/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2025 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "checkstl.h"

#include "errortypes.h"

#include "fixture.h"

#include "helpers.h"

#include "settings.h"

#include "standards.h"

#include "utils.h"

#include <cstddef>

#include <string>

class TestStl : public TestFixture {

public:

TestStl() : TestFixture("TestStl") {}

private:

/*const*/ Settings settings = settingsBuilder().severity(Severity::warning).severity(Severity::style).severity(Severity::performance).library("std.cfg").build();

void run() override {

mNewTemplate = true;

TEST_CASE(outOfBounds);

TEST_CASE(outOfBoundsSymbolic);

TEST_CASE(outOfBoundsIndexExpression);

TEST_CASE(outOfBoundsIterator);

TEST_CASE(iterator1);

TEST_CASE(iterator2);

TEST_CASE(iterator3);

TEST_CASE(iterator4);

TEST_CASE(iterator5);

TEST_CASE(iterator6);

TEST_CASE(iterator7);

TEST_CASE(iterator8);

TEST_CASE(iterator9);

TEST_CASE(iterator10);

TEST_CASE(iterator11);

TEST_CASE(iterator12);

TEST_CASE(iterator13);

TEST_CASE(iterator14); // #8191

TEST_CASE(iterator15); // #8341

TEST_CASE(iterator16);

TEST_CASE(iterator17);

TEST_CASE(iterator18);

TEST_CASE(iterator19);

TEST_CASE(iterator20);

TEST_CASE(iterator21);

TEST_CASE(iterator22);

TEST_CASE(iterator23);

TEST_CASE(iterator24);

TEST_CASE(iterator25); // #9742

TEST_CASE(iterator26); // #9176

TEST_CASE(iterator27); // #10378

TEST_CASE(iterator28); // #10450

TEST_CASE(iterator29);

TEST_CASE(iterator30);

TEST_CASE(iterator31);

TEST_CASE(iteratorExpression);

TEST_CASE(iteratorSameExpression);

TEST_CASE(mismatchingContainerIterator);

TEST_CASE(eraseIteratorOutOfBounds);

TEST_CASE(dereference);

TEST_CASE(dereference_break); // #3644 - handle "break"

TEST_CASE(dereference_member);

TEST_CASE(STLSize);

TEST_CASE(STLSizeNoErr);

TEST_CASE(negativeIndex);

TEST_CASE(negativeIndexMultiline);

TEST_CASE(erase1);

TEST_CASE(erase2);

TEST_CASE(erase3);

TEST_CASE(erase4);

TEST_CASE(erase5);

TEST_CASE(erase6);

TEST_CASE(eraseBreak);

TEST_CASE(eraseContinue);

TEST_CASE(eraseReturn1);

TEST_CASE(eraseReturn2);

TEST_CASE(eraseReturn3);

TEST_CASE(eraseGoto);

TEST_CASE(eraseAssign1);

TEST_CASE(eraseAssign2);

TEST_CASE(eraseAssign3);

TEST_CASE(eraseAssign4);

TEST_CASE(eraseAssignByFunctionCall);

TEST_CASE(eraseErase);

TEST_CASE(eraseByValue);

TEST_CASE(eraseIf);

TEST_CASE(eraseOnVector);

TEST_CASE(pushback1);

TEST_CASE(pushback2);

TEST_CASE(pushback3);

TEST_CASE(pushback4);

TEST_CASE(pushback5);

TEST_CASE(pushback6);

TEST_CASE(pushback7);

TEST_CASE(pushback8);

TEST_CASE(pushback9);

TEST_CASE(pushback10);

TEST_CASE(pushback11);

TEST_CASE(pushback12);

TEST_CASE(pushback13);

TEST_CASE(insert1);

TEST_CASE(insert2);

TEST_CASE(popback1);

TEST_CASE(stlBoundaries1);

TEST_CASE(stlBoundaries2);

TEST_CASE(stlBoundaries3);

TEST_CASE(stlBoundaries4); // #4364

TEST_CASE(stlBoundaries5); // #4352

TEST_CASE(stlBoundaries6); // #7106

// if (str.find("ab"))

TEST_CASE(if_find);

TEST_CASE(if_str_find);

TEST_CASE(size1);

TEST_CASE(size2);

TEST_CASE(size3);

TEST_CASE(size4); // #2652 - don't warn about vector/deque

// Redundant conditions..

