{

oss << "Array '" << arrayInfo.varname();

for (std::size_t i = 0; i < arrayInfo.num().size(); ++i)

oss << "[" << arrayInfo.num(i) << "]";

if (index.size() == 1)

oss << "' accessed at index " << index[0] << ", which is";

else {

oss << "' index " << arrayInfo.varname();

for (std::size_t i = 0; i < index.size(); ++i)

oss << "[" << index[i] << "]";

}

oss << " out of bounds.";

{

std::ostringstream oss;

makeArrayIndexOutOfBoundsError(oss, arrayInfo, index);

reportError(tok, Severity::error, "arrayIndexOutOfBounds", oss.str());

{

std::ostringstream errmsg;

errmsg << "Array '" << arrayInfo.varname();

for (std::size_t i = 0; i < arrayInfo.num().size(); ++i)

errmsg << "[" << arrayInfo.num(i) << "]";

if (index.size() == 1)

errmsg << "' accessed at index " << index[0].intvalue << ", which is out of bounds.";

else {

errmsg << "' index " << arrayInfo.varname();

for (std::size_t i = 0; i < index.size(); ++i)

errmsg << "[" << index[i].intvalue << "]";

errmsg << " out of bounds.";

}

const Token *condition = nullptr;

for (std::size_t i = 0; i < index.size(); ++i) {

if (condition == nullptr)

condition = index[i].condition;

}

if (condition != nullptr) {

if (!_settings->isEnabled("warning"))

return;

errmsg << " Otherwise condition '" << condition->expressionString() << "' is redundant.";

std::list<const Token *> callstack;

callstack.push_back(tok);

callstack.push_back(condition);

reportError(callstack, Severity::warning, "arrayIndexOutOfBoundsCond", errmsg.str());

} else {

reportError(tok, Severity::error, "arrayIndexOutOfBounds", errmsg.str());

}

{

std::ostringstream oss;

makeArrayIndexOutOfBoundsError(oss, arrayInfo, index);

reportError(callstack, Severity::error, "arrayIndexOutOfBounds", oss.str());

{

varnames.erase(std::remove(varnames.begin(), varnames.end(), ' '), varnames.end());

std::string errmsg("Buffer is accessed out of bounds");

if (!varnames.empty())

errmsg += ": " + varnames;

else

errmsg += ".";

return errmsg;

{

if (cat)

reportError(tok, Severity::warning, "possibleBufferAccessOutOfBounds",

"Possible buffer overflow if strlen(" + src + ") is larger than sizeof(" + dst + ")-strlen(" + dst +").\n"

"Possible buffer overflow if strlen(" + src + ") is larger than sizeof(" + dst + ")-strlen(" + dst +"). "

"The source buffer is larger than the destination buffer so there is the potential for overflowing the destination buffer.");

else

reportError(tok, Severity::warning, "possibleBufferAccessOutOfBounds",

"Possible buffer overflow if strlen(" + src + ") is larger than or equal to sizeof(" + dst + ").\n"

"Possible buffer overflow if strlen(" + src + ") is larger than or equal to sizeof(" + dst + "). "

"The source buffer is larger than the destination buffer so there is the potential for overflowing the destination buffer.");

{

const std::string errmsg = funcname + "() might return the full size of '" + varname + "'. Lower the supplied size by one.\n" +

funcname + "() might return the full size of '" + varname + "'. "

"If a " + varname + "[len] = '\\0'; statement follows, it will overrun the buffer. Lower the supplied size by one.";

reportError(tok, Severity::warning, "possibleReadlinkBufferOverrun", errmsg, true);

{

if (_settings && !_settings->isEnabled("warning"))

return;

reportError(tok, Severity::warning, "strncatUsage",

"Dangerous usage of strncat - 3rd parameter is the maximum number of characters to append.\n"

"At most, strncat appends the 3rd parameter's amount of characters and adds a terminating null byte.\n"

"The safe way to use strncat is to subtract one from the remaining space in the buffer and use it as 3rd parameter."

