-05-22 08:20:09 +02:00
Daniel Marjamäki 2c155a7a78 Uninitialized variables; use AST 2021-05-16 11:58:51 +02:00
Daniel Marjamäki e73057eb44 Fixed #10275 (ValueFlow: condition 'x>=0 && x < 10') 2021-05-16 10:34:22 +02:00
Daniel Marjamäki 2c10e0747a extracttests: ensure error comment is written on proper line 2021-05-16 08:40:04 +02:00
Daniel Marjamäki a07ea7e9e9 testbufferoverrun: refactor TODO test cases. Use TODO_ASSERT_EQUALS. 2021-05-15 21:08:07 +02:00
Daniel Marjamäki a2ff7752b4 testbufferoverrun; refactor TODO test cases 2021-05-15 20:42:57 +02:00
Daniel Marjamäki a40b85ccc6 testbufferoverrun: refactor TODO test case for strcat 2021-05-15 20:37:16 +02:00
Daniel Marjamäki b8314289c6 testbufferoverrun; fixed TODO test cases for pointer arithmetic overflows 2021-05-15 20:32:46 +02:00
Daniel Marjamäki 680a1ee1b9 testbufferoverrun; remove TODO strncat/strcat test cases 2021-05-15 20:12:36 +02:00
Daniel Marjamäki 26e9525683 testbufferoverrun; test case cleanup, ensure there is not uninitialized reads etc 2021-05-15 15:35:14 +02:00
Paul Fultz II eb96e4980e
Fix issue 10268: ValueFlow; Wrong value in for loop (#3257) 2021-05-15 08:39:20 +02:00
Daniel Marjamäki d549770b5b updated extracttests.py. fix syntax errors in test cases. 2021-05-13 20:21:02 +02:00
orbitcowboy e869452240 #10244: Fixed false negative: bufferAccessOutOfBounds 2021-04-13 16:40:38 +02:00
Oliver Stöneberg 6397e29f84
cleaned up includes based on include-what-you-use (#3141) 2021-04-03 21:30:50 +02:00
orbitcowboy e23a967215 #4750 Added a regression test 2021-03-28 09:29:46 +02:00
orbitcowboy 185a5e1ee6 #7682 Added regression test 2021-03-26 10:54:08 +01:00
orbitcowboy 6fd916a90f #3763 Added regression test 2021-03-26 10:01:44 +01:00
Daniel Marjamäki 42437277dc Update Copyright year 2021-03-21 20:58:32 +01:00
PKEuS 141d2ac215 Refactorization: Improved internal implementation of severity and certainty levels
Backported from LCppC.
2021-02-24 22:00:06 +01:00
PKEuS 4b01d5bdc6 Re-enabled a bunch of disabled unit tests, some as TODO tests
Merged from LCppC.
2021-02-20 13:02:14 +01:00
PKEuS cf1937294a Refactorization: Removed unnecessary \n and spaces in strings
Merged from LCppC.
2021-02-20 12:58:42 +01:00
Paul Fultz II fc4238829f
Fix issue 10092: false positive: (warning) The address of local variable 'data' might be accessed at non-zero index. (#3041) 2021-01-12 10:24:28 +01:00
Paul Fultz II e004731f1c
Fix issue 8650: ValueFlow: Track if pointer is created by '&' operator (#3011) 2021-01-05 16:56:38 +01:00
Ken-Patrick Lehrmann 8c2c81dbcd
Fix some false positive in loop forward analysis (#2669)
* Fix some false positive in loop forward analysis

In cases like:
```
bool b();
void f()
{
    int val[50];
    int i, sum=0;
    for (i = 1; b() && i < 50; i++)
        sum += val[i];
    for (; i < 50; i++)
        sum -= val[i];
}
```
The forward analysis assumed the second loop was entered, and we ended
up with false positive in it:
 `Array 'val[50]' accessed at index 50, which is out of bounds`

* Fix style
2020-06-05 18:06:03 +02:00
Daniel Marjamäki 08ddd84780 Update copyright year 2020-05-10 11:16:32 +02:00
Daniel Marjamäki 3e0218299b Revert "Update copyright year"
This reverts commit 6eec6c4bd5.
2020-05-10 11:13:05 +02:00
Daniel Marjamäki 6eec6c4bd5 Update copyright year 2020-05-10 11:11:34 +02:00
Oliver Stöneberg 2c1e36e63e
cleaned up includes based on include-what-you-use (#2600)
* cleaned up includes based on include-what-you-use

