From 2238c470d953c3c0b7d483d205cf24b851f44091 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Sat, 27 Aug 2022 20:37:10 +0200 Subject: [PATCH 1/3] Fix #8295 FN (error) Buffer is accessed out of bounds (wcpncpy, wcsncpy) --- cfg/posix.cfg | 22 ++++++++++++++++++++++ cfg/std.cfg | 20 ++++++++++++++++++++ lib/checkbufferoverrun.cpp | 12 +++++++++--- lib/library.cpp | 6 +++--- test/cfg/posix.c | 8 ++++++++ test/cfg/std.c | 8 ++++++++ 6 files changed, 70 insertions(+), 6 deletions(-) diff --git a/cfg/posix.cfg b/cfg/posix.cfg index 9fa1597f433..58bace66b3b 100644 --- a/cfg/posix.cfg +++ b/cfg/posix.cfg @@ -5484,6 +5484,28 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s 0: + + + + + false + + + + + + + + + + + + + + + 0: + + diff --git a/cfg/std.cfg b/cfg/std.cfg index 86ce3954a2c..b45d1340c97 100644 --- a/cfg/std.cfg +++ b/cfg/std.cfg @@ -4994,6 +4994,26 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun 0: + + + + false + + + + + + + + + + + + + + 0: + + diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index f939312e38b..db5c8c64546 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -593,10 +593,16 @@ static bool checkBufferSize(const Token *ftok, const Library::ArgumentChecks::Mi return Token::getStrLength(strtoken) < bufferSize; } break; - case Library::ArgumentChecks::MinSize::Type::ARGVALUE: - if (arg && arg->hasKnownIntValue()) - return arg->getKnownIntValue() <= bufferSize; + case Library::ArgumentChecks::MinSize::Type::ARGVALUE: { + if (arg && arg->hasKnownIntValue()) { + MathLib::bigint myMinsize = arg->getKnownIntValue(); + unsigned int baseSize = tokenizer->sizeOfType(minsize.baseType); + if (baseSize != 0) + myMinsize *= baseSize; + return myMinsize <= bufferSize; + } break; + } case Library::ArgumentChecks::MinSize::Type::SIZEOF: // TODO break; diff --git a/lib/library.cpp b/lib/library.cpp index c22d76c3cba..f74b000edb2 100644 --- a/lib/library.cpp +++ b/lib/library.cpp @@ -783,9 +783,6 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co return Error(ErrorCode::BAD_ATTRIBUTE_VALUE, valueattr); ac.minsizes.emplace_back(type, 0); ac.minsizes.back().value = minsizevalue; - const char* baseTypeAttr = argnode->Attribute("baseType"); - if (baseTypeAttr) - ac.minsizes.back().baseType = baseTypeAttr; } else { const char *argattr = argnode->Attribute("arg"); if (!argattr) @@ -804,6 +801,9 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co ac.minsizes.back().arg2 = arg2attr[0] - '0'; } } + const char* baseTypeAttr = argnode->Attribute("baseType"); // used by VALUE, ARGVALUE + if (baseTypeAttr) + ac.minsizes.back().baseType = baseTypeAttr; } else if (argnodename == "iterator") { diff --git a/test/cfg/posix.c b/test/cfg/posix.c index aad6217ee20..195f86f8575 100644 --- a/test/cfg/posix.c +++ b/test/cfg/posix.c @@ -564,6 +564,14 @@ size_t bufferAccessOutOfBounds_strnlen(const char *s, size_t maxlen) return len; } +void bufferAccessOutOfBounds_wcpncpy() +{ + wchar_t s[16]; + wcpncpy(s, L"abc", 16); + // cppcheck-suppress bufferAccessOutOfBounds + wcpncpy(s, L"abc", 17); +} + size_t nullPointer_strnlen(const char *s, size_t maxlen) { // No warning shall be shown: diff --git a/test/cfg/std.c b/test/cfg/std.c index 9ca3a61f06c..e60e9063704 100644 --- a/test/cfg/std.c +++ b/test/cfg/std.c @@ -556,6 +556,14 @@ void bufferAccessOutOfBounds_wcsftime(wchar_t* ptr, size_t maxsize, const wchar_ (void)wcsftime(ptr, maxsize, format, timeptr); } +void bufferAccessOutOfBounds_wcsncpy() +{ + wchar_t s[16]; + wcsncpy(s, L"abc", 16); + // cppcheck-suppress bufferAccessOutOfBounds + wcsncpy(s, L"abc", 17); +} + int nullPointer_wcsncmp(const wchar_t* s1, const wchar_t* s2, size_t n) { // cppcheck-suppress nullPointer From b76e74ed1d6f27e5ca4de568eedd77a1de1d4329 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Sat, 27 Aug 2022 21:39:21 +0200 Subject: [PATCH 2/3] Fix cfg, validation --- cfg/cppcheck-cfg.rng | 22 +++++++++++++++++++++- cfg/posix.cfg | 24 +----------------------- cfg/std.cfg | 22 +--------------------- 3 files changed, 23 insertions(+), 45 deletions(-) diff --git a/cfg/cppcheck-cfg.rng b/cfg/cppcheck-cfg.rng index b81a3533526..2c18e85599b 100644 --- a/cfg/cppcheck-cfg.rng +++ b/cfg/cppcheck-cfg.rng @@ -283,7 +283,6 @@ strlen - argvalue sizeof mul @@ -310,6 +309,27 @@ + + + + argvalue + + + + + + + + + + + + + + + + + diff --git a/cfg/posix.cfg b/cfg/posix.cfg index 58bace66b3b..83766ed1215 100644 --- a/cfg/posix.cfg +++ b/cfg/posix.cfg @@ -5449,7 +5449,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - + @@ -5484,28 +5484,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s 0: - - - - - false - - - - - - - - - - - - - - - 0: - - diff --git a/cfg/std.cfg b/cfg/std.cfg index b45d1340c97..a7387dfb353 100644 --- a/cfg/std.cfg +++ b/cfg/std.cfg @@ -4994,26 +4994,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun 0: - - - - false - - - - - - - - - - - - - - 0: - - @@ -5379,7 +5359,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun - + From bbd9e96eb9de32b314c75885de03e3d63ecd6f87 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Sat, 27 Aug 2022 22:01:14 +0200 Subject: [PATCH 3/3] Fix validation --- cfg/cppcheck-cfg.rng | 3 --- 1 file changed, 3 deletions(-) diff --git a/cfg/cppcheck-cfg.rng b/cfg/cppcheck-cfg.rng index 2c18e85599b..1f7b37de26b 100644 --- a/cfg/cppcheck-cfg.rng +++ b/cfg/cppcheck-cfg.rng @@ -323,9 +323,6 @@ - - -