// if (ints.find(123) != ints.end()) ints.remove(123);

TEST_CASE(redundantCondition1);

// missing inner comparison when incrementing iterator inside loop

TEST_CASE(missingInnerComparison1);

TEST_CASE(missingInnerComparison2); // no FP when there is comparison

TEST_CASE(missingInnerComparison3); // no FP when there is iterator shadowing

TEST_CASE(missingInnerComparison4); // no FP when "break;" is used

TEST_CASE(missingInnerComparison5); // Ticket #2154 - FP

TEST_CASE(missingInnerComparison6); // #2643 - 'it=foo.insert(++it,0);'

// catch common problems when using the string::c_str() function

TEST_CASE(cstr);

TEST_CASE(uselessCalls);

TEST_CASE(stabilityOfChecks); // #4684 cppcheck crash in template function call

TEST_CASE(dereferenceInvalidIterator);

TEST_CASE(dereferenceInvalidIterator2); // #6572

TEST_CASE(dereference_auto);

TEST_CASE(loopAlgoElementAssign);

TEST_CASE(loopAlgoAccumulateAssign);

TEST_CASE(loopAlgoContainerInsert);

TEST_CASE(loopAlgoIncrement);

TEST_CASE(loopAlgoConditional);

TEST_CASE(loopAlgoMinMax);

TEST_CASE(loopAlgoMultipleReturn);

TEST_CASE(invalidContainer);

TEST_CASE(invalidContainerLoop);

TEST_CASE(findInsert);

TEST_CASE(checkKnownEmptyContainer);

TEST_CASE(checkMutexes);

}

struct CheckOptions

{

CheckOptions() = default;

bool inconclusive = false;

Standards::cppstd_t cppstandard = Standards::CPPLatest;

};

#define check(...) check_(__FILE__, __LINE__, __VA_ARGS__)

template<size_t size>

void check_(const char* file, int line, const char (&code)[size], const CheckOptions& options = make_default_obj()) {

const Settings settings1 = settingsBuilder(settings).certainty(Certainty::inconclusive, options.inconclusive).cpp(options.cppstandard).build();

// Tokenize..

SimpleTokenizer tokenizer(settings1, *this);

ASSERT_LOC(tokenizer.tokenize(code), file, line);

runChecks<CheckStl>(tokenizer, this);

}

// TODO: get rid of this

void check_(const char* file, int line, const std::string& code) {

// Tokenize..

SimpleTokenizer tokenizer(settings, *this);

ASSERT_LOC(tokenizer.tokenize(code), file, line);

runChecks<CheckStl>(tokenizer, this);

}

#define checkNormal(code) checkNormal_(code, __FILE__, __LINE__)

template<size_t size>

void checkNormal_(const char (&code)[size], const char* file, int line) {

// Tokenize..

SimpleTokenizer tokenizer(settings, *this);

ASSERT_LOC(tokenizer.tokenize(code), file, line);

// Check..

runChecks<CheckStl>(tokenizer, this);

}

void outOfBounds() {

setMultiline();

checkNormal("bool f(const int a, const int b)\n" // #8648

"{\n"

" std::cout << a << b;\n"

" return true;\n"

"}\n"

"void f(const std::vector<int> &v)\n"

"{\n"

" if(v.size() >=2 &&\n"

" bar(v[2], v[3]) )\n" // v[3] is accessed

" {;}\n"

"}\n");

ASSERT_EQUALS("[test.cpp:9:18]: warning: Either the condition 'v.size()>=2' is redundant or size of 'v' can be 2. Expression 'v[2]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:8:17]: note: condition 'v.size()>=2'\n"

"[test.cpp:9:18]: note: Access out of bounds\n"

