/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2014 Daniel Marjamäki and Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

#include "tokenize.h"

#include "checkbufferoverrun.h"

#include "testsuite.h"

#include <sstream>

#include <climits>

extern std::ostringstream errout;

class TestBufferOverrun : public TestFixture {

public:

TestBufferOverrun() : TestFixture("TestBufferOverrun") {

}

private:

void check(const char code[], bool experimental = true, const char filename[] = "test.cpp", bool verify = true) {

// Clear the error buffer..

errout.str("");

Settings settings;

settings.inconclusive = true;

settings.standards.posix = true;

settings.experimental = experimental;

settings.addEnabled("warning");

settings.addEnabled("style");

settings.addEnabled("portability");

// Tokenize..

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

tokenizer.tokenize(istr, filename);

const std::string str1(tokenizer.tokens()->stringifyList(0,true));

// Assign variable ids

tokenizer.simplifyTokenList2();

const std::string str2(tokenizer.tokens()->stringifyList(0,true));

// Ensure that the test case is not bad.

if (verify && str1 != str2) {

warn(("Unsimplified code in test case. It looks like this test "

"should either be cleaned up or moved to TestTokenizer or "

"TestSimplifyTokens instead.\nstr1="+str1+"\nstr2="+str2).c_str());

}

// Check for buffer overruns..

CheckBufferOverrun checkBufferOverrun(&tokenizer, &settings, this);

checkBufferOverrun.bufferOverrun();

checkBufferOverrun.bufferOverrun2();

checkBufferOverrun.arrayIndexThenCheck();

checkBufferOverrun.writeOutsideBufferSize();

}

void checkstd(const char code[], const char filename[] = "test.cpp") {

static bool init;

static Settings settings;

if (!init) {

init = true;

LOAD_LIB_2(settings.library, "std.cfg");

settings.addEnabled("warning");

}

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

tokenizer.tokenize(istr, filename);

// Clear the error buffer..

errout.str("");

// Check for buffer overruns..

CheckBufferOverrun checkBufferOverrun(&tokenizer, &settings, this);

checkBufferOverrun.bufferOverrun();

checkBufferOverrun.bufferOverrun2();

checkBufferOverrun.arrayIndexThenCheck();

checkBufferOverrun.writeOutsideBufferSize();

}

void checkposix(const char code[], const char filename[] = "test.cpp") {

static bool init;

static Settings settings;

if (!init) {

init = true;

LOAD_LIB_2(settings.library, "posix.cfg");

settings.addEnabled("warning");

}

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

tokenizer.tokenize(istr, filename);

// Clear the error buffer..

errout.str("");

// Check for buffer overruns..

CheckBufferOverrun checkBufferOverrun(&tokenizer, &settings, this);

checkBufferOverrun.bufferOverrun();

checkBufferOverrun.bufferOverrun2();

checkBufferOverrun.arrayIndexThenCheck();

checkBufferOverrun.writeOutsideBufferSize();

}

void run() {

TEST_CASE(noerr1);

TEST_CASE(noerr2);

TEST_CASE(noerr3);

TEST_CASE(noerr4);

TEST_CASE(sizeof3);

TEST_CASE(array_index_1);

TEST_CASE(array_index_2);

TEST_CASE(array_index_3);

TEST_CASE(array_index_6);

TEST_CASE(array_index_7);

TEST_CASE(array_index_9);

TEST_CASE(array_index_11);

TEST_CASE(array_index_12);

TEST_CASE(array_index_13);

TEST_CASE(array_index_14);

TEST_CASE(array_index_15);

TEST_CASE(array_index_16);

TEST_CASE(array_index_17);

TEST_CASE(array_index_18);

TEST_CASE(array_index_19);

TEST_CASE(array_index_20);

TEST_CASE(array_index_21);

TEST_CASE(array_index_22);

TEST_CASE(array_index_23);

TEST_CASE(array_index_24); // ticket #1492 and #1539

TEST_CASE(array_index_25); // ticket #1536

TEST_CASE(array_index_26);

TEST_CASE(array_index_27);

TEST_CASE(array_index_28); // ticket #1418

TEST_CASE(array_index_29); // ticket #1734

TEST_CASE(array_index_30); // ticket #2086 - out of bounds when type is unknown

TEST_CASE(array_index_31); // ticket #2120 - out of bounds in subfunction when type is unknown

TEST_CASE(array_index_32);