"Source: http://www.cplusplus.com/reference/cstring/strncat/\n"

"Source: http://www.opensource.apple.com/source/Libc/Libc-167/gen.subproj/i386.subproj/strncat.c");

{

std::ostringstream oss;

oss << what << " is out of bounds";

if (show_size_info)

oss << ": Supplied size " << supplied_size << " is larger than actual size " << actual_size;

oss << '.';

reportError(tok, Severity::error, "outOfBounds", oss.str());

{

// The severity is portability instead of error since this ub doesnt

// cause bad behaviour on most implementations. people create out

// of bounds pointers by intention.

const std::string expr(tok ? tok->expressionString() : std::string(""));

std::string errmsg;

if (index && !index->isNumber()) {

errmsg = "Undefined behaviour, when '" +

index->expressionString() +

"' is " +

MathLib::toString(indexvalue) +

" the pointer arithmetic '" + expr + "' is out of bounds";

} else {

errmsg = "Undefined behaviour, pointer arithmetic '" + expr + "' is out of bounds";

}

std::string verbosemsg(errmsg + ". From chapter 6.5.6 in the C specification:\n"

"\"When an expression that has integer type is added to or subtracted from a pointer, ..\" and then \"If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined.\"");

reportError(tok, Severity::portability, "pointerOutOfBounds", errmsg + ".\n" + verbosemsg);

/*

{

if (_settings && !_settings->isEnabled("warning"))

return;

reportError(tok, Severity::warning, "sizeArgumentAsChar", "The size argument is given as a char constant.");

{

reportError(tok, Severity::warning, "terminateStrncpy",

"The buffer '" + varname + "' may not be null-terminated after the call to strncpy().\n"

"If the source string's size fits or exceeds the given size, strncpy() does not add a "

"zero at the end of the buffer. This causes bugs later in the code if the code "

"assumes buffer is null-terminated.", true);

{

const std::string errmsg = "The buffer '" + varname + "' is not null-terminated after the call to " + function + "().\n"

"The buffer '" + varname + "' is not null-terminated after the call to " + function + "(). "

"This will cause bugs later in the code if the code assumes the buffer is null-terminated.";

reportError(tok, Severity::warning, "bufferNotZeroTerminated", errmsg, true);

{

reportError(tok, Severity::error, "negativeMemoryAllocationSize",

"Memory allocation size is negative.\n"

"Memory allocation size is negative."

"Negative allocation size has no specified behaviour.");

{

const Token* end = tok->linkAt(1)->linkAt(1);

if (Token::simpleMatch(end, "} else {")) // scan the else-block

end = end->linkAt(2);

if (Token::simpleMatch(end, "{")) // Ticket #5203: Invalid code, bailout

return true;

// Used later to check if the body belongs to a "if"

const bool is_if = tok->str() == "if";

for (; tok && tok != end; tok = tok->next()) {

// If scanning a "if" block then bailout for "break"

if (is_if && (tok->str() == "break" || tok->str() == "continue"))

return true;

// bailout for "return"

else if (tok->str() == "return")

return true;

// bailout if varid is found

else if (tok->varId() == varid)

return true;

}

// No bailout stuff found => return false

return false;

{

if (charSizeToken)

*charSizeToken = nullptr;

if (minsizes.empty())

return false;

// All conditions must be true

bool error = true;

for (std::list<Library::ArgumentChecks::MinSize>::const_iterator minsize = minsizes.begin(); minsize != minsizes.end(); ++minsize) {

if (!error)

return false;

error = false;

const Token *argtok = ftok->tokAt(2);

for (int argnum = 1; argtok && argnum < minsize->arg; argnum++)

argtok = argtok->nextArgument();

if (!argtok)

return false;

switch (minsize->type) {

case Library::ArgumentChecks::MinSize::ARGVALUE:

if (Token::Match(argtok, "%num% ,|)")) {

const MathLib::bigint sz = MathLib::toLongNumber(argtok->str());

if ((std::size_t)sz > arraySize)

error = true;

} else if (argtok->type() == Token::eChar && Token::Match(argtok->next(), ",|)") && charSizeToken)

*charSizeToken = argtok; //sizeArgumentAsCharError(argtok);

break;

case Library::ArgumentChecks::MinSize::MUL:

// TODO: handle arbitrary arg2

if (minsize->arg2 == minsize->arg+1 && Token::Match(argtok, "%num% , %num% ,|)")) {

const MathLib::bigint sz = MathLib::toLongNumber(argtok->str()) * MathLib::toLongNumber(argtok->strAt(2));

if ((std::size_t)sz > arraySize)

error = true;

}

break;

case Library::ArgumentChecks::MinSize::STRLEN: {

const Token *strtoken = argtok->getValueTokenMaxStrLength();

if (strtoken && Token::getStrLength(strtoken) >= arraySize)

error = true;

}

break;

case Library::ArgumentChecks::MinSize::SIZEOF:

if (argtok->type() == Token::eString && Token::getStrLength(argtok) >= arraySize)

error = true;

break;

case Library::ArgumentChecks::MinSize::NONE:

return false;

};

}

return error;

{

const std::list<Library::ArgumentChecks::MinSize> * const minsizes = _settings->library.argminsizes(&ftok,par);

if (minsizes && (!(Token::simpleMatch(ftok.previous(), ".") || Token::Match(ftok.tokAt(-2), "!!std ::")))) {

if (arrayInfo.element_size() == 0)

return;

MathLib::bigint arraySize = arrayInfo.element_size();

for (std::size_t i = 0; i < arrayInfo.num().size(); ++i)

arraySize *= arrayInfo.num(i);

const Token *charSizeToken = nullptr;

if (checkMinSizes(*minsizes, &ftok, (std::size_t)arraySize, &charSizeToken))

bufferOverrunError(callstack, arrayInfo.varname());

if (charSizeToken)

sizeArgumentAsCharError(charSizeToken);

}

// Calling a user function?

// only 1-dimensional arrays can be checked currently

else if (arrayInfo.num().size() == 1) {

const Function* const func = ftok.function();

if (func && func->hasBody()) {

// Get corresponding parameter..

const Variable* const parameter = func->getArgumentVar(par-1);

// Ensure that it has a compatible size..

if (!parameter || _tokenizer->sizeOfType(parameter->typeStartToken()) != arrayInfo.element_size())

return;

// No variable id occur for instance when:

// - Variable function arguments: "void f(...)"

// - Unnamed parameter: "void f(char *)"

if (parameter->declarationId() == 0)

return;

// Check the parameter usage in the function scope..

for (const Token* ftok2 = func->functionScope->classStart; ftok2 != func->functionScope->classEnd; ftok2 = ftok2->next()) {

if (Token::Match(ftok2, "if|for|switch|while (")) {

// bailout if there is buffer usage..

if (bailoutIfSwitch(ftok2, parameter->declarationId())) {

break;

}

// no bailout is needed. skip the if-block

else {

// goto end of if block..

ftok2 = ftok2->linkAt(1)->linkAt(1);

if (Token::simpleMatch(ftok2, "} else {"))

ftok2 = ftok2->linkAt(2);

if (!ftok2)

break;

continue;

}

}

if (ftok2->str() == "}")

break;

if (ftok2->varId() == parameter->declarationId()) {

if (Token::Match(ftok2->previous(), "-- %name%") ||

Token::Match(ftok2, "%name% --"))

break;

if (Token::Match(ftok2->previous(), ";|{|}|%op% %name% [ %num% ]")) {

const MathLib::bigint index = MathLib::toLongNumber(ftok2->strAt(2));

if (index >= 0 && arrayInfo.num(0) > 0 && index >= arrayInfo.num(0)) {

std::list<const Token *> callstack2(callstack);

callstack2.push_back(ftok2);

std::vector<MathLib::bigint> indexes;

indexes.push_back(index);

arrayIndexOutOfBoundsError(callstack2, arrayInfo, indexes);

}

}

}

// Calling function..

if (Token::Match(ftok2, "%name% (")) {

ArrayInfo ai(arrayInfo);

ai.declarationId(parameter->declarationId());

checkFunctionCall(ftok2, ai, callstack);

}

}

}

}

// Check 'float x[10]' arguments in declaration

if (_settings->isEnabled("warning")) {

const Function* const func = ftok.function();

// If argument is '%type% a[num]' then check bounds against num

if (func) {

const Variable* const argument = func->getArgumentVar(par-1);

const Token *nameToken;

if (argument && Token::Match(argument->typeStartToken(), "%type% %var% [ %num% ] [,)[]")