"[test.cpp:9:24]: warning: Either the condition 'v.size()>=2' is redundant or size of 'v' can be 2. Expression 'v[3]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:8:17]: note: condition 'v.size()>=2'\n"

"[test.cpp:9:24]: note: Access out of bounds\n", errout_str());

checkNormal("void f() {\n"

" std::string s;\n"

" s[10] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:3:4]: error: Out of bounds access in expression 's[10]' because 's' is empty. [containerOutOfBounds]\n", errout_str());

checkNormal("void f() {\n"

" std::string s = \"abcd\";\n"

" s[10] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:3:4]: error: Out of bounds access in 's[10]', if 's' size is 4 and '10' is 10 [containerOutOfBounds]\n", errout_str());

checkNormal("void f(std::vector<int> v) {\n"

" v.front();\n"

" if (v.empty()) {}\n"

"}");

ASSERT_EQUALS("[test.cpp:2:12]: warning: Either the condition 'v.empty()' is redundant or expression 'v.front()' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:3:16]: note: condition 'v.empty()'\n"

"[test.cpp:2:12]: note: Access out of bounds\n", errout_str());

checkNormal("void f(std::vector<int> v) {\n"

" if (v.size() == 3) {}\n"

" v[16] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:3:6]: warning: Either the condition 'v.size()==3' is redundant or size of 'v' can be 3. Expression 'v[16]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:18]: note: condition 'v.size()==3'\n"

"[test.cpp:3:6]: note: Access out of bounds\n", errout_str());

checkNormal("void f(std::vector<int> v) {\n"

" int i = 16;\n"

" if (v.size() == 3) {\n"

" v[i] = 0;\n"

" }\n"

"}");

ASSERT_EQUALS("[test.cpp:4:10]: warning: Either the condition 'v.size()==3' is redundant or size of 'v' can be 3. Expression 'v[i]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:3:18]: note: condition 'v.size()==3'\n"

"[test.cpp:4:10]: note: Access out of bounds\n", errout_str());

checkNormal("void f(std::vector<int> v, int i) {\n"

" if (v.size() == 3 || i == 16) {}\n"

" v[i] = 0;\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(std::map<int,int> x) {\n"

" if (x.empty()) { x[1] = 2; }\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(std::string s) {\n"

" if (s.size() == 1) {\n"

" s[2] = 0;\n"

" }\n"

"}");

ASSERT_EQUALS("[test.cpp:3:10]: warning: Either the condition 's.size()==1' is redundant or size of 's' can be 1. Expression 's[2]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:18]: note: condition 's.size()==1'\n"

"[test.cpp:3:10]: note: Access out of bounds\n", errout_str());

// Do not crash

checkNormal("void a() {\n"

" std::string b[];\n"

" for (auto c : b)\n"

" c.data();\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("std::string f(std::string x) {\n"

" if (x.empty()) return {};\n"

" x[0];\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("std::string f(std::string x) {\n"

" if (x.empty()) return std::string{};\n"

" x[0];\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("void f() {\n"

" std::string s;\n"

" x = s.begin() + 1;\n"

"}");

ASSERT_EQUALS(

"[test.cpp:3:17]: error: Out of bounds access in expression 's.begin()+1' because 's' is empty. [containerOutOfBounds]\n"

"[test.cpp:3:17]: error: Out of bounds access in expression 's.begin()+1' because 's' is empty. [containerOutOfBounds]\n", // duplicate

errout_str());

checkNormal("void f(int x) {\n"

" std::string s;\n"

" auto it = s.begin() + x;\n"

"}");

ASSERT_EQUALS("[test.cpp:3:23]: error: Out of bounds access in expression 's.begin()+x' because 's' is empty and 'x' may be non-zero. [containerOutOfBounds]\n", errout_str());

checkNormal("char fstr1(){const std::string s = \"<a><b>\"; return s[42]; }\n"

"wchar_t fwstr1(){const std::wstring s = L\"<a><b>\"; return s[42]; }");

