Fixed ticket #329 (snprintf size is out of bounds when two variables …

…in one scope with similar names) FIXME: Because it's fix for simplifyTokenList() test should be moved to test/testsimplifytokens.cpp file. http://apps.sourceforge.net/trac/cppcheck/ticket/329
danmar · Jun 5, 2009 · 58781c7 · 58781c7
1 parent 52a8368
commit 58781c7
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 2 deletions.
diff --git a/src/tokenize.cpp b/src/tokenize.cpp
@@ -1250,6 +1250,12 @@ void Tokenizer::simplifyTokenList()
             }
         }
 
+        else if (Token::Match(tok, "sizeof ( %var% )") && tok->tokAt(2)->varId() > 0)
+        {
+            // don't try to replace size of variable if variable has
+            // similar name with type (#329)
+        }
+
         else if (Token::Match(tok, "sizeof ( %type% )"))
         {
             const char *type = tok->strAt(2);

diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -68,6 +68,7 @@ class TestBufferOverrun : public TestFixture
 
         TEST_CASE(sizeof1);
         TEST_CASE(sizeof2);
+        TEST_CASE(sizeof3);
 
         TEST_CASE(array_index_1);
         TEST_CASE(array_index_2);
@@ -201,8 +202,17 @@ class TestBufferOverrun : public TestFixture
         ASSERT_EQUALS("[test.cpp:4]: (all) Array index out of bounds\n", errout.str());
     }
 
-
-
+    void sizeof3()
+    {
+        check("void f()\n"
+              "{\n"
+              "    char group[32];\n"
+              "    snprintf(group, sizeof(group), \"%u\", 0);\n"
+              "    struct group *gr;\n"
+              "    snprintf(group, sizeof(group), \"%u\", gr->gr_gid);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
 
     void array_index_1()
     {