From 0383f66f5fd1d20524d6522d18a97ade6d39c26f Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Thu, 15 Oct 2026 17:38:32 +0200 Subject: [PATCH 1/9] Update testbufferoverrun.cpp --- test/testbufferoverrun.cpp | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index f6a2e1a5ec1..0910fb247c3 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -4618,9 +4618,8 @@ class TestBufferOverrun : public TestFixture { check("void f() {\n" " mymemset(\"abc\", 0, 20);\n" "}\n", settings); - TODO_ASSERT_EQUALS("[test.cpp:2]: (error) Buffer is accessed out of bounds.\n", - "", - errout_str()); + ASSERT_EQUALS("[test.cpp:2:12]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n", + errout_str()); check("void f() {\n" " mymemset(temp, \"abc\", 4);\n" From c6eab5fa9caea1d0944e2881191ddcffbf24696b Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Thu, 15 Oct 2026 17:40:04 +0200 Subject: [PATCH 2/9] Update checkbufferoverrun.cpp --- lib/checkbufferoverrun.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index bdd18ee21d2..800c74f5692 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -604,6 +604,11 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons return bufSizeVal; } } + } else if (bufTok->tokType() == Token::Type::eString) { + ValueFlow::Value strSizeVal; + strSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE; + strSizeVal.intvalue = Token::getStrArraySize(bufTok); + return strSizeVal; } } From dcee57bb0389c1dbcd377d9c707bee23d522fd60 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Thu, 15 Oct 2026 19:44:17 +0200 Subject: [PATCH 3/9] Fix, add test --- cfg/std.cfg | 3 --- lib/checkbufferoverrun.cpp | 5 ++-- test/testbufferoverrun.cpp | 51 +++++++++++++++++++++++++------------- 3 files changed, 37 insertions(+), 22 deletions(-) diff --git a/cfg/std.cfg b/cfg/std.cfg index 6c434b8715c..edf67e0534b 100644 --- a/cfg/std.cfg +++ b/cfg/std.cfg @@ -5030,7 +5030,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun - @@ -5116,7 +5115,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun - @@ -5233,7 +5231,6 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun - diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index 800c74f5692..8e1c19f34de 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -604,10 +604,11 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons return bufSizeVal; } } - } else if (bufTok->tokType() == Token::Type::eString) { + } else if (bufTok->tokType() == Token::Type::eString && bufTok->valueType()) { ValueFlow::Value strSizeVal; strSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE; - strSizeVal.intvalue = Token::getStrArraySize(bufTok); + const size_t charSize = bufTok->valueType()->type == ValueType::Type::WCHAR_T ? settings.platform.sizeof_wchar_t : 1; + strSizeVal.intvalue = Token::getStrArraySize(bufTok) * charSize; return strSizeVal; } } diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index 0910fb247c3..01f2329ebaa 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -229,6 +229,7 @@ class TestBufferOverrun : public TestFixture { TEST_CASE(buffer_overrun_36); TEST_CASE(buffer_overrun_37); TEST_CASE(buffer_overrun_38); + TEST_CASE(buffer_overrun_39); TEST_CASE(buffer_overrun_errorpath); TEST_CASE(buffer_overrun_bailoutIfSwitch); // ticket #2378 : bailoutIfSwitch TEST_CASE(buffer_overrun_function_array_argument); @@ -3484,23 +3485,6 @@ class TestBufferOverrun : public TestFixture { " (void)strxfrm(dest,src,3);\n" // << "}\n"); ASSERT_EQUALS("[test.cpp:6:19]: (error) Buffer is accessed out of bounds: dest [bufferAccessOutOfBounds]\n", errout_str()); - // source size is too small - check("void