| 1060 | } |
| 1061 | |
| 1062 | void CheckBufferOverrunImpl::objectIndex() |
| 1063 | { |
| 1064 | logChecker("CheckBufferOverrun::objectIndex"); |
| 1065 | const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase(); |
| 1066 | for (const Scope *functionScope : symbolDatabase->functionScopes) { |
| 1067 | for (const Token *tok = functionScope->bodyStart; tok != functionScope->bodyEnd; tok = tok->next()) { |
| 1068 | if (!Token::simpleMatch(tok, "[")) |
| 1069 | continue; |
| 1070 | const Token *obj = tok->astOperand1(); |
| 1071 | const Token *idx = tok->astOperand2(); |
| 1072 | if (!idx || !obj) |
| 1073 | continue; |
| 1074 | if (const ValueFlow::Value* v = idx->getKnownValue(ValueFlow::Value::ValueType::INT)) { |
| 1075 | if (v->intvalue == 0) |
| 1076 | continue; |
| 1077 | } |
| 1078 | |
| 1079 | std::vector<ValueFlow::Value> values = ValueFlow::getLifetimeObjValues(obj, false, -1); |
| 1080 | for (const ValueFlow::Value& v:values) { |
| 1081 | if (v.lifetimeKind != ValueFlow::Value::LifetimeKind::Address) |
| 1082 | continue; |
| 1083 | const Variable *var = v.tokvalue->variable(); |
| 1084 | if (!var) |
| 1085 | continue; |
| 1086 | if (var->isReference()) |
| 1087 | continue; |
| 1088 | if (var->isRValueReference()) |
| 1089 | continue; |
| 1090 | if (var->isArray()) |
| 1091 | continue; |
| 1092 | if (var->isPointer()) { |
| 1093 | if (!var->valueType()) |
| 1094 | continue; |
| 1095 | if (!obj->valueType()) |
| 1096 | continue; |
| 1097 | if (var->valueType()->pointer > obj->valueType()->pointer) |
| 1098 | continue; |
| 1099 | } |
| 1100 | if (obj->valueType() && var->valueType() && (obj->isCast() || (obj->isCpp() && isCPPCast(obj)) || obj->valueType()->pointer)) { // allow cast to a different type |
| 1101 | const auto varSize = var->valueType()->getSizeOf(mSettings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointee); |
| 1102 | if (varSize == 0) |
| 1103 | continue; |
| 1104 | if (obj->valueType()->type != var->valueType()->type) { |
| 1105 | if (ValueFlow::isOutOfBounds(makeSizeValue(varSize, v.path), idx).empty()) |
| 1106 | continue; |
| 1107 | } |
| 1108 | } |
| 1109 | if (v.path != 0) { |
| 1110 | std::vector<ValueFlow::Value> idxValues; |
| 1111 | std::copy_if(idx->values().cbegin(), |
| 1112 | idx->values().cend(), |
| 1113 | std::back_inserter(idxValues), |
| 1114 | [&](const ValueFlow::Value& vidx) { |
| 1115 | if (!vidx.isIntValue()) |
| 1116 | return false; |
| 1117 | return vidx.path == v.path || vidx.path == 0; |
| 1118 | }); |
| 1119 | if (std::any_of(idxValues.cbegin(), idxValues.cend(), [&](const ValueFlow::Value& vidx) { |
no test coverage detected