ASSERT_EQUALS("[test.cpp:1:54]: error: Out of bounds access in 's[42]', if 's' size is 6 and '42' is 42 [containerOutOfBounds]\n"

"[test.cpp:2:60]: error: Out of bounds access in 's[42]', if 's' size is 6 and '42' is 42 [containerOutOfBounds]\n", errout_str());

checkNormal("char fstr1(){const std::string s = \"<a><b>\"; return s[1]; }\n"

"wchar_t fwstr1(){const std::wstring s = L\"<a><b>\"; return s[1]; }");

ASSERT_EQUALS("", errout_str());

checkNormal("int f() {\n"

" std::vector<int> v;\n"

" std::vector<int> * pv = &v;\n"

" return (*pv)[42];\n"

"}");

ASSERT_EQUALS("[test.cpp:4:17]: error: Out of bounds access in expression '(*pv)[42]' because '*pv' is empty. [containerOutOfBounds]\n", errout_str());

checkNormal("void f() {\n"

" std::string s;\n"

" ++abc[s];\n"

"}");

ASSERT_EQUALS("", errout_str());

// # 9274

checkNormal("char f(bool b) {\n"

" const std::string s = \"<a><b>\";\n"

" int x = 6;\n"

" if(b) ++x;\n"

" return s[x];\n"

"}");

ASSERT_EQUALS("[test.cpp:5:13]: error: Out of bounds access in 's[x]', if 's' size is 6 and 'x' is 6 [containerOutOfBounds]\n", errout_str());

checkNormal("void f() {\n"

" static const int N = 4;\n"

" std::array<int, N> x;\n"

" x[0] = 0;\n"

"}");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(bool b) {\n"

" std::vector<int> x;\n"

" if (b)\n"

" x.push_back(1);\n"

" if (x.size() < 2)\n"

" return;\n"

" x[0] = 2;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(bool b) {\n"

" std::vector<int> v;\n"

" if(v.at(b?42:0)) {}\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:3:12]: error: Out of bounds access in expression 'v.at(b?42:0)' because 'v' is empty. [containerOutOfBounds]\n",

errout_str());

checkNormal("void f(std::vector<int> v, bool b){\n"

" if (v.size() == 1)\n"

" if(v.at(b?42:0)) {}\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:3:16]: warning: Either the condition 'v.size()==1' is redundant or size of 'v' can be 1. Expression 'v.at(b?42:0)' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:18]: note: condition 'v.size()==1'\n"

"[test.cpp:3:16]: note: Access out of bounds\n",

errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" T t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s = { { &ArrS } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n", dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" std::vector<T> t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s = { { { &ArrS } } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" std::vector<std::vector<T>> t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s = { { { { &ArrS } } } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" T t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s { { &ArrS } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" std::vector<T> t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s { { { &ArrS } } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("struct T {\n"

" std::vector<int>* v;\n"

"};\n"

"struct S {\n"

" std::vector<std::vector<T>> t;\n"

"};\n"

"long g(S& s);\n"

"int f() {\n"

" std::vector<int> ArrS;\n"

" S s { { { { &ArrS } } } };\n"

" g(s);\n"

" return ArrS[0];\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

checkNormal("extern void Bar(const double, const double);\n"

"void f(std::vector<double> &r, const double ) {\n"

" std::vector<double> result;\n"

" double d = 0.0;\n"

" const double inc = 0.1;\n"

" for(unsigned int i = 0; i < 10; ++i) {\n"

" result.push_back(d);\n"

" d = (i + 1) * inc;\n"

" }\n"

" Bar(1.0, d);\n"

" Bar(10U, result.size());\n"

" Bar(0.0, result[0]);\n"

" Bar(0.34, result[1]);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(size_t entries) {\n"

" std::vector<uint8_t> v;\n"

" if (v.size() < entries + 2)\n"

" v.resize(entries + 2);\n"

" v[0] = 1;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(size_t entries) {\n"

" std::vector<uint8_t> v;\n"

" if (v.size() < entries)\n"

" v.resize(entries);\n"