TEST_CASE(array_index_33); // ticket #3044

TEST_CASE(array_index_34); // ticket #3063

TEST_CASE(array_index_35); // ticket #2889

TEST_CASE(array_index_36); // ticket #2960

TEST_CASE(array_index_37);

TEST_CASE(array_index_38); // ticket #3273

TEST_CASE(array_index_39);

TEST_CASE(array_index_40); // loop variable calculation, taking address

TEST_CASE(array_index_41); // structs with the same name

TEST_CASE(array_index_42);

TEST_CASE(array_index_43); // struct with array

TEST_CASE(array_index_44); // #3979

TEST_CASE(array_index_45); // #4207 - calling function with variable number of parameters (...)

TEST_CASE(array_index_46); // #4840 - two-statement for loop

TEST_CASE(array_index_multidim);

TEST_CASE(array_index_switch_in_for);

TEST_CASE(array_index_for_in_for); // FP: #2634

TEST_CASE(array_index_calculation);

TEST_CASE(array_index_negative1);

TEST_CASE(array_index_negative2); // ticket #3063

TEST_CASE(array_index_for_decr);

TEST_CASE(array_index_varnames); // FP: struct member. #1576

TEST_CASE(array_index_for_continue); // for,continue

TEST_CASE(array_index_for); // FN: for,if

TEST_CASE(array_index_for_neq); // #2211: Using != in condition

TEST_CASE(array_index_for_question); // #2561: for, ?:

TEST_CASE(array_index_for_andand_oror); // FN: using && or || in the for loop condition

TEST_CASE(array_index_for_varid0); // #4228: No varid for counter variable

TEST_CASE(array_index_vla_for); // #3221: access VLA inside for

TEST_CASE(array_index_extern); // FP when using 'extern'. #1684

TEST_CASE(array_index_cast); // FP after cast. #2841

TEST_CASE(array_index_string_literal);

TEST_CASE(array_index_same_struct_and_var_name); // #4751 - not handled well when struct name and var name is same

TEST_CASE(array_index_valueflow);

TEST_CASE(buffer_overrun_1_standard_functions);

TEST_CASE(buffer_overrun_1_posix_functions);

TEST_CASE(buffer_overrun_2_struct);

TEST_CASE(buffer_overrun_3);

TEST_CASE(buffer_overrun_4);

TEST_CASE(buffer_overrun_5);

TEST_CASE(buffer_overrun_6);

TEST_CASE(buffer_overrun_7);

TEST_CASE(buffer_overrun_8);

TEST_CASE(buffer_overrun_9);

TEST_CASE(buffer_overrun_10);

TEST_CASE(buffer_overrun_11);

TEST_CASE(buffer_overrun_12);

TEST_CASE(buffer_overrun_13);

TEST_CASE(buffer_overrun_14);

TEST_CASE(buffer_overrun_15); // ticket #1787

TEST_CASE(buffer_overrun_16);

TEST_CASE(buffer_overrun_17); // ticket #2548

TEST_CASE(buffer_overrun_18); // ticket #2576 - for, calculation with loop variable

TEST_CASE(buffer_overrun_19); // #2597 - class member with unknown type

TEST_CASE(buffer_overrun_20); // #2986 (segmentation fault)

TEST_CASE(buffer_overrun_21);

TEST_CASE(buffer_overrun_22); // #3124

TEST_CASE(buffer_overrun_23); // #3153

TEST_CASE(buffer_overrun_24); // index variable is changed in for-loop

TEST_CASE(buffer_overrun_26); // #4432 (segmentation fault)

TEST_CASE(buffer_overrun_27); // #4444 (segmentation fault)

TEST_CASE(buffer_overrun_28); // Out of bound char array access

TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch

TEST_CASE(buffer_overrun_function_array_argument);

TEST_CASE(possible_buffer_overrun_1); // #3035

// It is undefined behaviour to point out of bounds of an array

// the address beyond the last element is in bounds

// char a[10];

// char *p1 = a + 10; // OK

// char *p2 = a + 11 // UB

TEST_CASE(pointer_out_of_bounds_1);

TEST_CASE(pointer_out_of_bounds_2);

TEST_CASE(sprintf1);

TEST_CASE(sprintf2);

TEST_CASE(sprintf3);

TEST_CASE(sprintf4);

TEST_CASE(sprintf5);

TEST_CASE(sprintf6);

