Skip to content

Commit 406dab5

Browse files
author
Nikita Kraiouchkine
committed
Add RULE-21-18 test-case
1 parent 7f766cb commit 406dab5

File tree

2 files changed

+142
-1
lines changed

2 files changed

+142
-1
lines changed

‎c/misra/test/rules/RULE-21-18/StringLibrarySizeArgumentOutOfBounds.expected

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,35 @@
1-
No expected results have yet been specified
1+
| test.c:16:5:16:10 | call to memcpy | The size of the $@ passed to memcpy is 64 bytes, but the $@ is 65 bytes. | test.c:16:12:16:15 | buf1 | write buffer | test.c:16:24:16:39 | ... + ... | size argument |
2+
| test.c:16:5:16:10 | call to memcpy | The size of the $@ passed to memcpy is 64 bytes, but the $@ is 65 bytes. | test.c:16:18:16:21 | buf2 | read buffer | test.c:16:24:16:39 | ... + ... | size argument |
3+
| test.c:18:5:18:10 | call to memcpy | The size of the $@ passed to memcpy is 63 bytes, but the $@ is 64 bytes. | test.c:18:12:18:19 | ... + ... | write buffer | test.c:18:28:18:39 | sizeof(<expr>) | size argument |
4+
| test.c:18:5:18:10 | call to memcpy | The size of the $@ passed to memcpy is 64 bytes, but the size of the $@ is only 63 bytes. | test.c:18:22:18:25 | buf2 | read buffer | test.c:18:12:18:19 | ... + ... | write buffer |
5+
| test.c:19:5:19:10 | call to memcpy | The size of the $@ passed to memcpy is 63 bytes, but the $@ is 128 bytes. | test.c:19:18:19:25 | ... + ... | read buffer | test.c:19:28:19:43 | ... * ... | size argument |
6+
| test.c:19:5:19:10 | call to memcpy | The size of the $@ passed to memcpy is 64 bytes, but the $@ is 128 bytes. | test.c:19:12:19:15 | buf1 | write buffer | test.c:19:28:19:43 | ... * ... | size argument |
7+
| test.c:25:5:25:10 | call to memcmp | The size of the $@ passed to memcmp is 64 bytes, but the $@ is 65 bytes. | test.c:25:12:25:15 | buf1 | write buffer | test.c:25:24:25:39 | ... + ... | size argument |
8+
| test.c:25:5:25:10 | call to memcmp | The size of the $@ passed to memcmp is 64 bytes, but the $@ is 65 bytes. | test.c:25:18:25:21 | buf2 | read buffer | test.c:25:24:25:39 | ... + ... | size argument |
9+
| test.c:27:5:27:10 | call to memcmp | The size of the $@ passed to memcmp is 63 bytes, but the $@ is 64 bytes. | test.c:27:12:27:19 | ... + ... | write buffer | test.c:27:28:27:39 | sizeof(<expr>) | size argument |
10+
| test.c:27:5:27:10 | call to memcmp | The size of the $@ passed to memcmp is 64 bytes, but the size of the $@ is only 63 bytes. | test.c:27:22:27:25 | buf2 | read buffer | test.c:27:12:27:19 | ... + ... | write buffer |
11+
| test.c:28:5:28:10 | call to memcmp | The size of the $@ passed to memcmp is 63 bytes, but the $@ is 128 bytes. | test.c:28:18:28:25 | ... + ... | read buffer | test.c:28:28:28:43 | ... * ... | size argument |
12+
| test.c:28:5:28:10 | call to memcmp | The size of the $@ passed to memcmp is 64 bytes, but the $@ is 128 bytes. | test.c:28:12:28:15 | buf1 | write buffer | test.c:28:28:28:43 | ... * ... | size argument |
13+
| test.c:33:5:33:10 | call to memchr | The size of the $@ passed to memchr is 128 bytes, but the $@ is 129 bytes. | test.c:33:12:33:14 | buf | read buffer | test.c:33:20:33:34 | ... + ... | size argument |
14+
| test.c:34:5:34:10 | call to memchr | The size of the $@ passed to memchr is 128 bytes, but the $@ is 129 bytes. | test.c:34:12:34:14 | buf | read buffer | test.c:34:20:34:34 | ... + ... | size argument |
15+
| test.c:36:5:36:10 | call to memchr | The $@ passed to memchr is null. | test.c:36:12:36:15 | 0 | argument | test.c:36:12:36:15 | 0 | |
16+
| test.c:41:5:41:10 | call to memset | The size of the $@ passed to memset is 128 bytes, but the $@ is 129 bytes. | test.c:41:12:41:14 | buf | write buffer | test.c:41:20:41:34 | ... + ... | size argument |
17+
| test.c:42:5:42:10 | call to memset | The size of the $@ passed to memset is 128 bytes, but the $@ is 129 bytes. | test.c:42:12:42:14 | buf | write buffer | test.c:42:20:42:34 | ... + ... | size argument |
18+
| test.c:44:5:44:10 | call to memset | The $@ passed to memset is null. | test.c:44:12:44:15 | 0 | argument | test.c:44:12:44:15 | 0 | |
19+
| test.c:50:5:50:11 | call to memmove | The size of the $@ passed to memmove is 128 bytes, but the $@ is 129 bytes. | test.c:50:13:50:16 | buf1 | write buffer | test.c:50:25:50:40 | ... + ... | size argument |
20+
| test.c:50:5:50:11 | call to memmove | The size of the $@ passed to memmove is 256 bytes, but the size of the $@ is only 128 bytes. | test.c:50:19:50:22 | buf2 | read buffer | test.c:50:13:50:16 | buf1 | write buffer |
21+
| test.c:52:5:52:11 | call to memmove | The size of the $@ passed to memmove is 127 bytes, but the $@ is 128 bytes. | test.c:52:13:52:20 | ... + ... | write buffer | test.c:52:29:52:40 | sizeof(<expr>) | size argument |
22+
| test.c:52:5:52:11 | call to memmove | The size of the $@ passed to memmove is 256 bytes, but the size of the $@ is only 127 bytes. | test.c:52:23:52:26 | buf2 | read buffer | test.c:52:13:52:20 | ... + ... | write buffer |
23+
| test.c:54:5:54:11 | call to memmove | The size of the $@ passed to memmove is 128 bytes, but the $@ is 256 bytes. | test.c:54:19:54:22 | buf1 | read buffer | test.c:54:25:54:36 | sizeof(<expr>) | size argument |
24+
| test.c:62:5:62:11 | call to strncpy | The size of the $@ passed to strncpy is 128 bytes, but the $@ is 129 bytes. | test.c:62:13:62:16 | buf1 | write buffer | test.c:62:25:62:40 | ... + ... | size argument |
25+
| test.c:62:5:62:11 | call to strncpy | The size of the $@ passed to strncpy is 256 bytes, but the size of the $@ is only 128 bytes. | test.c:62:19:62:22 | buf2 | read buffer | test.c:62:13:62:16 | buf1 | write buffer |
26+
| test.c:64:5:64:11 | call to strncpy | The size of the $@ passed to strncpy is 127 bytes, but the $@ is 128 bytes. | test.c:64:13:64:20 | ... + ... | write buffer | test.c:64:29:64:40 | sizeof(<expr>) | size argument |
27+
| test.c:64:5:64:11 | call to strncpy | The size of the $@ passed to strncpy is 256 bytes, but the size of the $@ is only 127 bytes. | test.c:64:23:64:26 | buf2 | read buffer | test.c:64:13:64:20 | ... + ... | write buffer |
28+
| test.c:77:5:77:11 | call to strncat | The $@ passed to strncat might not be null-terminated. | test.c:77:13:77:16 | buf1 | argument | test.c:77:13:77:16 | buf1 | |
29+
| test.c:81:5:81:11 | call to strncat | The size of the $@ passed to strncat is 6 bytes, but the size of the $@ is only 5 bytes. | test.c:81:25:81:31 | 12345 | read buffer | test.c:81:13:81:20 | call to get_ca_5 | write buffer |
30+
| test.c:83:5:83:11 | call to strncat | The size of the $@ passed to strncat is 5 bytes, but the size of the $@ is only 4 bytes. | test.c:83:29:83:34 | 1234 | read buffer | test.c:83:13:83:26 | ... + ... | write buffer |
31+
| test.c:94:5:94:11 | call to strncmp | The size of the $@ passed to strncmp is 5 bytes, but the $@ is 6 bytes. | test.c:94:23:94:30 | ca5_good | read buffer | test.c:94:33:94:33 | 6 | size argument |
32+
| test.c:95:5:95:11 | call to strncmp | The size of the $@ passed to strncmp is 5 bytes, but the $@ is 6 bytes. | test.c:95:13:95:20 | ca5_good | write buffer | test.c:95:32:95:32 | 6 | size argument |
33+
| test.c:95:5:95:11 | call to strncmp | The size of the $@ passed to strncmp is 5 bytes, but the $@ is 6 bytes. | test.c:95:23:95:29 | ca5_bad | read buffer | test.c:95:32:95:32 | 6 | size argument |
34+
| test.c:102:5:102:11 | call to strxfrm | The size of the $@ passed to strxfrm is 64 bytes, but the $@ is 65 bytes. | test.c:102:13:102:15 | buf | write buffer | test.c:102:25:102:39 | ... + ... | size argument |
35+
| test.c:104:5:104:11 | call to strxfrm | The $@ passed to strxfrm might not be null-terminated. | test.c:104:22:104:25 | buf2 | argument | test.c:104:22:104:25 | buf2 | |