&& (nameToken = argument->nameToken()) != nullptr) {

const Token *tok2 = nameToken->next();

MathLib::bigint argsize = _tokenizer->sizeOfType(argument->typeStartToken());

if (argsize == 100) // unknown size

argsize = 0;

while (Token::Match(tok2, "[ %num% ] [,)[]")) {

argsize *= MathLib::toLongNumber(tok2->strAt(1));

tok2 = tok2->tokAt(3);

}

MathLib::bigint arraysize = arrayInfo.element_size();

if (arraysize == 100) // unknown size

arraysize = 0;

for (std::size_t i = 0; i < arrayInfo.num().size(); i++)

arraysize *= arrayInfo.num(i);

if (Token::Match(tok2, "[,)]") && arraysize > 0 && argsize > arraysize)

argumentSizeError(&ftok, ftok.str(), arrayInfo.varname());

}

}

}

{

// Don't go deeper than 2 levels, the checking can get very slow

// when there is no limit

if (callstack.size() >= 2)

return;

// Prevent recursion

for (std::list<const Token*>::const_iterator it = callstack.begin(); it != callstack.end(); ++it) {

// Same function name => bail out

if (tok->str() == (*it)->str())

return;

}

callstack.push_back(tok);

const unsigned int declarationId = arrayInfo.declarationId();

const Token *tok2 = tok->tokAt(2);

// 1st parameter..

if (Token::Match(tok2, "%varid% ,|)", declarationId))

checkFunctionParameter(*tok, 1, arrayInfo, callstack);

else if (Token::Match(tok2, "%varid% + %num% ,|)", declarationId)) {

const ArrayInfo ai(arrayInfo.limit(MathLib::toLongNumber(tok2->strAt(2))));

checkFunctionParameter(*tok, 1, ai, callstack);

}

// goto 2nd parameter and check it..

tok2 = tok2->nextArgument();

if (Token::Match(tok2, "%varid% ,|)", declarationId))

checkFunctionParameter(*tok, 2, arrayInfo, callstack);

else if (Token::Match(tok2, "%varid% + %num% ,|)", declarationId)) {

const ArrayInfo ai(arrayInfo.limit(MathLib::toLongNumber(tok2->strAt(2))));

checkFunctionParameter(*tok, 2, ai, callstack);

}

{

const MathLib::bigint size = arrayInfo.num(0);

if (size == 0) // unknown size

return;

if (tok->str() == "return") {

tok = tok->next();

if (!tok)

return;

}

const MathLib::bigint total_size = arrayInfo.element_size() * size;

const unsigned int declarationId = arrayInfo.declarationId();

std::string varnames;

for (std::size_t i = 0; i < varname.size(); ++i)

varnames += (i == 0 ? "" : " . ") + varname[i];

const unsigned char varcount = static_cast<unsigned char>(varname.empty() ? 0U : (varname.size() - 1) * 2U);

// ValueFlow array index..

if ((declarationId > 0 && Token::Match(tok, "%varid% [", declarationId)) ||

(declarationId == 0 && Token::Match(tok, (varnames + " [").c_str()))) {

const Token *tok2 = tok;

while (tok2->str() != "[")

tok2 = tok2->next();

valueFlowCheckArrayIndex(tok2, arrayInfo);

}

// If the result of pointer arithmetic means that the pointer is

// out of bounds then this flag will be set.

bool pointerIsOutOfBounds = false;

const bool isPortabilityEnabled = _settings->isEnabled("portability");

for (const Token* const end = tok->scope()->classEnd; tok && tok != end; tok = tok->next()) {

if (declarationId != 0 && Token::Match(tok, "%varid% = new|malloc|realloc", declarationId)) {

// Abort

break;

}

// reassign buffer

if (declarationId > 0 && Token::Match(tok, "[;{}] %varid% = %any%", declarationId)) {

// using varid .. bailout

if (tok->tokAt(3)->varId() != declarationId)

break;

pointerIsOutOfBounds = false;

}

// Array index..