" v[0] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5:6]: error: Out of bounds access in expression 'v[0]' because 'v' is empty. [containerOutOfBounds]\n", errout_str());

checkNormal("void f(size_t entries) {\n"

" if (entries < 2) return;\n"

" std::vector<uint8_t> v;\n"

" if (v.size() < entries)\n"

" v.resize(entries);\n"

" v[0] = 1;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(size_t entries) {\n"

" if (entries == 0) return;\n"

" std::vector<uint8_t> v;\n"

" if (v.size() < entries)\n"

" v.resize(entries);\n"

" v[0] = 1;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void foo(std::vector<int>* PArr, int n) {\n"

" std::vector<int> Arr;\n"

" if (!PArr)\n"

" PArr = &Arr;\n"

" PArr->resize(n);\n"

" for (int i = 0; i < n; ++i)\n"

" (*PArr)[i] = 1;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("int f() {\n"

" std::vector<int> v;\n"

" std::vector<int> * pv = &v;\n"

" return (*pv).at(42);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:20]: error: Out of bounds access in expression '(*pv).at(42)' because '*pv' is empty. [containerOutOfBounds]\n",

errout_str());

checkNormal("std::string f(const char* DirName) {\n"

" if (DirName == nullptr)\n"

" return {};\n"

" std::string Name{ DirName };\n"

" if (!Name.empty() && Name.back() != '\\\\')\n"

" Name += '\\\\';\n"

" return Name;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("bool f(bool b) {\n"

" std::vector<int> v;\n"

" if (b)\n"

" v.push_back(0);\n"

" for(auto i:v)\n"

" if (v[i] > 0)\n"

" return true;\n"

" return false;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:5:3]: style: Consider using std::any_of algorithm instead of a raw loop. [useStlAlgorithm]\n", errout_str());

checkNormal("std::vector<int> range(int n);\n"

"bool f(bool b) {\n"

" std::vector<int> v;\n"

" if (b)\n"

" v.push_back(1);\n"

" assert(range(v.size()).size() == v.size());\n"

" for(auto i:range(v.size()))\n"

" if (v[i] > 0)\n"

" return true;\n"

" return false;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:7:3]: style: Consider using std::any_of algorithm instead of a raw loop. [useStlAlgorithm]\n", errout_str());

checkNormal("bool g();\n"

"int f(int x) {\n"

" std::vector<int> v;\n"

" if (g())\n"

" v.emplace_back(x);\n"

" const auto n = (int)v.size();\n"

" for (int i = 0; i < n; ++i)\n"

" if (v[i] > 0)\n"

" return i;\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:8:0]: style: Consider using std::find_if algorithm instead of a raw loop. [useStlAlgorithm]\n", errout_str());

checkNormal("bool g();\n"

"int f(int x) {\n"

" std::vector<int> v;\n"

" if (g())\n"

" v.emplace_back(x);\n"

" const auto n = static_cast<int>(v.size());\n"

" for (int i = 0; i < n; ++i)\n"

" if (v[i] > 0)\n"

" return i;\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:8:0]: style: Consider using std::find_if algorithm instead of a raw loop. [useStlAlgorithm]\n", errout_str());

checkNormal("bool g();\n"

"void f(int x) {\n"

" std::vector<int> v;\n"

" if (g())\n"

" v.emplace_back(x);\n"

" const int n = v.size();\n"

" h(n);\n"

" for (int i = 0; i < n; ++i)\n"

" h(v[i]);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void foo(const std::vector<int> &v) {\n"

" if(v.size() >=1 && v[0] == 4 && v[1] == 2){}\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:38]: warning: Either the condition 'v.size()>=1' is redundant or size of 'v' can be 1. Expression 'v[1]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:17]: note: condition 'v.size()>=1'\n"

"[test.cpp:2:38]: note: Access out of bounds\n", errout_str());

checkNormal("int f(int x, int y) {\n"

" std::vector<int> a = {0,1,2};\n"

" if(x<2)\n"

" y = a[x] + 1;\n"

" else\n"

" y = a[x];\n"

