File tree Expand file tree Collapse file tree 2 files changed +8
-12
lines changed
cpp/ql/test/query-tests/Critical/OverflowStatic Expand file tree Collapse file tree 2 files changed +8
-12
lines changed Original file line number Diff line number Diff line change 5
5
| test2.c:33:26:33:27 | 46 | Potential buffer-overflow: 'buffer' has size 40 not 46. |
6
6
| test2.c:34:22:34:23 | 47 | Potential buffer-overflow: 'buffer' has size 40 not 47. |
7
7
| test2.c:35:23:35:24 | 48 | Potential buffer-overflow: 'buffer' has size 40 not 48. |
8
- | test.c:14:9:14:13 | access to array | Potential buffer-overflow: 'xs' has size 5 but 'xs[5]' is accessed here. |
9
- | test.c:15:9:15:13 | access to array | Potential buffer-overflow: 'xs' has size 5 but 'xs[6]' is accessed here. |
10
- | test.c:20:9:20:18 | access to array | Potential buffer-overflow: 'ys' has size 5 but 'ys[5]' is accessed here. |
11
- | test.c:21:9:21:18 | access to array | Potential buffer-overflow: 'ys' has size 5 but 'ys[6]' is accessed here. |
12
- | test.c:47:3:47:18 | access to array | Potential buffer-overflow: 'ptr' has size 8 but 'ptr[8]' is accessed here. |
13
- | test.c:54:3:54:26 | access to array | Potential buffer-overflow: 'ptr' has size 8 but 'ptr[8]' is accessed here. |
14
- | test.c:61:3:61:18 | access to array | Potential buffer-overflow: 'ptr' has size 8 but 'ptr[8]' is accessed here. |
15
- | test.c:72:3:72:11 | access to array | Potential buffer-overflow: 'buf' has size 1 but 'buf[1]' is accessed here. |
8
+ | test.c:14:9:14:13 | access to array | Potential buffer-overflow: 'xs' has size 5 but 'xs[5]' may be accessed here. |
9
+ | test.c:15:9:15:13 | access to array | Potential buffer-overflow: 'xs' has size 5 but 'xs[6]' may be accessed here. |
10
+ | test.c:20:9:20:18 | access to array | Potential buffer-overflow: 'ys' has size 5 but 'ys[5]' may be accessed here. |
11
+ | test.c:21:9:21:18 | access to array | Potential buffer-overflow: 'ys' has size 5 but 'ys[6]' may be accessed here. |
16
12
| test.cpp:19:3:19:12 | access to array | Potential buffer-overflow: counter 'i' <= 3 but 'buffer1' has 3 elements. |
17
13
| test.cpp:20:3:20:12 | access to array | Potential buffer-overflow: counter 'i' <= 3 but 'buffer2' has 3 elements. |
18
14
| test.cpp:24:27:24:27 | 4 | Potential buffer-overflow: 'buffer1' has size 3 not 4. |
Original file line number Diff line number Diff line change @@ -44,21 +44,21 @@ void union_test() {
44
44
union u u ;
45
45
u .ptr [0 ] = 0 ; // GOOD
46
46
u .ptr [sizeof (u )- 1 ] = 0 ; // GOOD
47
- u .ptr [sizeof (u )] = 0 ; // BAD
47
+ u .ptr [sizeof (u )] = 0 ; // BAD [NOT DETECTED]
48
48
}
49
49
50
50
void test_struct_union () {
51
51
struct { union u u ; } v ;
52
52
v .u .ptr [0 ] = 0 ; // GOOD
53
53
v .u .ptr [sizeof (union u )-1 ] = 0 ; // GOOD
54
- v .u .ptr [sizeof (union u )] = 0 ; // BAD
54
+ v .u .ptr [sizeof (union u )] = 0 ; // BAD [NOT DETECTED]
55
55
}
56
56
57
57
void union_test2 () {
58
58
union { char ptr [1 ]; unsigned long value ; } u ;
59
59
u .ptr [0 ] = 0 ; // GOOD
60
60
u .ptr [sizeof (u )- 1 ] = 0 ; // GOOD
61
- u .ptr [sizeof (u )] = 0 ; // BAD
61
+ u .ptr [sizeof (u )] = 0 ; // BAD [NOT DETECTED]
62
62
}
63
63
64
64
typedef struct {
@@ -69,5 +69,5 @@ typedef struct {
69
69
void test_alloc () {
70
70
// Special case of taking sizeof without any addition or multiplications
71
71
var_buf * b = malloc (sizeof (var_buf ));
72
- b -> buf [1 ] = 0 ; // BAD
72
+ b -> buf [1 ] = 0 ; // BAD [NOT DETECTED]
73
73
}
You can’t perform that action at this time.
0 commit comments