if ((declarationId > 0 && ((tok->str() == "return" || (!tok->isName() && !Token::Match(tok, "[.&]"))) && Token::Match(tok->next(), "%varid% [", declarationId))) ||

(declarationId == 0 && ((tok->str() == "return" || (!tok->isName() && !Token::Match(tok, "[.&]"))) && (Token::Match(tok->next(), (varnames + " [").c_str()) || Token::Match(tok->next(), (varname[0] +" [ %num% ] . " + varname[1] + " [ %num% ]").c_str()))))) {

std::vector<MathLib::bigint> indexes;

const Token *tok2 = tok->tokAt(2 + varcount);

for (; Token::Match(tok2, "[ %num% ]"); tok2 = tok2->tokAt(3)) {

const MathLib::bigint index = MathLib::toLongNumber(tok2->strAt(1));

indexes.push_back(index);

}

for (; Token::Match(tok2->tokAt(3), "[ %num% ]"); tok2 = tok2->tokAt(3)) {

const MathLib::bigint index = MathLib::toLongNumber(tok2->strAt(4));

indexes.push_back(index);

}

if (indexes.empty() && arrayInfo.num().size() == 1U && Token::simpleMatch(tok2, "[") && tok2->astOperand2()) {

const ValueFlow::Value *value = tok2->astOperand2()->getMaxValue(false);

if (value) {

indexes.push_back(value->intvalue);

}

}

if (indexes.size() == arrayInfo.num().size()) {

// Check if the indexes point outside the whole array..

// char a[10][10];

// a[0][20] <-- ok.

// a[9][20] <-- error.

// total number of elements of array..

MathLib::bigint totalElements = 1;

// total index..

MathLib::bigint totalIndex = 0;

// calculate the totalElements and totalIndex..

for (std::size_t i = 0; i < indexes.size(); ++i) {

const std::size_t ri = indexes.size() - 1 - i;

totalIndex += indexes[ri] * totalElements;

totalElements *= arrayInfo.num(ri);

if (arrayInfo.num(ri) == -1) {

// unknown size

totalElements = 0;

break;

}

}

// totalElements == 0 => Unknown size

if (totalElements == 0)

continue;

const Token *tok3 = tok->previous();

while (tok3 && Token::Match(tok3->previous(), "%name% ."))

tok3 = tok3->tokAt(-2);

// taking address of 1 past end?

if (totalIndex == totalElements) {

const bool addr = (tok3 && (tok3->str() == "&" ||

Token::simpleMatch(tok3->previous(), "& (")));

if (addr)

continue;

}

// Is totalIndex in bounds?

if (totalIndex > totalElements || totalIndex < 0) {

arrayIndexOutOfBoundsError(tok->tokAt(1 + varcount), arrayInfo, indexes);

}

// Is any array index out of bounds?

else {

// check each index for overflow

for (std::size_t i = 0; i < indexes.size(); ++i) {

if (indexes[i] >= arrayInfo.num(i)) {

if (indexes.size() == 1U) {

arrayIndexOutOfBoundsError(tok->tokAt(1 + varcount), arrayInfo, indexes);

break; // only warn about the first one

}

// The access is still within the memory range for the array

// so it may be intentional.

else if (_settings->inconclusive) {

arrayIndexOutOfBoundsError(tok->tokAt(1 + varcount), arrayInfo, indexes);

break; // only warn about the first one

}

}

}

}

}

tok = tok2;

continue;

}

// memset, memcmp, memcpy, strncpy, fgets..

if (declarationId == 0 && size > 0) {

std::list<const Token *> callstack;

callstack.push_back(tok);

if (Token::Match(tok, ("%name% ( " + varnames + " ,").c_str()))

checkFunctionParameter(*tok, 1, arrayInfo, callstack);

if (Token::Match(tok, ("%name% ( %name% , " + varnames + " ,").c_str()))

checkFunctionParameter(*tok, 2, arrayInfo, callstack);

}

if (total_size > 0) {

// Writing data into array..

if ((declarationId > 0 && Token::Match(tok, "strcpy|strcat ( %varid% , %str% )", declarationId)) ||

