Fix #9788 ctu: false negative array index out of bounds for array arguments (cppcheck-opensource#4277)

chrchr-github · web-flow · commit 6eab3cb8bdaa · 2022-07-13T21:08:51.000+02:00
diff --git a/lib/ctu.cpp b/lib/ctu.cpp
@@ -439,7 +439,7 @@ static std::list<std::pair<const Token *, MathLib::bigint>> getUnsafeFunction(co
 {
     std::list<std::pair<const Token *, MathLib::bigint>> ret;
     const Variable * const argvar = scope->function->getArgumentVar(argnr);
-    if (!argvar->isPointer() && !argvar->isReference())
+    if (!argvar->isArrayOrPointer() && !argvar->isReference())
         return ret;
     for (const Token *tok2 = scope->bodyStart; tok2 != scope->bodyEnd; tok2 = tok2->next()) {
         if (Token::Match(tok2, ")|else {")) {
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -5058,6 +5058,18 @@ class TestBufferOverrun : public TestFixture {
             "    get_mac_address(macstrbuf);\n"
             "}");
         ASSERT_EQUALS("", errout.str());
+
+        // #9788
+        ctu("void f1(char *s) { s[2] = 'B'; }\n"
+            "void f2(char s[]) { s[2] = 'B'; }\n"
+            "void g() {\n"
+            "    char str[2];\n"
+            "    f1(str);\n"
+            "    f2(str);\n"
+            "}\n");
+        ASSERT_EQUALS("[test.cpp:5] -> [test.cpp:1]: (error) Array index out of bounds; 's' buffer size is 2 and it is accessed at offset 2.\n"
+                      "[test.cpp:6] -> [test.cpp:2]: (error) Array index out of bounds; 's' buffer size is 2 and it is accessed at offset 2.\n",
+                      errout.str());
     }
 
     void ctu_variable() {

Original file line number	Diff line number	Diff line change
`@@ -439,7 +439,7 @@ static std::list<std::pair<const Token *, MathLib::bigint>> getUnsafeFunction(co`
`439`	`439`	`{`
`440`	`440`	`std::list<std::pair<const Token *, MathLib::bigint>> ret;`
`441`	`441`	`const Variable * const argvar = scope->function->getArgumentVar(argnr);`
`442`		`- if (!argvar->isPointer() && !argvar->isReference())`
	`442`	`+ if (!argvar->isArrayOrPointer() && !argvar->isReference())`
`443`	`443`	`return ret;`
`444`	`444`	`for (const Token *tok2 = scope->bodyStart; tok2 != scope->bodyEnd; tok2 = tok2->next()) {`
`445`	`445`	`if (Token::Match(tok2, ")\|else {")) {`