Opened 12 years ago

Closed 17 months ago

Last modified 13 months ago

#6366 closed enhancement (fixed)

false negative: array index out of bounds issue not displayed during variable declaration with comma operator

Reported by: orbitcowboy Owned by: kidkat
Priority: safety-cosmetic Milestone: 2.18
Component: Improve check Version:
Keywords: arrayIndexOutOfBounds Cc:

Description (last modified by kidkat)

Cppcheck does not report all array index overruns, in case two overruns happen during a variable declaration, seperated by a comma:

typedef struct {
 long m[9];
} S;

void f(const S *s)
{
  long a=s->m[9], b=s->m[9];
  long c=s->m[9];
}

Only the case a=s->m[9] and c=s->m[9] is reported and b=s->m[9] is missing.

$ cppcheck --enable=all --debug arrayIndexOutOfBounds.cpp 
Checking arrayIndexOutOfBounds.cpp...
[arrayIndexOutOfBounds.cpp:7]: (style) Variable 'a' is assigned a value that is never used.
[arrayIndexOutOfBounds.cpp:7]: (style) Variable 'b' is assigned a value that is never used.
[arrayIndexOutOfBounds.cpp:8]: (style) Variable 'c' is assigned a value that is never used.


##file arrayIndexOutOfBounds.cpp
1: struct S {
2: long m@1 [ 9 ] ;
3: } ;
4:
5: void f ( const struct S * s@2 )
6: {
7: long a@3 ; a@3 = s@2 . m@4 [ 9 ] ; long b@5 ; b@5 = s@2 . m@4 [ 9 ] ;
8: long c@6 ; c@6 = s@2 . m@4 [ 9 ] ;
9: }



##AST
 m 9 [
 f S s * (
 a s m . 9 [ =
 b s m . 9 [ =
 c s m . 9 [ =


##Value flow
Line 2
  9:{9}
Line 7
  9:{9}
  9:{9}
Line 8
  9:{9}
[arrayIndexOutOfBounds.cpp:7]: (error) Array 's.m[9]' accessed at index 9, which is out of bounds.
[arrayIndexOutOfBounds.cpp:8]: (error) Array 's.m[9]' accessed at index 9, which is out of bounds.
[arrayIndexOutOfBounds.cpp:5]: (style) The function 'f' is never used.

Change History (5)

comment:1 by kidkat, 4 years ago

Description: modified (diff)

It is actually being detected with the modified code

typedef struct {
    long m[9];
} S;

void f(const S *s)
{
    long a=s->m[8], b=s->m[9];
}
input.cpp:7:27: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
    long a=s->m[8], b=s->m[9];
                          ^

It seems this is somehow being omitted since it occurs on the same line. The column is different so it is a unique error and should be reported.

input.cpp:7:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
    long a=s->m[9], b=s->m[9];
               ^

comment:2 by kidkat, 18 months ago

My assumption was correct.

Using --emit-duplicates shows it:

input.cpp:7:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
    long a=s->m[9], b=s->m[9];
               ^
input.cpp:7:27: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
    long a=s->m[9], b=s->m[9];
                          ^
input.cpp:8:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
    long c=s->m[9];
               ^

See https://github.com/danmar/cppcheck/pull/4377 for an attempt of fixing this.

Last edited 18 months ago by kidkat (previous) (diff)

comment:3 by kidkat, 18 months ago

Owner: changed from noone to kidkat
Status: newassigned

comment:4 by kidkat, 17 months ago

Milestone: 2.18
Resolution: fixed
Status: assignedclosed

comment:5 by Daniel Marjamäki, 13 months ago

Priority: Normalsafety-cosmetic
Note: See TracTickets for help on using tickets.