@@ -674,23 +674,25 @@ void CheckBufferOverrun::checkScope(const Token *tok, const std::vector<std::str
674674
675675 if (total_size > 0 ) {
676676 // Writing data into array..
677- if ((declarationId > 0 && Token::Match (tok, " strcpy|strcat ( %varid% , %str% )" , declarationId)) ||
678- (declarationId == 0 && Token::Match (tok, (" strcpy|strcat ( " + varnames + " , %str% )" ).c_str ()))) {
679- const std::size_t len = Token::getStrLength (tok->tokAt (varcount + 4 ));
680- if (len >= (unsigned int )total_size) {
681- bufferOverrunError (tok, declarationId > 0 ? emptyString : varnames);
682- continue ;
683- }
684- } else if ((declarationId > 0 && Token::Match (tok, " strcpy|strcat ( %varid% , %var% )" , declarationId)) ||
685- (declarationId == 0 && Token::Match (tok, (" strcpy|strcat ( " + varnames + " , %var% )" ).c_str ()))) {
686- const Variable *var = tok->tokAt (varcount + 4 )->variable ();
687- if (var && var->isArray () && var->dimensions ().size () == 1 ) {
688- const MathLib::bigint len = var->dimension (0 );
689- if (len > total_size) {
690- if (printInconclusive)
691- possibleBufferOverrunError (tok, tok->strAt (4 ), tok->strAt (2 ), tok->str () == " strcat" );
677+ if ((declarationId > 0 && Token::Match (tok, " strcpy|strcat ( %varid% , %str%|%var% )" , declarationId)) ||
678+ (declarationId == 0 && Token::Match (tok, (" strcpy|strcat ( " + varnames + " , %str%|%var% )" ).c_str ()))) {
679+ const Token* lastParamTok = tok->tokAt (varcount + 4 );
680+ if (lastParamTok->tokType () == Token::Type::eString) {
681+ const std::size_t len = Token::getStrLength (lastParamTok);
682+ if (len >= (unsigned int )total_size) {
683+ bufferOverrunError (tok, declarationId > 0 ? emptyString : varnames);
692684 continue ;
693685 }
686+ } else {
687+ const Variable *var = lastParamTok->variable ();
688+ if (var && var->isArray () && var->dimensions ().size () == 1 ) {
689+ const MathLib::bigint len = var->dimension (0 );
690+ if (len > total_size) {
691+ if (printInconclusive)
692+ possibleBufferOverrunError (tok, tok->strAt (4 ), tok->strAt (2 ), tok->str () == " strcat" );
693+ continue ;
694+ }
695+ }
694696 }
695697 }
696698
0 commit comments