Skip to content

Fix #15195: False negative: bufferAccessOutOfBounds with address of member #9012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ludviggunne merged 2 commits into from
Nov 12, 2026
Merged

Fix #15195: False negative: bufferAccessOutOfBounds with address of member #9012

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e3c5aa6
test
ludviggunne Nov 10, 2026
76406a8
fix
ludviggunne Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions lib/checkbufferoverrun.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -585,6 +585,10 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons
}
bufTok = bufTok->astOperand1();
}
while (Token::Match(bufTok, ".|::"))

@dmcppcheck dmcppcheck Nov 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

This unwraps &x.m to m for every kind of member, scalars and struct members included. So there are now error reports on the common idiom of writing the enclosing object through the address of a member:

struct S { int first; int second; };
void g1(S &s) { memset(&s.first, 0, sizeof(S)); }               // error: &s.first
void g3(S *s) { memset(&s->second, 0, sizeof(S) - sizeof(int)); } // error: &s->second
void S2::clr() { memset(&this->first, 0, sizeof(*this)); }       // error

Base reported none of these. The ticket is about array members, so consider unwrapping only when the member has array dimensions, or skipping the case where the access stays inside the outer object.

bufTok = bufTok->astOperand2();
if (!bufTok)
return ValueFlow::Value(-1);
}
const Variable *var = bufTok->variable();

Expand Down Expand Up @@ -756,8 +760,16 @@ void CheckBufferOverrunImpl::bufferOverflow()
if (bufferSize.intvalue <= 0)
continue;
// buffer size == 1 => do not warn for dynamic memory
if (bufferSize.intvalue == 1 && Token::simpleMatch(argtok->astParent(), ".")) { // TODO: check if parent was allocated dynamically
const Token *tok2 = argtok;
const Token *memberTok = argtok;
if (memberTok->isUnaryOp("&")) {
memberTok = memberTok->astOperand1();
if (Token::simpleMatch(memberTok, "["))
memberTok = memberTok->astOperand1();
while (Token::Match(memberTok, ".|::"))
memberTok = memberTok->astOperand2();
}
if (bufferSize.intvalue == 1 && memberTok && Token::simpleMatch(memberTok->astParent(), ".")) { // TODO: check if parent was allocated dynamically
const Token *tok2 = memberTok;
while (Token::simpleMatch(tok2->astParent(), "."))
tok2 = tok2->astParent();
while (Token::Match(tok2, "[|."))
Expand Down
41 changes: 41 additions & 0 deletions test/testbufferoverrun.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,7 @@ class TestBufferOverrun : public TestFixture {
TEST_CASE(buffer_overrun_37);
TEST_CASE(buffer_overrun_38);
TEST_CASE(buffer_overrun_39);
TEST_CASE(buffer_overrun_40);
TEST_CASE(buffer_overrun_errorpath);
TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch
TEST_CASE(buffer_overrun_function_array_argument);
Expand Down Expand Up @@ -3692,6 +3693,46 @@ class TestBufferOverrun : public TestFixture {
errout_str());
}

void buffer_overrun_40() {
check("struct S { char a[4]; };\n"
"struct T { struct S s; };\n"
"int f(const struct T *p, const struct T *q) {\n"
" return memcmp(&p->s.a, &q->s, 16);\n"
"}\n");
ASSERT_EQUALS("[test.cpp:4:19]: (error) Buffer is accessed out of bounds: p->s.a [bufferAccessOutOfBounds]\n"
"[test.cpp:4:28]: (error) Buffer is accessed out of bounds: &q->s [bufferAccessOutOfBounds]\n",
errout_str());

check("struct S { char a[4]; };\n"
"struct T { struct S s; };\n"
"int f(const struct T *p, const struct T *q) {\n"
" return memcmp(&p->s.a, &q->s, 4);\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check("struct S { char a[4]; };\n"
"struct T { struct S s; };\n"
"void f(char *d) {\n"
" struct S s;\n"
" struct T t;\n"
" memcpy(d, &s.a, 16);\n"
" memcpy(d, &s.a[0], 16);\n"
" memcpy(d, &t.s, 16);\n"
"}\n");
ASSERT_EQUALS("[test.cpp:6:15]: (error) Buffer is accessed out of bounds: s.a [bufferAccessOutOfBounds]\n"
"[test.cpp:7:15]: (error) Buffer is accessed out of bounds: &s.a[0] [bufferAccessOutOfBounds]\n"
"[test.cpp:8:15]: (error) Buffer is accessed out of bounds: &t.s [bufferAccessOutOfBounds]\n",
errout_str());

check("struct Foo { int n; char data[1]; };\n"
"void f(struct Foo *p, const char *src) {\n"
" memcpy(p->data, src, 10);\n"
" memcpy(&p->data, src, 10);\n"
" memcpy(&p->data[0], src, 10);\n"
"}\n");
ASSERT_EQUALS("", errout_str());
}

void buffer_overrun_errorpath() {
setMultiline();
Settings s = settings0;
Expand Down
Loading