TEST_CASE(sprintf7);

TEST_CASE(sprintf8);

TEST_CASE(sprintf9);

TEST_CASE(sprintf10);

TEST_CASE(snprintf1);

TEST_CASE(snprintf2);

TEST_CASE(snprintf4);

TEST_CASE(snprintf5);

TEST_CASE(snprintf6);

TEST_CASE(snprintf7);

TEST_CASE(strncat1);

TEST_CASE(strncat2);

TEST_CASE(strncat3);

TEST_CASE(strncat4);

TEST_CASE(strcat1);

TEST_CASE(strcat2);

TEST_CASE(strcat3);

TEST_CASE(memfunc1); // memchr/memset/memcpy

TEST_CASE(memfunc2);

TEST_CASE(memfunc3); // ticket #1659

TEST_CASE(varid1);

TEST_CASE(varid2);

TEST_CASE(varid3); // ticket #4764

TEST_CASE(assign1);

TEST_CASE(alloc1); // Buffer allocated with new

TEST_CASE(alloc2); // Buffer allocated with malloc

TEST_CASE(alloc3); // statically allocated buffer

TEST_CASE(alloc4); // Buffer allocated with alloca

TEST_CASE(malloc_memset); // using memset on buffer allocated with malloc

TEST_CASE(memset1);

TEST_CASE(memset2);

TEST_CASE(counter_test);

TEST_CASE(strncpy1);

TEST_CASE(unknownType);

TEST_CASE(terminateStrncpy1);

TEST_CASE(terminateStrncpy2);

TEST_CASE(terminateStrncpy3);

TEST_CASE(recursive_long_time);

TEST_CASE(crash1); // Ticket #1587 - crash

TEST_CASE(crash2); // Ticket #2607 - crash

TEST_CASE(crash3); // Ticket #3034 - crash

TEST_CASE(crash4); // Ticket #5426 - crash

TEST_CASE(crash5); // TIcket #5595 - crash

TEST_CASE(garbage1); // Ticket #5203

TEST_CASE(executionPaths1);

TEST_CASE(executionPaths2);

TEST_CASE(executionPaths3); // no FP for function parameter

TEST_CASE(executionPaths4); // Ticket #2386 - Segmentation fault in the ExecutionPath handling

TEST_CASE(executionPaths5); // Ticket #2920 - False positive when size is unknown

TEST_CASE(executionPaths6); // unknown types

TEST_CASE(cmdLineArgs1);

TEST_CASE(scope); // handling different scopes

TEST_CASE(getErrorMessages);

TEST_CASE(unknownMacroNoDecl); // #2638 - not variable declaration: 'AAA a[0] = 0;'

// Access array and then check if the used index is within bounds

TEST_CASE(arrayIndexThenCheck);

TEST_CASE(bufferNotZeroTerminated);

TEST_CASE(readlink);

TEST_CASE(readlinkat);

TEST_CASE(writeOutsideBufferSize)

TEST_CASE(negativeMemoryAllocationSizeError) // #389

}

void noerr1() {

check("extern int ab;\n"

"void f()\n"

"{\n"

" if (ab)\n"

" {\n"

" char str[50];\n"

" }\n"

" if (ab)\n"

" {\n"

" char str[50];\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void noerr2() {

check("static char buf[2];\n"

"void f1(char *str)\n"

"{\n"

" strcpy(buf,str);\n"

"}\n"

"void f2(char *str)\n"

"{\n"

" strcat(buf,str);\n"

"}\n"

"void f3(char *str)\n"

"{\n"

" sprintf(buf,\"%s\",str);\n"

"}\n"

"void f4(const char str[])\n"

"{\n"

" strcpy(buf, str);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void noerr3() {

check("struct { char data[10]; } abc;\n"

"static char f()\n"

"{\n"

" char data[1];\n"

" return abc.data[1];\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void noerr4() {

// The memory isn't read or written and therefore there is no error.

check("static void f() {\n"

" char data[100];\n"

" const char *p = data + 100;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void sizeof3() {

check("struct group { int gr_gid; };\n"

"void f()\n"

"{\n"

" char group[32];\n"

" snprintf(group, 32, \"%u\", 0);\n"

" struct group *gr;\n"

" snprintf(group, 32, \"%u\", gr->gr_gid);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_1() {

check("void f()\n"

"{\n"

" char str[0x10];\n"

" str[15] = 0;\n"

