diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index e0de433e1f1..660a048a977 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -2123,12 +2123,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
-
-
@@ -2146,12 +2144,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
-
-
@@ -4200,7 +4196,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
-
@@ -5472,7 +5467,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
-
@@ -5606,7 +5600,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
-
diff --git a/cfg/sqlite3.cfg b/cfg/sqlite3.cfg
index 6c5811f1f75..c10179630f0 100644
--- a/cfg/sqlite3.cfg
+++ b/cfg/sqlite3.cfg
@@ -1403,13 +1403,11 @@
-
-
diff --git a/cfg/std.cfg b/cfg/std.cfg
index 6c434b8715c..edf67e0534b 100644
--- a/cfg/std.cfg
+++ b/cfg/std.cfg
@@ -5030,7 +5030,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
-
@@ -5116,7 +5115,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
-
@@ -5233,7 +5231,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
-
diff --git a/cfg/windows.cfg b/cfg/windows.cfg
index b2251900d42..1481da3a3a7 100644
--- a/cfg/windows.cfg
+++ b/cfg/windows.cfg
@@ -4293,12 +4293,10 @@ HFONT CreateFont(
-
-
@@ -4632,7 +4630,6 @@ HFONT CreateFont(
-
diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
index bdd18ee21d2..7d9cb6d36d2 100644
--- a/lib/checkbufferoverrun.cpp
+++ b/lib/checkbufferoverrun.cpp
@@ -604,6 +604,14 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons
return bufSizeVal;
}
}
+ } else if (bufTok->tokType() == Token::Type::eString && bufTok->valueType()) {
+ ValueFlow::Value strSizeVal;
+ strSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE;
+ const size_t charSize = bufTok->valueType()->getSizeOf(settings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointee);
+ if (charSize > 0) {
+ strSizeVal.intvalue = Token::getStrArraySize(bufTok) * charSize;
+ return strSizeVal;
+ }
}
}
diff --git a/test/cfg/posix.c b/test/cfg/posix.c
index 82cfd950792..d90e3f289e4 100644
--- a/test/cfg/posix.c
+++ b/test/cfg/posix.c
@@ -717,8 +717,9 @@ size_t bufferAccessOutOfBounds_strnlen(const char *s, size_t maxlen)
{
const char buf[2]={'4','2'};
size_t len = strnlen(buf,2);
- // cppcheck-suppress bufferAccessOutOfBounds
+ // TODO cppcheck-suppress bufferAccessOutOfBounds
len+=strnlen(buf,3);
+ len+=strnlen("ab",3);
return len;
}
@@ -1606,4 +1607,4 @@ void pthread_define_test()
(void)rwlock;
PTHREAD_SCOPE_PROCESS;
PTHREAD_SCOPE_SYSTEM;
-}
\ No newline at end of file
+}
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
index f6a2e1a5ec1..2443635eb0e 100644
--- a/test/testbufferoverrun.cpp
+++ b/test/testbufferoverrun.cpp
@@ -229,6 +229,7 @@ class TestBufferOverrun : public TestFixture {
TEST_CASE(buffer_overrun_36);
TEST_CASE(buffer_overrun_37);
TEST_CASE(buffer_overrun_38);
+ TEST_CASE(buffer_overrun_39);
TEST_CASE(buffer_overrun_errorpath);
TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch
TEST_CASE(buffer_overrun_function_array_argument);
@@ -3484,23 +3485,6 @@ class TestBufferOverrun : public TestFixture {
" (void)strxfrm(dest,src,3);\n" // <<
"}\n");
ASSERT_EQUALS("[test.cpp:6:19]: (error) Buffer is accessed out of bounds: dest [bufferAccessOutOfBounds]\n", errout_str());
- // source size is too small
- check("void f(void) {\n"
- " const char src[2] = \"ab\";\n"
- " char dest[3] = \"abc\";\n"
- " (void)strxfrm(dest,src,1);\n"
- " (void)strxfrm(dest,src,2);\n"
- " (void)strxfrm(dest,src,3);\n" // <<
- "}\n");
- ASSERT_EQUALS("[test.cpp:6:24]: (error) Buffer is accessed out of bounds: src [bufferAccessOutOfBounds]\n", errout_str());
- // source size is too small
- check("void f(void) {\n"
- " const char src[1] = \"a\";\n"
- " char dest[3] = \"abc\";\n"
- " (void)strxfrm(dest,src,1);\n"
- " (void)strxfrm(dest,src,2);\n" // <<
- "}\n");
- ASSERT_EQUALS("[test.cpp:5:24]: (error) Buffer is accessed out of bounds: src [bufferAccessOutOfBounds]\n", errout_str());
}
void buffer_overrun_33() { // #2019
@@ -3638,6 +3622,44 @@ class TestBufferOverrun : public TestFixture {
ASSERT_EQUALS("", errout_str());
}
+ void buffer_overrun_39() { // #11765
+ check("void f() {\n"
+ " char buf[10];\n"
+ " memcpy(buf, \"abc\", 4);\n"
+ "}\n");
+ ASSERT_EQUALS("", errout_str());
+
+ check("void f() {\n"
+ " char buf[128];\n"
+ " memcpy(buf, \"abc\", 5);\n"
+ "}\n");
+ ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
+ errout_str());
+
+ check("void f() {\n"
+ " char buf[128];\n"
+ " memcpy(buf, L\"abc\", 4 * sizeof(wchar_t));\n"
+ "}\n");
+ ASSERT_EQUALS("", errout_str());
+
+ check("void f() {\n"
+ " char buf[128];\n"
+ " memcpy(buf, L\"abc\", 4 * sizeof(wchar_t) + 1);\n"
+ "}\n");
+ ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: L\"abc\" [bufferAccessOutOfBounds]\n",
+ errout_str());
+
+ check("int f(char* s) {\n"
+ " return memcmp(s, \"\\0\\0\\0\", 3);\n"
+ "}\n");
+ ASSERT_EQUALS("", errout_str());
+
+ check("int f(const char16_t* buf) {\n"
+ " return memcmp(buf, u\"abc\", 4 * sizeof(char16_t));\n"
+ "}\n");
+ ASSERT_EQUALS("", errout_str());
+ }
+
void buffer_overrun_errorpath() {
setMultiline();
Settings s = settings0;
@@ -4618,9 +4640,8 @@ class TestBufferOverrun : public TestFixture {
check("void f() {\n"
" mymemset(\"abc\", 0, 20);\n"
"}\n", settings);
- TODO_ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds.\n",
- "",
- errout_str());
+ ASSERT_EQUALS("[test.cpp:2:12]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
+ errout_str());
check("void f() {\n"
" mymemset(temp, \"abc\", 4);\n"