Skip to content

Fix 14934: detect out-of-bounds access to global new arrays - #8828

Open
JeewoongKim wants to merge 1 commit into
cppcheck-opensource:mainfrom
JeewoongKim:fix-14934-global-buffer-size
Open

Fix 14934: detect out-of-bounds access to global new arrays#8828
JeewoongKim wants to merge 1 commit into
cppcheck-opensource:mainfrom
JeewoongKim:fix-14934-global-buffer-size

Conversation

@JeewoongKim

Copy link
Copy Markdown
Contributor

Global pointers initialized with new[] did not get a BUFFER_SIZE value because
valueFlowDynamicBufferSize() only handled allocations found inside function scopes.

This change propagates the initial buffer size into main(). The existing value-flow analysis
invalidate it after assignments or calls that may modify the global pointer.

Added regression tests for the reported out-of-bounds false negative, reassignment of the
global pointer, and an unknown function call that may modify it.

@JeewoongKim
JeewoongKim force-pushed the fix-14934-global-buffer-size branch 2 times, most recently from bc87761 to d7d165a Compare September 6, 2026 10:48
@chrchr-github

Copy link
Copy Markdown
Collaborator

Thanks for working on this. I'm not sure this approach is feasible though.
Global variables might be reassigned at any point, which would invalidate any previous buffer size. That's why buffer sizes are currently tracked only at the function level.
Also, this PR only handles new and not e.g. malloc().

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants