| 1016 | } |
| 1017 | |
| 1018 | bool CheckBufferOverrun::analyseWholeProgram1(const std::map<std::string, std::list<const CTU::FileInfo::CallBase *>> &callsMap, const CTU::FileInfo::UnsafeUsage &unsafeUsage, |
| 1019 | int type, ErrorLogger &errorLogger, int maxCtuDepth, const std::string& file0) |
| 1020 | { |
| 1021 | const CTU::FileInfo::FunctionCall *functionCall = nullptr; |
| 1022 | |
| 1023 | std::list<ErrorMessage::FileLocation> locationList = |
| 1024 | CTU::FileInfo::getErrorPath(CTU::FileInfo::InvalidValueType::bufferOverflow, |
| 1025 | unsafeUsage, |
| 1026 | callsMap, |
| 1027 | "Using argument ARG", |
| 1028 | &functionCall, |
| 1029 | false, |
| 1030 | maxCtuDepth); |
| 1031 | if (locationList.empty()) |
| 1032 | return false; |
| 1033 | |
| 1034 | const char *errorId = nullptr; |
| 1035 | std::string errmsg; |
| 1036 | CWE cwe(0); |
| 1037 | |
| 1038 | if (type == 1) { |
| 1039 | errorId = "ctuArrayIndex"; |
| 1040 | if (unsafeUsage.value > 0) |
| 1041 | errmsg = "Array index out of bounds; '" + unsafeUsage.myArgumentName + "' buffer size is " + MathLib::toString(functionCall->callArgValue.value) + " and it is accessed at offset " + MathLib::toString(unsafeUsage.value) + "."; |
| 1042 | else |
| 1043 | errmsg = "Array index out of bounds; buffer '" + unsafeUsage.myArgumentName + "' is accessed at offset " + MathLib::toString(unsafeUsage.value) + "."; |
| 1044 | cwe = (unsafeUsage.value > 0) ? CWE_BUFFER_OVERRUN : CWE_BUFFER_UNDERRUN; |
| 1045 | } else { |
| 1046 | errorId = "ctuPointerArith"; |
| 1047 | errmsg = "Pointer arithmetic overflow; '" + unsafeUsage.myArgumentName + "' buffer size is " + MathLib::toString(functionCall->callArgValue.value); |
| 1048 | cwe = CWE_POINTER_ARITHMETIC_OVERFLOW; |
| 1049 | } |
| 1050 | |
| 1051 | const ErrorMessage errorMessage(std::move(locationList), |
| 1052 | file0, |
| 1053 | Severity::error, |
| 1054 | errmsg, |
| 1055 | errorId, |
| 1056 | cwe, Certainty::normal); |
| 1057 | errorLogger.reportErr(errorMessage); |
| 1058 | |
| 1059 | return true; |
| 1060 | } |
| 1061 | |
| 1062 | void CheckBufferOverrunImpl::objectIndex() |
| 1063 | { |