f(void) {\n" - " const char src[2] = \"ab\";\n" - " char dest[3] = \"abc\";\n" - " (void)strxfrm(dest,src,1);\n" - " (void)strxfrm(dest,src,2);\n" - " (void)strxfrm(dest,src,3);\n" // << - "}\n"); - ASSERT_EQUALS("[test.cpp:6:24]: (error) Buffer is accessed out of bounds: src [bufferAccessOutOfBounds]\n", errout_str()); - // source size is too small - check("void f(void) {\n" - " const char src[1] = \"a\";\n" - " char dest[3] = \"abc\";\n" - " (void)strxfrm(dest,src,1);\n" - " (void)strxfrm(dest,src,2);\n" // << - "}\n"); - ASSERT_EQUALS("[test.cpp:5:24]: (error) Buffer is accessed out of bounds: src [bufferAccessOutOfBounds]\n", errout_str()); } void buffer_overrun_33() { // #2019 @@ -3638,6 +3622,39 @@ class TestBufferOverrun : public TestFixture { ASSERT_EQUALS("", errout_str()); } + void buffer_overrun_39() { // #11765 + check("void f() {\n" + " char buf[128];\n" + " memcpy(buf, \"Error\", 6);\n" + "}\n"); + ASSERT_EQUALS("", errout_str()); + + check("void f() {\n" + " char buf[128];\n" + " memcpy(buf, \"Error\", 16);\n" + "}\n"); + ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: \"Error\" [bufferAccessOutOfBounds]\n", + errout_str()); + + check("void f() {\n" + " char buf[128];\n" + " memcpy(buf, L\"Error\", 10);\n" // at least 12 bytes on any platform + "}\n"); + ASSERT_EQUALS("", errout_str()); + + check("void f() {\n" + " char buf[128];\n" + " memcpy(buf, L\"Error\", 26);\n" // at most 24 bytes + "}\n"); + ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: L\"Error\" [bufferAccessOutOfBounds]\n", + errout_str()); + + check("int f(char* s) {\n" + " return memcmp(s, \"\\0\\0\\0\", 3);\n" + "}\n"); + ASSERT_EQUALS("", errout_str()); + } + void buffer_overrun_errorpath() { setMultiline(); Settings s = settings0; From a3879488bd2e79564176b9c3f2414baa51bdc5bf Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Thu, 15 Oct 2026 19:55:43 +0200 Subject: [PATCH 4/9] Fix --- lib/checkbufferoverrun.cpp | 8 +++++--- test/testbufferoverrun.cpp | 5 +++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp index 8e1c19f34de..7d9cb6d36d2 100644 --- a/lib/checkbufferoverrun.cpp +++ b/lib/checkbufferoverrun.cpp @@ -607,9 +607,11 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons } else if (bufTok->tokType() == Token::Type::eString && bufTok->valueType()) { ValueFlow::Value strSizeVal; strSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE; - const size_t charSize = bufTok->valueType()->type == ValueType::Type::WCHAR_T ? settings.platform.sizeof_wchar_t : 1; - strSizeVal.intvalue = Token::getStrArraySize(bufTok) * charSize; - return strSizeVal; + const size_t charSize = bufTok->valueType()->getSizeOf(settings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointee); + if (charSize > 0) { + strSizeVal.intvalue = Token::getStrArraySize(bufTok) * charSize; + return strSizeVal; + } } } diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index 01f2329ebaa..7f8d6332719 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -3653,6 +3653,11 @@ class TestBufferOverrun : public TestFixture { " return memcmp(s, \"\\0\\0\\0\", 3);\n" "}\n"); ASSERT_EQUALS("", errout_str()); + + check("int f(const char16_t* buf) {\n" + " return memcmp(buf, u\"abc\", 4 * sizeof(char16_t));\n" + "}\n"); + ASSERT_EQUALS("", errout_str()); } void buffer_overrun_errorpath() { From cd753bfd6b6ee6ad366a06d16f09545f59baf516 Mon Sep 17 00:00:00 2001 From: chrchr-github Date: Thu, 15 Oct 2026 20:02:29 +0200 Subject: [PATCH 5/9] Fix --- test/testbufferoverrun.