" str[16] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'str[16]' accessed at index 16, which is out of bounds.\n", errout.str());

check("char f()\n"

"{\n"

" char str[16];\n"

" return str[16];\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Array 'str[16]' accessed at index 16, which is out of bounds.\n", errout.str());

// test stack array

check("int f()\n"

"{\n"

" int x[ 3 ] = { 0, 1, 2 };\n"

" int y;\n"

" y = x[ 4 ];\n"

" return y;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'x[3]' accessed at index 4, which is out of bounds.\n", errout.str());

check("int f()\n"

"{\n"

" int x[ 3 ] = { 0, 1, 2 };\n"

" int y;\n"

" y = x[ 2 ];\n"

" return y;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_2() {

check("void f()\n"

"{\n"

" char *str = new char[0x10];\n"

" str[15] = 0;\n"

" str[16] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'str[16]' accessed at index 16, which is out of bounds.\n", errout.str());

}

void array_index_3() {

{

check("void f()\n"

"{\n"

" int val[50];\n"

" int i, sum=0;\n"

" for (i = 0; i < 100; i++)\n"

" sum += val[i];\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Array 'val[50]' accessed at index 99, which is out of bounds.\n", errout.str());

}

{

check("void f()\n"

"{\n"

" int val[50];\n"

" int i, sum=0;\n"

" for (i = 1; i < 100; i++)\n"

" sum += val[i];\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Array 'val[50]' accessed at index 99, which is out of bounds.\n", errout.str());

}

{

check("void f(int a)\n"

"{\n"

" int val[50];\n"

" int i, sum=0;\n"

" for (i = a; i < 100; i++)\n"

" sum += val[i];\n"

"}");

ASSERT_EQUALS("[test.cpp:6]: (error) Array 'val[50]' accessed at index 99, which is out of bounds.\n", errout.str());

}

{

check("typedef struct g g2[3];\n"

"void foo(char *a)\n"

"{\n"

" for (int i = 0; i < 4; i++)\n"

" {\n"

" a[i]=0;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

{

check("void foo(int argc)\n"

"{\n"

" char a[2];\n"

" for (int i = 4; i < argc; i++)\n"

" {\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

{

check("void foo(int a[10]) {\n"

" for (int i=0;i<50;++i) {\n"

" a[i] = 0;\n"

" }\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Array 'a[10]' accessed at index 49, which is out of bounds.\n", errout.str());

}

}

void array_index_6() {

check("struct ABC\n"

"{\n"

" char str[10];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC abc;\n"

" abc.str[10] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:9]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

check("struct ABC\n"

"{\n"

" char str[10];\n"

"};\n"

"\n"

"static char f()\n"

"{\n"

" struct ABC abc;\n"

" return abc.str[10];\n"

"}");

ASSERT_EQUALS("[test.cpp:9]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

// This is not out of bounds because it is a variable length array

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(struct ABC) + 10);\n"

" x->str[1] = 0;"

"}");

ASSERT_EQUALS("", errout.str());

// This is not out of bounds because it is not a variable length array

check("struct ABC\n"

"{\n"

" char str[1];\n"

" int x;\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(struct ABC) + 10);\n"

" x->str[1] = 0;"

"}");

ASSERT_EQUALS("[test.cpp:10]: (error) Array 'x.str[1]' accessed at index 1, which is out of bounds.\n", errout.str());

// This is not out of bounds because it is a variable length array

// and the index is within the memory allocated.

/** @todo this works by accident because we ignore any access to this array */

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(struct ABC) + 10);\n"

" x->str[10] = 0;"

"}");

ASSERT_EQUALS("", errout.str());

// This is out of bounds because it is outside the memory allocated.

/** @todo this doesn't work because of a bug in sizeof(struct) */

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(struct ABC) + 10);\n"

" x->str[11] = 0;"

"}");

TODO_ASSERT_EQUALS("[test.cpp:9]: (error) Array 'str[1]' accessed at index 11, which is out of bounds.\n", "", errout.str());

// This is out of bounds if 'sizeof(ABC)' is 1 (No padding)

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(ABC) + 10);\n"

" x->str[11] = 0;"

"}");

TODO_ASSERT_EQUALS("error", "", errout.str());

// This is out of bounds because it is outside the memory allocated

/** @todo this doesn't work because of a bug in sizeof(struct) */

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(struct ABC));\n"

" x->str[1] = 0;"

"}");

TODO_ASSERT_EQUALS("[test.cpp:9]: (error) Array 'str[1]' accessed at index 1, which is out of bounds.\n", "", errout.str());

// This is out of bounds because it is outside the memory allocated

// But only if 'sizeof(ABC)' is 1 (No padding)

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC* x = malloc(sizeof(ABC));\n"

" x->str[1] = 0;"

"}");

TODO_ASSERT_EQUALS("error", "", errout.str());

// This is out of bounds because it is not a variable array

check("struct ABC\n"

"{\n"

" char str[1];\n"

"};\n"

"\n"

"static void f()\n"

"{\n"

" struct ABC x;\n"

" x.str[1] = 0;"

"}");

ASSERT_EQUALS("[test.cpp:9]: (error) Array 'x.str[1]' accessed at index 1, which is out of bounds.\n", errout.str());

check("struct foo\n"

"{\n"

" char str[10];\n"

"};\n"

"\n"

"void x()\n"

"{\n"

" foo f;\n"

" for ( unsigned int i = 0; i < 64; ++i )\n"

" f.str[i] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:10]: (error) Array 'f.str[10]' accessed at index 63, which is out of bounds.\n", errout.str());

check("struct AB { char a[NUM]; char b[NUM]; }\n"

"void f(struct AB *ab) {\n"

" ab->a[0] = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_7() {

check("struct ABC\n"

"{\n"

" char str[10];\n"

"};\n"

"\n"

"static void f(struct ABC *abc)\n"

"{\n"

" abc->str[10] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:8]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

}

void array_index_9() {

check("static void memclr( char *data )\n"

"{\n"

" data[10] = 0;\n"

"}\n"

"\n"

"static void f()\n"

"{\n"

" char str[5];\n"

" memclr( str );\n"

"}");

ASSERT_EQUALS("[test.cpp:9] -> [test.cpp:3]: (error) Array 'str[5]' accessed at index 10, which is out of bounds.\n", errout.str());

check("static void memclr( int i, char *data )\n"

"{\n"

" data[10] = 0;\n"

"}\n"

"\n"

"static void f()\n"

"{\n"

" char str[5];\n"

" memclr( 0, str );\n"

"}");

ASSERT_EQUALS("[test.cpp:9] -> [test.cpp:3]: (error) Array 'str[5]' accessed at index 10, which is out of bounds.\n", errout.str());

check("static void memclr( int i, char *data )\n"

"{\n"

" data[i] = 0;\n"

"}\n"

"\n"

"static void f()\n"

"{\n"

" char str[5];\n"

" memclr( 10, str );\n"

"}");

TODO_ASSERT_EQUALS("[test.cpp:9] -> [test.cpp:3]: (possible error) Array index out of bounds.\n",

"", errout.str());

// This is not an error

check("static void memclr( char *data, int size )\n"

"{\n"

" if( size > 10 )"

" data[10] = 0;\n"

"}\n"

"\n"

"static void f()\n"

"{\n"

" char str[5];\n"

" memclr( str, 5 );\n"

"}");

ASSERT_EQUALS("", errout.str());

// #2097..

check("void foo(int *p)\n"

"{\n"

" --p;\n"

" p[2] = 0;\n"

"}\n"

"\n"

"void bar()\n"

"{\n"

" int p[3];\n"

" foo(p+1);\n"

"}");

ASSERT_EQUALS("", errout.str());

// #3168

checkstd("void a(char *p) { memset(p,0,100); }\n"

"void b() {\n"

" char buf[10];\n"

" a(buf);"

"}");

ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:1]: (error) Buffer is accessed out of bounds: buf\n", errout.str());

}

void array_index_11() {

check("class ABC\n"

"{\n"

"public:\n"

" ABC();\n"

" char *str[10];\n"

" struct ABC *next();"

"};\n"

"\n"

"static void f()\n"

"{\n"

" ABC *abc1;\n"

" for ( ABC *abc = abc1; abc; abc = abc->next() )\n"

" {\n"

" abc->str[10] = 0;\n"

" }\n"

"}");

ASSERT_EQUALS("[test.cpp:13]: (error) Array 'abc.str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

}

void array_index_12() {

check("class Fred\n"

"{\n"

"private:\n"

" char str[10];\n"

"public:\n"

" Fred();\n"

"};\n"

"Fred::Fred()\n"

"{\n"