(declarationId == 0 && Token::Match(tok, ("strcpy|strcat ( " + varnames + " , %str% )").c_str()))) {

const std::size_t len = Token::getStrLength(tok->tokAt(varcount + 4));

if (len >= (unsigned int)total_size) {

bufferOverrunError(tok, declarationId > 0 ? emptyString : varnames);

continue;

}

} else if ((declarationId > 0 && Token::Match(tok, "strcpy|strcat ( %varid% , %var% )", declarationId)) ||

(declarationId == 0 && Token::Match(tok, ("strcpy|strcat ( " + varnames + " , %var% )").c_str()))) {

const Variable *var = tok->tokAt(varcount + 4)->variable();

if (var && var->isArray() && var->dimensions().size() == 1) {

const std::size_t len = (std::size_t)var->dimension(0);

if (len > (unsigned int)total_size) {

if (_settings->inconclusive)

possibleBufferOverrunError(tok, tok->strAt(4), tok->strAt(2), tok->str() == "strcat");

continue;

}

}

}

// Detect few strcat() calls

const std::string strcatPattern = declarationId > 0 ? std::string("strcat ( %varid% , %str% ) ;") : ("strcat ( " + varnames + " , %str% ) ;");

if (Token::Match(tok, strcatPattern.c_str(), declarationId)) {

std::size_t charactersAppend = 0;

const Token *tok2 = tok;

while (Token::Match(tok2, strcatPattern.c_str(), declarationId)) {

charactersAppend += Token::getStrLength(tok2->tokAt(4 + varcount));

if (charactersAppend >= static_cast<std::size_t>(total_size)) {

bufferOverrunError(tok2);

break;

}

tok2 = tok2->tokAt(7 + varcount);

}

}

// sprintf..

const std::string sprintfPattern = declarationId > 0 ? std::string("sprintf ( %varid% , %str% [,)]") : ("sprintf ( " + varnames + " , %str% [,)]");

if (Token::Match(tok, sprintfPattern.c_str(), declarationId)) {

checkSprintfCall(tok, static_cast<unsigned int>(total_size));

}

// snprintf..

const std::string snprintfPattern = declarationId > 0 ? std::string("snprintf ( %varid% , %num% ,") : ("snprintf ( " + varnames + " , %num% ,");

if (Token::Match(tok, snprintfPattern.c_str(), declarationId)) {

const MathLib::bigint n = MathLib::toLongNumber(tok->strAt(4 + varcount));

if (n > total_size)

outOfBoundsError(tok->tokAt(4 + varcount), "snprintf size", true, n, total_size);

}

// Check function call..

if (Token::Match(tok, "%name% (")) {

// No varid => function calls are not handled

if (declarationId == 0)

continue;

const ArrayInfo arrayInfo1(declarationId, varnames, total_size / size, size);

const std::list<const Token *> callstack;

checkFunctionCall(tok, arrayInfo1, callstack);

}

}

// undefined behaviour: result of pointer arithmetic is out of bounds

if (declarationId && Token::Match(tok, "= %varid% + %num% ;", declarationId)) {

const MathLib::bigint index = MathLib::toLongNumber(tok->strAt(3));

if (isPortabilityEnabled && index > size)

pointerOutOfBoundsError(tok->tokAt(2));

if (index >= size && Token::Match(tok->tokAt(-2), "[;{}] %varid% =", declarationId))

pointerIsOutOfBounds = true;

}

else if (pointerIsOutOfBounds && Token::Match(tok, "[;{}=] * %varid% [;=]", declarationId)) {

outOfBoundsError(tok->tokAt(2), tok->strAt(2), false, 0, 0);

}

}

{

// Declaration in global scope or namespace?

if (tok->scope()->type == Scope::eGlobal || tok->scope()->type == Scope::eNamespace)

return;

/*

// Taking address?

bool addressOf = false;

{

const Token *tok2 = tok->astParent();

while (Token::Match(tok2, "%name%|.|::|["))

tok2 = tok2->astParent();

addressOf = tok2 && tok2->str() == "&" && !(tok2->astOperand1() && tok2->astOperand2());

}

// Look for errors first

for (int warn = 0; warn == 0 || warn == 1; ++warn) {

// Negative index..

