FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Revert "Fix #11765 FN: minsize not checked for string literal, buffer… · etemcode1/cppcheck@709fec8 · GitHub

/ cppcheck Public
forked from cppcheck-opensource/cppcheck

Commit 709fec8

Browse files
chrchr-github
authored
Revert "Fix #11765 FN: minsize not checked for string literal, buffer… (cppcheck-opensource#5235)
… access out of bounds not found (cppcheck-opensource#5154)" This reverts commit 9ad18f5.
1 parent 9c5275f commit 709fec8

4 files changed

Lines changed: 34 additions & 41 deletions

File tree

‎cfg/std.cfg‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5011,6 +5011,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
50115011
<arg nr="3" direction="in">
50125012
<not-null/>
50135013
<not-uninit/>
5014+
<minsize type="argvalue" arg="4"/>
50145015
<strz/>
50155016
</arg>
50165017
<arg nr="4" direction="in">
@@ -5096,6 +5097,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
50965097
<arg nr="3" direction="in">
50975098
<not-null/>
50985099
<not-uninit/>
5100+
<minsize type="argvalue" arg="4"/>
50995101
<strz/>
51005102
</arg>
51015103
<arg nr="4" direction="in">
@@ -5211,6 +5213,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
52115213
<not-null/>
52125214
<not-uninit/>
52135215
<strz/>
5216+
<minsize type="argvalue" arg="3"/>
52145217
</arg>
52155218
<arg nr="3" direction="in">
52165219
<not-uninit/>

‎lib/checkbufferoverrun.cpp‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -554,25 +554,20 @@ ValueFlow::Value CheckBufferOverrun::getBufferSize(const Token *bufTok) const
554554
return *value;
555555
}
556556

557-
MathLib::bigint dim = -1;
558-
if (var) {
559-
dim = std::accumulate(var->dimensions().cbegin(), var->dimensions().cend(), 1LL, [](MathLib::bigint i1, const Dimension &dim) {
560-
return i1 * dim.num;
561-
});
562-
}
563-
else if (bufTok->tokType() == Token::Type::eString) {
564-
dim = Token::getStrLength(bufTok) + 1;
565-
}
566-
else
557+
if (!var)
567558
return ValueFlow::Value(-1);
568559

560+
const MathLib::bigint dim = std::accumulate(var->dimensions().cbegin(), var->dimensions().cend(), 1LL, [](MathLib::bigint i1, const Dimension &dim) {
561+
return i1 * dim.num;
562+
});
563+
569564
ValueFlow::Value v;
570565
v.setKnown();
571566
v.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE;
572567

573-
if (var && var->isPointerArray())
568+
if (var->isPointerArray())
574569
v.intvalue = dim * mSettings->platform.sizeof_pointer;
575-
else if (var && var->isPointer())
570+
else if (var->isPointer())
576571
return ValueFlow::Value(-1);
577572
else {
578573
const MathLib::bigint typeSize = bufTok->valueType()->typeSize(mSettings->platform);
@@ -651,7 +646,7 @@ void CheckBufferOverrun::bufferOverflow()
651646
argtok = argtok->astOperand2() ? argtok->astOperand2() : argtok->astOperand1();
652647
while (Token::Match(argtok, ".|::"))
653648
argtok = argtok->astOperand2();
654-
if (!argtok || (!argtok->variable() && argtok->tokType() != Token::Type::eString))
649+
if (!argtok || !argtok->variable())
655650
continue;
656651
if (argtok->valueType() && argtok->valueType()->pointer == 0)
657652
continue;

‎test/cfg/std.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,12 +219,14 @@ void bufferAccessOutOfBounds(void)
219219
strncpy_s(a,5,"abcd",5);
220220
// string will be truncated, error is returned, but no buffer overflow
221221
strncpy_s(a,5,"abcde",6);
222+
// TODO cppcheck-suppress bufferAccessOutOfBounds
222223
strncpy_s(a,5,"a",6);
223224
strncpy_s(a,5,"abcdefgh",4);
224225
// valid call
225226
strncat_s(a,5,"1",2);
226227
// cppcheck-suppress bufferAccessOutOfBounds
227228
strncat_s(a,10,"1",2);
229+
// TODO cppcheck-suppress bufferAccessOutOfBounds
228230
strncat_s(a,5,"1",5);
229231
fread(a,1,5,stdin);
230232
// cppcheck-suppress bufferAccessOutOfBounds
@@ -516,6 +518,7 @@ void nullpointer(int value)
516518
wcstok(NULL,L"xyz",&pWcsUninit);
517519

