Skip to content

Fix #15124 FN bufferAccessOutOfBounds with wmemcpy() #8951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chrchr-github wants to merge 3 commits into
base: main
Choose a base branch
from
+53 −11
Open

Fix #15124 FN bufferAccessOutOfBounds with wmemcpy() #8951

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8c6a368
Update std.cfg
chrchr-github Oct 21, 2026
1367f16
Update std.c
chrchr-github Oct 21, 2026
12ac67f
Fix more functions
web-flow Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions cfg/gnu.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -650,7 +650,7 @@
<not-bool/>
</arg>
</function>
<!-- https://man7.org/linux/man-pages/man3/mempcpy.3.html-->
<!-- https://man7.org/linux/man-pages/man3/wmempcpy.3.html -->
<!-- wchar_t *wmempcpy(wchar_t *restrict dest, const wchar_t *restrict src, size_t n);-->
<function name="wmempcpy">
<returnValue type="wchar_t *"/>
Expand All @@ -659,12 +659,12 @@
<not-overlapping-data ptr1-arg="1" ptr2-arg="2" size-arg="3"/>
<arg nr="1" direction="out">
<not-null/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2" direction="in">
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="3" direction="in">
<not-uninit/>
Expand Down
16 changes: 8 additions & 8 deletions cfg/std.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3928,7 +3928,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
<arg nr="1">
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2" direction="in">
<not-uninit/>
Expand Down Expand Up @@ -3974,12 +3974,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
<arg nr="1" direction="in">
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2" direction="in">
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="3" direction="in">
<not-uninit/>
Expand Down Expand Up @@ -4016,12 +4016,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
<not-overlapping-data ptr1-arg="1" ptr2-arg="2" count-arg="3"/>
<arg nr="1" direction="out">
<not-null/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2" direction="in">
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>

@dmcppcheck dmcppcheck Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

wmemmove, wmemset and wmemchr in this file, and wmempcpy in cfg/gnu.cfg (lines 662/667), also take a count of wide characters. They still use <minsize type="argvalue" arg="3"/> without baseType="wchar_t", so they have the same false negative. For example, wchar_t a[4]; wmemmove(a, L"abcd", 5); and wmemset(a, L'x', 5); give no warning with this PR. Please fix them here too and add tests.

</arg>
<arg nr="3" direction="in">
<not-uninit/>
Expand Down Expand Up @@ -4081,13 +4081,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
<leak-ignore/>
<arg nr="1" direction="out">
<not-null/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2">
<!-- TODO: direction? memory could be overwritten -->
<not-null/>
<not-uninit/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="3" direction="in">
<not-uninit/>
Expand Down Expand Up @@ -4141,7 +4141,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
<leak-ignore/>
<arg nr="1" direction="out">
<not-null/>
<minsize type="argvalue" arg="3"/>
<minsize type="argvalue" arg="3" baseType="wchar_t"/>
</arg>
<arg nr="2" direction="in">
<not-uninit/>
Expand Down
7 changes: 7 additions & 0 deletions test/cfg/gnu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,13 @@ wchar_t *nullPointer_wmempcpy(wchar_t *dest, const wchar_t *src, size_t n)
return wmempcpy(dest,src,n);
}

void bufferAccessOutOfBounds_wmempcpy(const wchar_t *src)
{
wchar_t buf[3];
// cppcheck-suppress bufferAccessOutOfBounds
wmempcpy(buf, src, 5);
}

int uninitvar_getpw(uid_t uid, char *buf)
{
uid_t someUid;
Expand Down
35 changes: 35 additions & 0 deletions test/cfg/std.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,20 @@ void bufferAccessOutOfBounds_wcsncpy()
wcsncpy(s, L"abc", 17);
}

void bufferAccessOutOfBounds_wmemcpy()
{
wchar_t a[4];
// cppcheck-suppress bufferAccessOutOfBounds
wmemcpy(a, L"abcd", 5);
}

int bufferAccessOutOfBounds_wmemcmp(const wchar_t* b)
{
const wchar_t a[4] = { L'a', L'b', L'c', L'd' };
// cppcheck-suppress bufferAccessOutOfBounds
return wmemcmp(a, b, 5);
}

int nullPointer_wcsncmp(const wchar_t* s1, const wchar_t* s2, size_t n)
{
// cppcheck-suppress nullPointer
Expand Down Expand Up @@ -2937,6 +2951,27 @@ void *bufferAccessOutOfBounds_memchr(const void *s, int c, size_t n)
return memchr(s,c,n);
}

bool bufferAccessOutOfBounds_wmemchr(wchar_t c)
{
const wchar_t buf[] = {'a', 'b', 'c'};
// cppcheck-suppress bufferAccessOutOfBounds
return wmemchr(buf, c, 5) != NULL;
}

void bufferAccessOutOfBounds_wmemset(wchar_t c)
{
wchar_t buf[3];
// cppcheck-suppress bufferAccessOutOfBounds
wmemset(buf, c, 5);
}

void bufferAccessOutOfBounds_wmemmove(const wchar_t* s)
{
wchar_t d[3];
// cppcheck-suppress bufferAccessOutOfBounds
wmemmove(d, s, 5);
}

void uninitvar_wmemchr(void)
{
const wchar_t *cs;
Expand Down
Loading