* check.h: trying to work around Visual Studio 2012 bug

* fixed Visual Studio compilation
2020-04-13 13:44:48 +02:00
orbitcowboy f05c504440 Running astyle [ci skip] 2020-03-03 20:38:30 +01:00
Dmitry-Me b61feff125 Improve test coverage for detecting invalid pointers 2020-03-02 19:01:27 +03:00
Paul Fultz II 3b20684aca
Fix issue 9360: False positive: arrayIndexOutOfBounds when function is called with different array sizes (#2541) 2020-02-17 10:31:08 +01:00
Paul Fultz II e1a97c524d Fix issue 9554: False positive: The address of local variable 'x' is accessed at non-zero index. (#2470)
* Fix issue 9554: False positive: The address of local variable 'x' is accessed at non-zero index.

* Format

* Remove unnecesary condition check
2020-01-04 11:39:52 +01:00
Daniel Marjamäki 9ffb657c1a Fixed #8597 (False positive - Array index is used before limits check.) 2019-12-20 09:46:01 +01:00
Paul Fultz II 78b4485670 Regression for issue 8653: valueFlowAfterCondition: compound conditional (#2416) 2019-12-02 11:35:51 +01:00
Sebastian c3c3d6770c
Fix #9478: Valueflow: printf does not change value (#2388)
Format-string arguments are now marked to have `in` direction, except
for `scan`-functions (like `scanf`) where these arguments are explicitly
marked to have `out` direction.
2019-11-24 01:40:31 +01:00
Daniel Marjamäki fcc5fad3ed Fixed #9113 (false positive: (error) Buffer is accessed out of bounds) 2019-11-10 16:42:48 +01:00
Rikard Falkeborn 73a569be97 TestBufferOverRun: Handle string literals (#2287) 2019-10-21 07:11:22 +02:00
Rikard Falkeborn 5c061c1c12 Set correct type and size of string and char literals (#2275)
* Set correct type and size of string and char literals

Use that string and char literal tokens store the prefix. This makes
it possible to distinghuish between different type of string literals
(i.e., utf8 encoded strings, utf16, wide strings, etc) which have
different type.

When the tokens holding the string and character values have the correct
type, it is possible to improve Token::getStrSize() to give the correct
result for all string types. Previously, it would return the number of
characters in the string, i.e., it would give the wrong size unless
the type of the string was char*.

Since strings now can have different size (in number of bytes) and
length (in number of elements), add a new helper function that returns
the number of characters. Checkers have been updated to use the correct
functions.

Having the size makes it possible to find more problems with prefixed
strings, and to reduce false positives, for example in the buffer
overflow checker.

Also, improve the stringLiteralWrite error message to also print the
prefix of the string (if there is one).

* Add comment and update string length
2019-10-20 07:11:57 +02:00
Rikard Falkeborn 443fcd2ac4 TestBufferOverrun: Enable passing tests (#2246)
There are a number of tests and asserts in testbufferoverrun that pass.
Enable them to add test coverage.
2019-10-07 09:17:12 +02:00
Paul Fultz II 6b6553e320 Dont warn for arrays that are containers (#2240) 2019-10-05 16:14:30 +02:00
orbitcowboy 4b41f19c87 insecureCmdLineArgs: Added more test cases to ensure 'const'-qualifiers are handled correctly. 2019-08-15 08:45:31 +02:00
Daniel Marjamäki 602911cfca Activate a TODO test case 2019-07-29 08:06:57 +02:00
Scott Furry a195477470 Correct Zero/Null as pointer constant (#1938)
Building with enhanced clang warnings indicated a large number of
instances with the warning:

`warning: zero as null pointer constant`

Recommended practice in C++11 is to use `nullptr` as value for
a NULL or empty pointer value. All instances where this warning
was encountered were corrected in this commit.

Where warning was encountered in dependency code (i.e. external library)
no chnages were made. Patching will be offered upstream.
2019-06-30 21:39:22 +02:00
Paul Fultz II f75c15af56 Fix issue 6821: New check: access heap/stack data using address of variable
This fixes errors with:

```cpp
int f() {
    int i;
    return (&i)[1];
}
```