" return y;\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:6:14]: warning: Either the condition 'x<2' is redundant or 'x' can have the value greater or equal to 3. Expression 'a[x]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:3:9]: note: condition 'x<2'\n"

"[test.cpp:6:14]: note: Access out of bounds\n",

errout_str());

checkNormal("int f(std::vector<int> v) {\n"

" if (v.size() > 3)\n"

" return v[v.size() - 3];\n"

" return 0;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(std::vector<int> v) {\n"

" v[v.size() - 1];\n"

" if (v.size() == 1) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(int n) {\n"

" std::vector<int> v = {1, 2, 3, 4};\n"

" const int i = qMin(n, v.size());\n"

" if (i > 1)\n"

" v[i] = 1;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(std::vector<int>& v, int i) {\n"

" if (i > -1) {\n"

" v.erase(v.begin() + i);\n"

" if (v.empty()) {}\n"

" }\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void g(const char *, ...) { exit(1); }\n" // #10025

"void f(const char c[]) {\n"

" std::vector<int> v = get();\n"

" if (v.empty())\n"

" g(\"\", c[0]);\n"

" return h(&v[0], v.size()); \n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(int i, std::vector<int> v) {\n" // #9157

" if (i <= (int)v.size()) {\n"

" if (v[i]) {}\n"

" }\n"

" if (i <= static_cast<int>(v.size())) {\n"

" if (v[i]) {}\n"

" }\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:14]: warning: Either the condition 'i<=(int)v.size()' is redundant or 'i' can have the value v.size(). Expression 'v[i]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:11]: note: condition 'i<=(int)v.size()'\n"

"[test.cpp:3:14]: note: Access out of bounds\n"

"[test.cpp:6:14]: warning: Either the condition 'i<=static_cast<int>(v.size())' is redundant or 'i' can have the value v.size(). Expression 'v[i]' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:5:11]: note: condition 'i<=static_cast<int>(v.size())'\n"

"[test.cpp:6:14]: note: Access out of bounds\n",

errout_str());

check("template<class Iterator>\n"

"void b(Iterator d) {\n"

" std::string c = \"a\";\n"

" d + c.length();\n"

"}\n"

"void f() {\n"

" std::string buf;\n"

" b(buf.begin());\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("[test.cpp:4:5]: error: Out of bounds access in expression 'd+c.length()' because 'buf' is empty. [containerOutOfBounds]\n",

errout_str());

check("template<class Iterator>\n"

"void b(Iterator d) {\n"

" std::string c = \"a\";\n"

" sort(d, d + c.length());\n"

"}\n"

"void f() {\n"

" std::string buf;\n"

" b(buf.begin());\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS("", errout_str());

check("int f(const std::vector<int> &v) {\n"

" return !v.empty() ? 42 : v.back();\n"

"}\n",

dinit(CheckOptions, $.inconclusive = true));

ASSERT_EQUALS(

"[test.cpp:2:36]: warning: Either the condition 'v.empty()' is redundant or expression 'v.back()' causes access out of bounds. [containerOutOfBounds]\n"

"[test.cpp:2:20]: note: condition 'v.empty()'\n"

"[test.cpp:2:36]: note: Access out of bounds\n",

errout_str());

check("std::vector<int> g() {\n" // #10779

" std::vector<int> v(10);\n"

" for(int i = 0; i <= 10; ++i)\n"

" v[i] = 42;\n"

" return v;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:10]: error: Out of bounds access in 'v[i]', if 'v' size is 10 and 'i' is 10 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n"

" int s = 2;\n"

" std::vector <int> v(s);\n"

" v[100] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:6]: error: Out of bounds access in 'v[100]', if 'v' size is 2 and '100' is 100 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n"

" std::vector <int> v({ 1, 2, 3 });\n"

" v[100] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:6]: error: Out of bounds access in 'v[100]', if 'v' size is 3 and '100' is 100 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n"

" char c[] = { 1, 2, 3 };\n"

" std::vector<char> v(c, sizeof(c) + c);\n"

" v[100] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:6]: error: Out of bounds access in 'v[100]', if 'v' size is 3 and '100' is 100 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n"

