Fixed cppcheck-opensource#7831 (false-positive: terminateStrncpy)

danmar · danmar · commit a61f4e9c94ab · 2016-11-24T07:04:58.000+01:00
diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
@@ -987,10 +987,12 @@ void CheckBufferOverrun::checkScope_inner(const Token *tok, const ArrayInfo &arr
                     for (; tok4; tok4 = tok4->next()) {
                         const Token* tok3 = tok2->tokAt(2);
                         if (tok4->varId() == tok3->varId()) {
-                            if (!Token::Match(tok4, "%varid% [ %any% ] = 0 ;", tok3->varId())) {
+                            const Token *eq = nullptr;
+                            if (Token::Match(tok4, "%varid% [", tok3->varId()) && Token::simpleMatch(tok4->linkAt(1), "] ="))
+                                eq = tok4->linkAt(1)->next();
+                            const Token *rhs = eq ? eq->astOperand2() : nullptr;
+                            if (!(rhs && rhs->hasKnownIntValue() && rhs->getValue(0)))
                                 terminateStrncpyError(tok2, tok3->str());
-                            }
-
                             break;
                         }
                     }
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -3431,6 +3431,20 @@ class TestBufferOverrun : public TestFixture {
               "}");
         ASSERT_EQUALS("[test.cpp:3]: (warning, inconclusive) The buffer 'baz' may not be null-terminated after the call to strncpy().\n", errout.str());
 
+        check("void foo ( char *bar ) {\n"
+              "    char baz[100];\n"
+              "    strncpy(baz, bar, 100);\n"
+              "    baz[99] = '\\0';\n"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+
+        check("void foo ( char *bar ) {\n"
+              "    char baz[100];\n"
+              "    strncpy(baz, bar, 100);\n"
+              "    baz[x+1] = '\\0';\n"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+
         // Test with invalid code that there is no segfault
         check("char baz[100];\n"
               "strncpy(baz, \"var\", 100)\n");