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp index 7f8d6332719..2443635eb0e 100644 --- a/test/testbufferoverrun.cpp +++ b/test/testbufferoverrun.cpp @@ -3624,29 +3624,29 @@ class TestBufferOverrun : public TestFixture { void buffer_overrun_39() { // #11765 check("void f() {\n" - " char buf[128];\n" - " memcpy(buf, \"Error\", 6);\n" + " char buf[10];\n" + " memcpy(buf, \"abc\", 4);\n" "}\n"); ASSERT_EQUALS("", errout_str()); check("void f() {\n" " char buf[128];\n" - " memcpy(buf, \"Error\", 16);\n" + " memcpy(buf, \"abc\", 5);\n" "}\n"); - ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: \"Error\" [bufferAccessOutOfBounds]\n", + ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n", errout_str()); check("void f() {\n" " char buf[128];\n" - " memcpy(buf, L\"Error\", 10);\n" // at least 12 bytes on any platform + " memcpy(buf, L\"abc\", 4 * sizeof(wchar_t));\n" "}\n"); ASSERT_EQUALS("", errout_str()); check("void f() {\n" " char buf[128];\n" - " memcpy(buf, L\"Error\", 26);\n" // at most 24 bytes + " memcpy(buf, L\"abc\", 4 * sizeof(wchar_t) + 1);\n" "}\n"); - ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: L\"Error\" [bufferAccessOutOfBounds]\n", + ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: L\"abc\" [bufferAccessOutOfBounds]\n", errout_str()); check("int f(char* s) {\n" From 775b826ed636b61a21504f7495d3648965c7dd63 Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Fri, 16 Oct 2026 08:29:42 +0200 Subject: [PATCH 6/9] Update posix.cfg [skip ci] --- cfg/posix.cfg | 7 ------- 1 file changed, 7 deletions(-) diff --git a/cfg/posix.cfg b/cfg/posix.cfg index e0de433e1f1..660a048a977 100644 --- a/cfg/posix.cfg +++ b/cfg/posix.cfg @@ -2123,12 +2123,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - - @@ -2146,12 +2144,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - - @@ -4200,7 +4196,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - @@ -5472,7 +5467,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - @@ -5606,7 +5600,6 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s - From 778cb2e1ef8bccbbfb537d507e2b1259af9e60a8 Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Fri, 16 Oct 2026 08:31:26 +0200 Subject: [PATCH 7/9] Update windows.cfg [skip ci] --- cfg/windows.cfg | 3 --- 1 file changed, 3 deletions(-) diff --git a/cfg/windows.cfg b/cfg/windows.cfg index b2251900d42..1481da3a3a7 100644 --- a/cfg/windows.cfg +++ b/cfg/windows.cfg @@ -4293,12 +4293,10 @@ HFONT CreateFont( - - @@ -4632,7 +4630,6 @@ HFONT CreateFont( - From ecee9f70cedf5a901a87823e39829c01d637510d Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Fri, 16 Oct 2026 08:32:50 +0200 Subject: [PATCH 8/9] Update sqlite3.cfg --- cfg/sqlite3.cfg | 2 -- 1 file changed, 2 deletions(-) diff --git a/cfg/sqlite3.cfg b/cfg/sqlite3.cfg index 6c5811f1f75..c10179630f0 100644 --- a/cfg/sqlite3.cfg +++ b/cfg/sqlite3.cfg @@ -1403,13 +1403,11 @@ - - From 95276538498cdc2b5a8f8a6187a3836758c24f56 Mon Sep 17 00:00:00 2001 From: chrchr-github <78114321+chrchr-github@users.noreply.github.com> Date: Fri, 16 Oct 2026 08:51:06 +0200 Subject: [PATCH 9/9] Update posix.c --- test/cfg/posix.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/cfg/posix.c b/test/cfg/posix.c index 82cfd950792..d90e3f289e4 100644 --- a/test/cfg/posix.c +++ b/test/cfg/posix.c @@ -717,8 +717,9 @@ size_t bufferAccessOutOfBounds_strnlen(const char *s, size_t maxlen) { const char buf[2]={'4','2'}; size_t len = strnlen(buf,2); - // cppcheck-suppress bufferAccessOutOfBounds + // TODO cppcheck-suppress bufferAccessOutOfBounds len+=strnlen(buf,3); + len+=strnlen("ab",3); return len; } @@ -1606,4 +1607,4 @@ void pthread_define_test() (void)rwlock; PTHREAD_SCOPE_PROCESS; PTHREAD_SCOPE_SYSTEM; -} \ No newline at end of file +}