" char c[] = { 1, 2, 3 };\n"

" std::vector<char> v{ c, c + sizeof(c) };\n"

" v[100] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:6]: error: Out of bounds access in 'v[100]', if 'v' size is 3 and '100' is 100 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n"

" int i[] = { 1, 2, 3 };\n"

" std::vector<int> v(i, i + sizeof(i) / 4);\n"

" v[100] = 1;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:6]: error: Out of bounds access in 'v[100]', if 'v' size is 3 and '100' is 100 [containerOutOfBounds]\n",

errout_str());

check("void f() {\n" // #6615

" int i[] = { 1, 2, 3 };\n"

" std::vector<int> v(i, i + sizeof(i) / sizeof(int));\n"

" v[100] = 1;\n"

"}\n");

TODO_ASSERT_EQUALS("test.cpp:4:error:Out of bounds access in 'v[100]', if 'v' size is 3 and '100' is 100\n",

"",

errout_str());

check("void f() {\n"

" std::array<int, 10> a = {};\n"

" a[10];\n"

" constexpr std::array<int, 10> b = {};\n"

" b[10];\n"

" const std::array<int, 10> c = {};\n"

" c[10];\n"

" static constexpr std::array<int, 10> d = {};\n"

" d[10];\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:6]: error: Out of bounds access in 'a[10]', if 'a' size is 10 and '10' is 10 [containerOutOfBounds]\n"

"[test.cpp:5:6]: error: Out of bounds access in 'b[10]', if 'b' size is 10 and '10' is 10 [containerOutOfBounds]\n"

"[test.cpp:7:6]: error: Out of bounds access in 'c[10]', if 'c' size is 10 and '10' is 10 [containerOutOfBounds]\n"

"[test.cpp:9:6]: error: Out of bounds access in 'd[10]', if 'd' size is 10 and '10' is 10 [containerOutOfBounds]\n",

errout_str());

check("struct test_fixed {\n"

" std::array<int, 10> array = {};\n"

" void index(int i) { array[i]; }\n"

"};\n"

"void f() {\n"

" test_fixed x = test_fixed();\n"

" x.index(10);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:30]: error: Out of bounds access in 'array[i]', if 'array' size is 10 and 'i' is 10 [containerOutOfBounds]\n",

errout_str());

check("struct test_constexpr {\n"

" static constexpr std::array<int, 10> array = {};\n"

" void index(int i) { array[i]; }\n"

"};\n"

"void f() {\n"

" test_constexpr x = test_constexpr();\n"

" x.index(10);\n"

"}\n");

ASSERT_EQUALS("[test.cpp:3:30]: error: Out of bounds access in 'array[i]', if 'array' size is 10 and 'i' is 10 [containerOutOfBounds]\n",

errout_str());

checkNormal("struct A {\n"

" const std::vector<int>& v;\n"

" A(const std::vector<int>& x) : v(x)\n"

" {}\n"

" int f() const {\n"

" return v[0];\n"

" }\n"

"};\n");

ASSERT_EQUALS("", errout_str());

checkNormal("struct A {\n"

" static const std::vector<int> v;\n"

" int f() const {\n"

" return v[0];\n"

" }\n"

"};\n"

"const std::vector<int> A::v = {1, 2};\n");

ASSERT_EQUALS("", errout_str());

checkNormal("struct a {\n"

" std::vector<int> g() const;\n"

"};\n"

"int f(const a& b) {\n"

" auto c = b.g();\n"

" assert(not c.empty());\n"

" int d = c.front();\n"

" return d;\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("std::string f() {\n"

" std::map<int, std::string> m = { { 1, \"1\" } };\n"

" return m.at(1);\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("struct A {\n"

" virtual void init_v(std::vector<int> *v) = 0;\n"

"};\n"

"A* create_a();\n"

"struct B {\n"

" B() : a(create_a()) {}\n"

" void init_v(std::vector<int> *v) {\n"

" a->init_v(v);\n"

" }\n"

" A* a;\n"

