Fix #14948 FP bufferAccessOutOfBounds after container size check (#8763)

chrchr-github · web-flow · web-flow · commit b1b7e3ccb5e1 · 2026-08-10T09:03:31.000+02:00
Co-authored-by: chrchr-github &lt;noreply@github.com&gt;
diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
@@ -68,7 +68,9 @@ static const ValueFlow::Value *getBufferSizeValue(const Token *tok)
     auto it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), std::mem_fn(&ValueFlow::Value::isBufferSizeValue));
     if (it != tokenValues.cend())
         return &*it;
-    it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), std::mem_fn(&ValueFlow::Value::isContainerSizeValue));
+    it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), [](const ValueFlow::Value& v) {
+        return v.isContainerSizeValue() && !v.isImpossible();
+    });
     return it == tokenValues.cend() ? nullptr : &*it;
 }
 
@@ -597,6 +599,8 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons
                     ValueFlow::Value bufSizeVal;
                     bufSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE;
                     bufSizeVal.intvalue = value->intvalue * elementSize;
+                    bufSizeVal.valueKind = value->valueKind;
+                    bufSizeVal.errorPath = value->errorPath;
                     return bufSizeVal;
                 }
             }
@@ -730,7 +734,10 @@ void CheckBufferOverrunImpl::bufferOverflow()
 
 void CheckBufferOverrunImpl::bufferOverflowError(const Token *tok, const ValueFlow::Value *value, Certainty certainty)
 {
-    reportError(getErrorPath(tok, value, "Buffer overrun"), Severity::error, "bufferAccessOutOfBounds", "Buffer is accessed out of bounds: " + (tok ? getRealBufferTok(tok)->expressionString() : "buf"), CWE_BUFFER_OVERRUN, certainty);
+    const auto errorPath = getErrorPath(tok, value, "Buffer overrun");
+    const auto severity = !value || value->isKnown() ? Severity::error : Severity::warning;
+    const std::string msg = "Buffer is accessed out of bounds: " + (tok ? getRealBufferTok(tok)->expressionString() : "buf");
+    reportError(errorPath, severity, "bufferAccessOutOfBounds", msg, CWE_BUFFER_OVERRUN, certainty);
 }
 
 //---------------------------------------------------------------------------
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -3628,6 +3628,14 @@ class TestBufferOverrun : public TestFixture {
               "        memset(&a[i], 0, sizeof(a));\n"
               "}\n");
         ASSERT_EQUALS("[test.cpp:4:16]: (error) Buffer is accessed out of bounds: &a[i] [bufferAccessOutOfBounds]\n", errout_str());
+
+        check("void f(const std::vector<uint8_t>& s) {\n" // #14948
+              "    if (s.size() < 4)\n"
+              "        return;\n"
+              "    uint32_t u = 0;\n"
+              "    std::memcpy(&u, &s[0], sizeof(u));\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str());
     }
 
     void buffer_overrun_errorpath() {
@@ -3642,6 +3650,15 @@ class TestBufferOverrun : public TestFixture {
         ASSERT_EQUALS("[test.cpp:3:12]: error: Buffer is accessed out of bounds: p [bufferAccessOutOfBounds]\n"
                       "[test.cpp:2:13]: note: Assign p, buffer with size 10\n"
                       "[test.cpp:3:12]: note: Buffer overrun\n", errout_str());
+
+        check("void f(const std::vector<uint8_t>& s) {\n"
+              "    if (s.size() == 2) {}\n"
+              "    uint32_t u = 0;\n"
+              "    std::memcpy(&u, &s[0], sizeof(u));\n"
+              "}\n", s);
+        ASSERT_EQUALS("[test.cpp:4:21]: warning: Buffer is accessed out of bounds: &s[0] [bufferAccessOutOfBounds]\n"
+                      "[test.cpp:2:18]: note: Assuming that condition 's.size()==2' is not redundant\n"
+                      "[test.cpp:4:21]: note: Buffer overrun\n", errout_str());
     }
 
     void buffer_overrun_bailoutIfSwitch() {

Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,9 @@ static const ValueFlow::Value getBufferSizeValue(const Token tok)`
`68`	`68`	`auto it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), std::mem_fn(&ValueFlow::Value::isBufferSizeValue));`
`69`	`69`	`if (it != tokenValues.cend())`
`70`	`70`	`return &*it;`
`71`		`- it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), std::mem_fn(&ValueFlow::Value::isContainerSizeValue));`
	`71`	`+ it = std::find_if(tokenValues.cbegin(), tokenValues.cend(), [](const ValueFlow::Value& v) {`
	`72`	`+ return v.isContainerSizeValue() && !v.isImpossible();`
	`73`	`+ });`
`72`	`74`	`return it == tokenValues.cend() ? nullptr : &*it;`
`73`	`75`	`}`
`74`	`76`
`@@ -597,6 +599,8 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons`
`597`	`599`	`ValueFlow::Value bufSizeVal;`
`598`	`600`	`bufSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE;`
`599`	`601`	`bufSizeVal.intvalue = value->intvalue * elementSize;`
	`602`	`+ bufSizeVal.valueKind = value->valueKind;`
	`603`	`+ bufSizeVal.errorPath = value->errorPath;`
`600`	`604`	`return bufSizeVal;`
`601`	`605`	`}`
`602`	`606`	`}`
`@@ -730,7 +734,10 @@ void CheckBufferOverrunImpl::bufferOverflow()`
`730`	`734`
`731`	`735`	`void CheckBufferOverrunImpl::bufferOverflowError(const Token tok, const ValueFlow::Value value, Certainty certainty)`
`732`	`736`	`{`
`733`		`- reportError(getErrorPath(tok, value, "Buffer overrun"), Severity::error, "bufferAccessOutOfBounds", "Buffer is accessed out of bounds: " + (tok ? getRealBufferTok(tok)->expressionString() : "buf"), CWE_BUFFER_OVERRUN, certainty);`
	`737`	`+ const auto errorPath = getErrorPath(tok, value, "Buffer overrun");`
	`738`	`+ const auto severity = !value \|\| value->isKnown() ? Severity::error : Severity::warning;`
	`739`	`+ const std::string msg = "Buffer is accessed out of bounds: " + (tok ? getRealBufferTok(tok)->expressionString() : "buf");`
	`740`	`+ reportError(errorPath, severity, "bufferAccessOutOfBounds", msg, CWE_BUFFER_OVERRUN, certainty);`
`734`	`741`	`}`
`735`	`742`
`736`	`743`	`//---------------------------------------------------------------------------`