518520
strxfrm(0,"foo",0);
521+
// TODO: error message (#6306 and http://trac.cppcheck.net/changeset/d11eb4931aea51cf2cb74faccdcd2a3289b818d6/)
519522
strxfrm(0,"foo",42);
520523
wcsxfrm(0,L"foo",0);
521524
// TODO: error message when arg1==NULL and arg3!=0 #6306: https://trac.cppcheck.net/ticket/6306#comment:2

‎test/testbufferoverrun.cpp‎

Lines changed: 20 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,6 @@ class TestBufferOverrun : public TestFixture {
238238
TEST_CASE(buffer_overrun_34); //#11035
239239
TEST_CASE(buffer_overrun_35); //#2304
240240
TEST_CASE(buffer_overrun_36);
241-
TEST_CASE(buffer_overrun_37);
242241
TEST_CASE(buffer_overrun_errorpath);
243242
TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch
244243
TEST_CASE(buffer_overrun_function_array_argument);
@@ -3325,6 +3324,23 @@ class TestBufferOverrun : public TestFixture {
33253324
" (void)strxfrm(dest,src,3);\n" // <<
33263325
"}");
33273326
ASSERT_EQUALS("[test.cpp:6]: (error) Buffer is accessed out of bounds: dest\n", errout.str());
3327+
// source size is too small
3328+
check("void f(void) {\n"
3329+
" const char src[2] = \"ab\";\n"
3330+
" char dest[3] = \"abc\";\n"
3331+
" (void)strxfrm(dest,src,1);\n"
3332+
" (void)strxfrm(dest,src,2);\n"
3333+
" (void)strxfrm(dest,src,3);\n" // <<
3334+
"}");
3335+
ASSERT_EQUALS("[test.cpp:6]: (error) Buffer is accessed out of bounds: src\n", errout.str());
3336+
// source size is too small
3337+
check("void f(void) {\n"
3338+
" const char src[1] = \"a\";\n"
3339+
" char dest[3] = \"abc\";\n"
3340+
" (void)strxfrm(dest,src,1);\n"
3341+
" (void)strxfrm(dest,src,2);\n" // <<
3342+
"}");
3343+
ASSERT_EQUALS("[test.cpp:5]: (error) Buffer is accessed out of bounds: src\n", errout.str());
33283344
}
33293345

33303346
void buffer_overrun_33() { // #2019
@@ -3387,32 +3403,6 @@ class TestBufferOverrun : public TestFixture {
33873403
ASSERT_EQUALS("", errout.str());
33883404
}
33893405

3390-
void buffer_overrun_37() { // #11765
3391-
check("void f() {\n"
3392-
" char buf[128];\n"
3393-
" memcpy(buf, \"Error\", 6);\n"
3394-
"}\n");
3395-
ASSERT_EQUALS("", errout.str());
3396-
3397-
check("void f() {\n"
3398-
" char buf[128];\n"
3399-
" memcpy(buf, \"Error\", 16);\n"
3400-
"}\n");
3401-
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds: \"Error\"\n", errout.str());
3402-
3403-
check("void f() {\n"
3404-
" char buf[128];\n"
3405-
" memcpy(buf, L\"Error\", 10);\n" // at least 12 bytes on any platform
3406-
"}\n");
3407-
ASSERT_EQUALS("", errout.str());
3408-
3409-
check("void f() {\n"
3410-
" char buf[128];\n"
3411-
" memcpy(buf, L\"Error\", 26);\n" // at most 24 bytes
3412-
"}\n");
3413-
ASSERT_EQUALS("[test.cpp:3]: (error) Buffer is accessed out of bounds: L\"Error\"\n", errout.str());
3414-
}
3415-
34163406
void buffer_overrun_errorpath() {
34173407
setMultiline();
34183408
const Settings settingsOld = settings0;
@@ -4275,7 +4265,9 @@ class TestBufferOverrun : public TestFixture {
42754265
check("void f() {\n"
42764266
" mymemset(\"abc\", 0, 20);\n"
42774267
"}", settings);
4278-
ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds: \"abc\"\n", errout.str());
4268+
TODO_ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds.\n",
4269+
"",
4270+
errout.str());
42794271

42804272
check("void f() {\n"
42814273
" mymemset(temp, \"abc\", 4);\n"

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL