| 2027 | } |
| 2028 | |
| 2029 | void CheckIOImpl::invalidScanfFormatWidthError(const Token* tok, nonneg int numFormat, int width, const Variable *var, const std::string& specifier) |
| 2030 | { |
| 2031 | MathLib::bigint arrlen = 0; |
| 2032 | std::string varname; |
| 2033 | |
| 2034 | if (var) { |
| 2035 | arrlen = var->dimension(0); |
| 2036 | varname = var->name(); |
| 2037 | } |
| 2038 | |
| 2039 | std::ostringstream errmsg; |
| 2040 | if (arrlen > width) { |
| 2041 | if (tok != nullptr && (!mSettings.certainty.isEnabled(Certainty::inconclusive) || !mSettings.severity.isEnabled(Severity::warning))) |
| 2042 | return; |
| 2043 | errmsg << "Width " << width << " given in format string (no. " << numFormat << ") is smaller than destination buffer" |
| 2044 | << " '" << varname << "[" << arrlen << "]'."; |
| 2045 | reportError(tok, Severity::warning, "invalidScanfFormatWidth_smaller", errmsg.str(), CWE(0U), Certainty::inconclusive); |
| 2046 | } else { |
| 2047 | errmsg << "Width " << width << " given in format string (no. " << numFormat << ") is larger than destination buffer '" |
| 2048 | << varname << "[" << arrlen << "]', use %" << (specifier == "c" ? arrlen : (arrlen - 1)) << specifier << " to prevent overflowing it."; |
| 2049 | reportError(tok, Severity::error, "invalidScanfFormatWidth", errmsg.str(), CWE687, Certainty::normal); |
| 2050 | } |
| 2051 | } |
| 2052 | |
| 2053 | void CheckIO::runChecks(const Tokenizer &tokenizer, ErrorLogger& errorLogger) |
| 2054 | { |
no test coverage detected