for (const Token *tok2 = tok; tok2 && tok2->str() == "["; tok2 = tok2->link()->next()) {

const Token *index = tok2->astOperand2();

if (!index)

continue;

const ValueFlow::Value *value = index->getValueLE(-1LL,_settings);

if (value)

negativeIndexError(index, *value);

}

// Index out of bounds..

std::vector<ValueFlow::Value> indexes;

unsigned int valuevarid = 0;

for (const Token *tok2 = tok; indexes.size() < arrayInfo.num().size() && Token::Match(tok2, "["); tok2 = tok2->link()->next()) {

if (!tok2->astOperand2()) {

indexes.clear();

break;

}

const ValueFlow::Value *value = tok2->astOperand2()->getMaxValue(warn == 1);

if (!value) {

indexes.clear();

break;

}

if (valuevarid == 0U)

valuevarid = value->varId;

if (value->varId > 0 && valuevarid != value->varId) {

indexes.clear();

break;

}

if (value->intvalue < 0) {

indexes.clear();

break;

}

indexes.push_back(*value);

}

if (indexes.size() == arrayInfo.num().size()) {

// Check if the indexes point outside the whole array..

// char a[10][10];

// a[0][20] <-- ok.

// a[9][20] <-- error.

// total number of elements of array..

MathLib::bigint totalElements = 1;

// total index..

MathLib::bigint totalIndex = 0;

// calculate the totalElements and totalIndex..

for (std::size_t i = 0; i < indexes.size(); ++i) {

const std::size_t ri = indexes.size() - 1 - i;

totalIndex += indexes[ri].intvalue * totalElements;

totalElements *= arrayInfo.num(ri);

}

// totalElements <= 0 => Unknown size

if (totalElements <= 0)

continue;

// taking address of 1 past end?

if (addressOf && totalIndex == totalElements)

continue;

// Is totalIndex in bounds?

if (totalIndex >= totalElements) {

arrayIndexOutOfBoundsError(tok, arrayInfo, indexes);

break;

}

// Is any array index out of bounds?

else {

// check each index for overflow

for (std::size_t i = 0; i < indexes.size(); ++i) {

if (indexes[i].intvalue >= arrayInfo.num(i)) {

// The access is still within the memory range for the array

// so it may be intentional.

if (_settings->inconclusive) {

arrayIndexOutOfBoundsError(tok, arrayInfo, indexes);

break; // only warn about the first one

}

}

}

}

}

}

{

const MathLib::bigint total_size = arrayInfo.num(0) * arrayInfo.element_size();

const Token *scope_begin = tok->previous();

assert(scope_begin != 0);

const unsigned int declarationId = arrayInfo.declarationId();

const bool isPortabilityEnabled = _settings->isEnabled("portability");

const bool isWarningEnabled = _settings->isEnabled("warning");

bool reassigned = false;

for (const Token* const end = tok->scope()->classEnd; tok != end; tok = tok->next()) {

if (reassigned && tok->str() == ";")

break;

if (tok->varId() == declarationId) {

if (tok->strAt(1) == "=") {

reassigned = true;

}

else if (tok->strAt(1) == "[") {

valueFlowCheckArrayIndex(tok->next(), arrayInfo);

}

else if (isPortabilityEnabled && !tok->isCast() && tok->astParent() && tok->astParent()->str() == "+") {

// undefined behaviour: result of pointer arithmetic is out of bounds

const Token *index;

if (tok == tok->astParent()->astOperand1())

index = tok->astParent()->astOperand2();

else

index = tok->astParent()->astOperand1();

if (index) {

const ValueFlow::Value *value = index->getValueGE(arrayInfo.num(0) + 1U, _settings);

if (!value)

value = index->getValueLE(-1, _settings);

if (value)

pointerOutOfBoundsError(tok->astParent(), index, value->intvalue);

}

}

else if (isPortabilityEnabled && tok->astParent() && tok->astParent()->str() == "-") {

const Variable *var = _tokenizer->getSymbolDatabase()->getVariableFromVarId(declarationId);

if (var && var->isArray()) {

const Token *index = tok->astParent()->astOperand2();

const ValueFlow::Value *value = index ? index->getValueGE(1,_settings) : nullptr;

if (index && !value)

value = index->getValueLE(-1 - arrayInfo.num(0), _settings);

if (value)

pointerOutOfBoundsError(tok->astParent(), index, value->intvalue);