"};\n"

"void f() {\n"

" B b;\n"

" std::vector<int> v;\n"

" b.init_v(&v);\n"

" v[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("void f(std::vector<int>* v) {\n"

" if (v->empty())\n"

" v->push_back(1);\n"

" auto x = v->back();\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("template <typename T, uint8_t count>\n"

"struct Foo {\n"

" std::array<T, count> items = {0};\n"

" T maxCount = count;\n"

" explicit Foo(const T& maxValue = (std::numeric_limits<T>::max)()) : maxCount(maxValue) {}\n"

" bool Set(const uint8_t idx) {\n"

" if (CheckBounds(idx) && items[idx] < maxCount) {\n"

" items[idx] += 1;\n"

" return true;\n"

" }\n"

" return false;\n"

" }\n"

" static bool CheckBounds(const uint8_t idx) { return idx < count; }\n"

"};\n"

"void f() {\n"

" Foo<uint8_t, 42U> x;\n"

" if (x.Set(42U)) {}\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("struct S { void g(std::span<int>& r) const; };\n" // #11828

"int f(const S& s) {\n"

" std::span<int> t;\n"

" s.g(t);\n"

" return t[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

checkNormal("char h() {\n"

" std::string s;\n"

" std::string_view sv(s);\n"

" return s[2];\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:13]: error: Out of bounds access in expression 's[2]' because 's' is empty. [containerOutOfBounds]\n", errout_str());

checkNormal("void f() {\n" // #12738

" std::vector<double> v{ 0, 0.1 };\n"

" (void)v[0];\n"

"}\n");

ASSERT_EQUALS("", errout_str());

}

void outOfBoundsSymbolic()

{

check("void foo(std::string textline, int col) {\n"

" if(col > textline.size())\n"

" return false;\n"

" int x = textline[col];\n"

"}\n");

ASSERT_EQUALS(

"[test.cpp:2:12] -> [test.cpp:4:21]: (warning) Either the condition 'col>textline.size()' is redundant or 'col' can have the value textline.size(). Expression 'textline[col]' causes access out of bounds. [containerOutOfBounds]\n",

errout_str());

}

void outOfBoundsIndexExpression() {

setMultiline();

checkNormal("void f(std::string s) {\n"

" s[s.size()] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:2:3]: error: Out of bounds access of s, index 's.size()' is out of bounds. [containerOutOfBoundsIndexExpression]\n", errout_str());

checkNormal("void f(std::string s) {\n"

" s[s.size()+1] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:2:3]: error: Out of bounds access of s, index 's.size()+1' is out of bounds. [containerOutOfBoundsIndexExpression]\n", errout_str());

checkNormal("void f(std::string s) {\n"

" s[1+s.size()] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:2:3]: error: Out of bounds access of s, index '1+s.size()' is out of bounds. [containerOutOfBoundsIndexExpression]\n", errout_str());

checkNormal("void f(std::string s) {\n"

" s[x*s.size()] = 1;\n"

"}");

ASSERT_EQUALS("[test.cpp:2:3]: error: Out of bounds access of s, index 'x*s.size()' is out of bounds. [containerOutOfBoundsIndexExpression]\n", errout_str());

checkNormal("bool f(std::string_view& sv) {\n" // #10031

" return sv[sv.size()] == '\\0';\n"

"}\n");

ASSERT_EQUALS("[test.cpp:2:12]: error: Out of bounds access of sv, index 'sv.size()' is out of bounds. [containerOutOfBoundsIndexExpression]\n", errout_str());

}

void outOfBoundsIterator() {

check("int f() {\n"

" std::vector<int> v;\n"

" auto it = v.begin();\n"

" return *it;\n"

"}\n");

ASSERT_EQUALS("[test.cpp:4:13]: (error) Out of bounds access in expression 'it' because 'v' is empty. [containerOutOfBounds]\n",

errout_str());

check("int f() {\n"

" std::vector<int> v;\n"

" v.push_back(0);\n"

" auto it = v.begin() + 1;\n"

" return *it;\n"

"}\n");