" str[10] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:10]: (error) Array 'str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

check("class Fred\n"

"{\n"

"private:\n"

" char str[10];\n"

"public:\n"

" char c();\n"

"};\n"

"char Fred::c()\n"

"{\n"

" return str[10];\n"

"}");

ASSERT_EQUALS("[test.cpp:10]: (error) Array 'str[10]' accessed at index 10, which is out of bounds.\n", errout.str());

}

void array_index_13() {

check("void f()\n"

"{\n"

" char buf[10];\n"

" for (int i = 0; i < 100; i++)\n"

" {\n"

" if (i < 10)\n"

" int x = buf[i];\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_14() {

check("void f()\n"

"{\n"

" int a[10];\n"

" for (int i = 0; i < 10; i++)\n"

" a[i+10] = i;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index 19, which is out of bounds.\n", errout.str());

}

void array_index_15() {

check("void f()\n"

"{\n"

" int a[10];\n"

" for (int i = 0; i < 10; i++)\n"

" a[10+i] = i;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index 19, which is out of bounds.\n", errout.str());

}

void array_index_16() {

check("void f()\n"

"{\n"

" int a[10];\n"

" for (int i = 0; i < 10; i++)\n"

" a[i+1] = i;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index 10, which is out of bounds.\n", errout.str());

}

void array_index_17() {

check("void f()\n"

"{\n"

" int a[10];\n"

" for (int i = 0; i < 10; i++)\n"

" a[i*2] = i;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[10]' accessed at index 18, which is out of bounds.\n", errout.str());

check("void f()\n"

"{\n"

" int a[12];\n"

" for (int i = 0; i < 12; i+=6)\n"

" a[i+5] = i;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" int a[12];\n"

" for (int i = 0; i < 12; i+=6)\n"

" a[i+6] = i;\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Array 'a[12]' accessed at index 12, which is out of bounds.\n", errout.str());

check("void f() {\n" // #4398

" int a[2];\n"

" for (int i = 0; i < 4; i+=2)\n"

" a[i] = 0;\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Array 'a[2]' accessed at index 2, which is out of bounds.\n", errout.str());

check("void f() {\n" // #4398

" int a[2];\n"

" for (int i = 0; i < 4; i+=2)\n"

" do_stuff(a+i);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_18() {

check("void f()\n"

"{\n"

" int a[5];\n"

" for (int i = 0; i < 6; i++)\n"

" {\n"

" a[i] = i;\n"

" i+=1;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" int a[5];\n"

" for (int i = 0; i < 6; i++)\n"

" {\n"

" a[i] = i;\n"

" i++;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" int a[5];\n"

" for (int i = 0; i < 6; i++)\n"

" {\n"

" a[i] = i;\n"

" ++i;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" int a[5];\n"

" for (int i = 0; i < 6; i++)\n"

" {\n"

" a[i] = i;\n"

" i=4;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void f()\n"

"{\n"

" int a[6];\n"

" for (int i = 0; i < 7; i++)\n"

" {\n"

" a[i] = i;\n"

" i+=1;\n"

" }\n"

"}");

TODO_ASSERT_EQUALS("[test.cpp:6]: (error) Buffer overrun\n", "", errout.str());

}

void array_index_19() {

// "One Past the End" is legal, as long as pointer is not dereferenced.

check("void f()\n"

"{\n"

" char a[2];\n"

" char *end = &(a[2]);\n"

"}");

ASSERT_EQUALS("", errout.str());

// Getting more than one past the end is not legal

check("void f()\n"

"{\n"

" char a[2];\n"

" char *end = &(a[3]);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Array 'a[2]' accessed at index 3, which is out of bounds.\n", errout.str());

}

void array_index_20() {

check("void f()\n"

"{\n"

" char a[8];\n"

" int b[10];\n"

" for ( int i = 0; i < 9; i++ )\n"

" b[i] = 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_21() {

check("class A {\n"

" int indices[2];\n"

" void foo(int indices[3]);\n"

"};\n"

"\n"

"void A::foo(int indices[3]) {\n"

" for(int j=0; j<3; ++j) {\n"

" int b = indices[j];\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void array_index_22() {

check("int main() {\n"

" size_t indices[2];\n"

" int b = indices[2];\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Array 'indices[2]' accessed at index 2, which is out of bounds.\n", errout.str());

}

void array_index_23() {

check("void foo()\n"

"{\n"