It uses the lifetime analysis to detect the issues.
2019-05-31 12:24:31 +02:00
Daniel Marjamäki 6da42a3d63 Fixed #9112 (false positive: (error) Array index out of bounds; buffer 'x' is accessed at offset n.) 2019-05-01 13:00:14 +02:00
Daniel Marjamäki de4f57ec0f Buffer overflow: Add CTU checking for pointer arithmetic overflows 2019-04-03 06:43:56 +02:00
Daniel Marjamäki c5807459f9 CheckBufferOverrun: Add check for pointer arithmetics 2019-03-31 09:00:52 +02:00
Daniel Marjamäki 4107671549 TestBufferOverrun: Uncommented and moved CTU tests 2019-03-30 15:10:00 +01:00
Daniel Marjamäki b5a285319c Fixed #9073 (Segmentation fault in Token::isUnaryOp() with ode) 2019-03-29 19:37:23 +01:00
Daniel Marjamäki d6b806c592 CheckBufferOverrun: Better CTU checking when variable address is passed 2019-03-23 15:57:17 +01:00
Daniel Marjamäki 9653760547 CheckBufferOverrun: Improved CTU analysis for array 2019-03-23 11:20:35 +01:00
Daniel Marjamäki 15fc9a622d CheckBufferOverrun: Add CTU analysis 2019-03-23 08:36:10 +01:00
Daniel Marjamäki 031362ae01 CheckBufferOverrun: Fix false positive 2019-03-19 21:07:08 +01:00
Daniel Marjamäki a0e58f0039 Revert "Revert "CheckBufferOverrun: Handle multidimensional arrays""
This reverts commit 9d1755f449.
2019-03-19 13:16:22 +01:00
Daniel Marjamäki 9d1755f449 Revert "CheckBufferOverrun: Handle multidimensional arrays"
This reverts commit e98a4a6f14.
2019-03-19 13:13:29 +01:00
Daniel Marjamäki e98a4a6f14 CheckBufferOverrun: Handle multidimensional arrays 2019-03-19 09:29:32 +01:00
Daniel Marjamäki 03f8535c71 Better multiline warning when there is buffer overflow 2019-03-17 20:12:02 +01:00
Daniel Marjamäki 3c85d8a8ac ValueFlow: Better info for buffer size values 2019-03-17 19:02:36 +01:00
Daniel Marjamäki 0771929518 Buffer overflow: Handling of dynamically allocated buffer 2019-03-17 13:40:56 +01:00
Daniel Marjamäki 92f4113b59 Array index: Checking array index out of bounds for dynamic buffers 2019-03-17 13:09:15 +01:00
Daniel Marjamäki ebef16b8a3 Travis: Try to remove temporary fix 2019-03-16 18:29:02 +01:00
Daniel Marjamäki e9d29e826f Travis: Temporarily comment out failing test 2019-03-16 09:48:32 +01:00
Daniel Marjamäki fb2198fd6b Travis: Try to fix test 2019-03-16 09:28:00 +01:00
Daniel Marjamäki f40a80c349 Use 'normal' checking instead of 'simplified' 2019-03-16 07:19:48 +01:00
Daniel Marjamäki 81a1d744c6 CheckBufferOverrun: fix FP for array definition of static class member 2019-03-13 06:39:09 +01:00
Daniel Marjamäki 67e8b99c2c CheckBufferOverrun: Readd a check for strncpy/memcpy/etc 2019-03-12 21:15:26 +01:00
Daniel Marjamäki 0c08f6db6c CheckBufferOverrun: Use AST to lookup array 2019-03-12 06:46:38 +01:00
Daniel Marjamäki ea23033a65 Array index out of bounds: Fix false positive 2019-03-11 20:33:08 +01:00
Daniel Marjamäki bd048085bd Add CheckBufferOverrun::arrayIndexThenCheck 2019-03-11 19:20:06 +01:00
Daniel Marjamäki 729f57d8f1 Start a major rewrite of CheckBufferOverrun. For now only the 'array index' and 'buffer overflow' checks are rewritten.
There are important TODOs still; for instance adding CTU support using our CTU infrastructure, add handling of pointers (maybe I'll use FwdAnalysis for this), add handling of multidimensional arrays, etc..
2019-03-11 12:34:33 +01:00
amai2012 eb9edbc177 #9024 Crash caused by package "procserv" in lib/token.h:921 function Token::getKnownIntValue - Fix and test for alternative code example. 2019-03-08 11:07:33 +01:00
Daniel Marjamäki c32d015337 Fixed false positives from terminateStrncpy 2019-03-06 18:50:50 +01:00
Daniel Marjamäki bd7790fd8c Update copyright year 2019-02-09 07:24:06 +01:00
Paul Fultz II 4b37f276c2 ValueFlow: Set arrays to true when converting to a boolean
This sets it by checking the parent. It doesn't handle function parameters yet.
2019-01-21 20:05:35 +01:00
Daniel Marjamäki 8dd641b8be Use OVERRIDE in test 2019-01-12 15:45:25 +01:00