}

}

}

else if (!tok->scope()->isExecutable()) // No executable code outside of executable scope - continue to increase performance

continue;

else if (Token::Match(tok, "%name% (")) {

// Check function call..

checkFunctionCall(tok, arrayInfo, std::list<const Token*>());

if (_settings->inconclusive && Token::Match(tok, "strncpy|memcpy|memmove ( %varid% , %str% , %num% )", declarationId)) {

if (Token::getStrLength(tok->tokAt(4)) >= (unsigned int)total_size) {

const unsigned int num = (unsigned int)MathLib::toLongNumber(tok->strAt(6));

if ((unsigned int)total_size == num)

bufferNotZeroTerminatedError(tok, tok->strAt(2), tok->str());

}

}

if ((Token::Match(tok, "strncpy|strncat ( %varid% ,", declarationId) && Token::Match(tok->linkAt(1)->tokAt(-2), ", %num% )"))) {

const Token* param3 = tok->linkAt(1)->previous();

// check for strncpy which is not terminated

if (tok->str() == "strncpy") {

// strncpy takes entire variable length as input size

unsigned int num = (unsigned int)MathLib::toLongNumber(param3->str());

// this is currently 'inconclusive'. See TestBufferOverrun::terminateStrncpy3

if (isWarningEnabled && num >= total_size && _settings->inconclusive) {

const Token *tok2 = tok->next()->link()->next();

for (; tok2; tok2 = tok2->next()) {

const Token* tok3 = tok->tokAt(2);

if (tok2->varId() == tok3->varId()) {

if (!Token::Match(tok2, "%varid% [ %any% ] = 0 ;", tok3->varId())) {

terminateStrncpyError(tok, tok3->str());

}

break;

}

}

}

}

// Dangerous usage of strncat..

else if (tok->str() == "strncat") {

const MathLib::bigint n = MathLib::toLongNumber(param3->str());

if (n >= total_size)

strncatUsageError(tok);

}

// Dangerous usage of strncpy + strncat..

if (Token::Match(param3->tokAt(2), "; strncat ( %varid% ,", declarationId) && Token::Match(param3->linkAt(4)->tokAt(-2), ", %num% )")) {

const MathLib::bigint n = MathLib::toLongNumber(param3->str()) + MathLib::toLongNumber(param3->linkAt(4)->strAt(-1));

if (n > total_size)

strncatUsageError(param3->tokAt(3));

}

}

// Writing data into array..

if (total_size > 0 && Token::Match(tok, "strcpy|strcat ( %varid% , %str% )", declarationId)) {

const std::size_t len = Token::getStrLength(tok->tokAt(4));

if (len >= (unsigned int)total_size) {

bufferOverrunError(tok, arrayInfo.varname());

continue;

}

}

// Detect few strcat() calls

if (total_size > 0 && Token::Match(tok, "strcat ( %varid% , %str% ) ;", declarationId)) {

std::size_t charactersAppend = 0;

const Token *tok2 = tok;

while (tok2 && Token::Match(tok2, "strcat ( %varid% , %str% ) ;", declarationId)) {

charactersAppend += Token::getStrLength(tok2->tokAt(4));

if (charactersAppend >= (unsigned int)total_size) {

bufferOverrunError(tok2, arrayInfo.varname());

break;

}

tok2 = tok2->tokAt(7);

}

}

if (Token::Match(tok, "sprintf ( %varid% , %str% [,)]", declarationId)) {

checkSprintfCall(tok, total_size);

}

// snprintf..

if (total_size > 0 && Token::Match(tok, "snprintf ( %varid% , %num% ,", declarationId)) {

const MathLib::bigint n = MathLib::toLongNumber(tok->strAt(4));

if (n > total_size)

outOfBoundsError(tok->tokAt(4), "snprintf size", true, n, total_size);

}

// readlink() / readlinkat() buffer usage

if (_settings->standards.posix && Token::Match(tok, "readlink|readlinkat ("))

checkReadlinkBufferUsage(tok, scope_begin, declarationId, total_size);

}

}