#6366 closed enhancement (fixed)
false negative: array index out of bounds issue not displayed during variable declaration with comma operator
| Reported by: | orbitcowboy | Owned by: | kidkat |
|---|---|---|---|
| Priority: | safety-cosmetic | Milestone: | 2.18 |
| Component: | Improve check | Version: | |
| Keywords: | arrayIndexOutOfBounds | Cc: |
Description (last modified by )
Cppcheck does not report all array index overruns, in case two overruns happen during a variable declaration, seperated by a comma:
typedef struct {
long m[9];
} S;
void f(const S *s)
{
long a=s->m[9], b=s->m[9];
long c=s->m[9];
}
Only the case a=s->m[9] and c=s->m[9] is reported and b=s->m[9] is missing.
$ cppcheck --enable=all --debug arrayIndexOutOfBounds.cpp
Checking arrayIndexOutOfBounds.cpp...
[arrayIndexOutOfBounds.cpp:7]: (style) Variable 'a' is assigned a value that is never used.
[arrayIndexOutOfBounds.cpp:7]: (style) Variable 'b' is assigned a value that is never used.
[arrayIndexOutOfBounds.cpp:8]: (style) Variable 'c' is assigned a value that is never used.
##file arrayIndexOutOfBounds.cpp
1: struct S {
2: long m@1 [ 9 ] ;
3: } ;
4:
5: void f ( const struct S * s@2 )
6: {
7: long a@3 ; a@3 = s@2 . m@4 [ 9 ] ; long b@5 ; b@5 = s@2 . m@4 [ 9 ] ;
8: long c@6 ; c@6 = s@2 . m@4 [ 9 ] ;
9: }
##AST
m 9 [
f S s * (
a s m . 9 [ =
b s m . 9 [ =
c s m . 9 [ =
##Value flow
Line 2
9:{9}
Line 7
9:{9}
9:{9}
Line 8
9:{9}
[arrayIndexOutOfBounds.cpp:7]: (error) Array 's.m[9]' accessed at index 9, which is out of bounds.
[arrayIndexOutOfBounds.cpp:8]: (error) Array 's.m[9]' accessed at index 9, which is out of bounds.
[arrayIndexOutOfBounds.cpp:5]: (style) The function 'f' is never used.
Change History (5)
comment:1 by , 4 years ago
| Description: | modified (diff) |
|---|
comment:2 by , 18 months ago
My assumption was correct.
Using --emit-duplicates shows it:
input.cpp:7:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
long a=s->m[9], b=s->m[9];
^
input.cpp:7:27: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
long a=s->m[9], b=s->m[9];
^
input.cpp:8:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds]
long c=s->m[9];
^
See https://github.com/danmar/cppcheck/pull/4377 for an attempt of fixing this.
comment:3 by , 18 months ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:4 by , 17 months ago
| Milestone: | → 2.18 |
|---|---|
| Resolution: | → fixed |
| Status: | assigned → closed |
comment:5 by , 13 months ago
| Priority: | Normal → safety-cosmetic |
|---|
Note:
See TracTickets
for help on using tickets.
It is actually being detected with the modified code
typedef struct { long m[9]; } S; void f(const S *s) { long a=s->m[8], b=s->m[9]; }input.cpp:7:27: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds] long a=s->m[8], b=s->m[9]; ^It seems this is somehow being omitted since it occurs on the same line. The column is different so it is a unique error and should be reported.
input.cpp:7:16: error: Array 's->m[9]' accessed at index 9, which is out of bounds. [arrayIndexOutOfBounds] long a=s->m[9], b=s->m[9]; ^