‎c/misra/test/rules/RULE-21-18/test.c

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// test partially copied from CERT-C ARR38-C test
2+
#include <stdlib.h>
3+
#include <string.h>
4+
5+
char *get_ca_5(void) {
6+
void *ptr = malloc(5 * sizeof(char));
7+
memset(ptr, 0, 5 * sizeof(char));
8+
return (char *)ptr;
9+
}
10+
11+
void test(void) {
12+
{
13+
char buf1[64];
14+
char buf2[64];
15+
memcpy(buf1, buf2, sizeof(buf1)); // COMPLIANT
16+
memcpy(buf1, buf2, sizeof(buf1) + 1); // NON_COMPLIANT
17+
memcpy(buf1, buf2, sizeof(buf1) - 1); // COMPLIANT
18+
memcpy(buf1 + 1, buf2, sizeof(buf1)); // NON_COMPLIANT
19+
memcpy(buf1, buf2 + 1, sizeof(buf1) * 2); // NON_COMPLIANT
20+
}
21+
{
22+
char buf1[64];
23+
char buf2[64];
24+
memcmp(buf1, buf2, sizeof(buf1)); // COMPLIANT
25+
memcmp(buf1, buf2, sizeof(buf1) + 1); // NON_COMPLIANT
26+
memcmp(buf1, buf2, sizeof(buf1) - 1); // COMPLIANT
27+
memcmp(buf1 + 1, buf2, sizeof(buf1)); // NON_COMPLIANT
28+
memcmp(buf1, buf2 + 1, sizeof(buf1) * 2); // NON_COMPLIANT
29+
}
30+
{
31+
char buf[128];
32+
memchr(buf, 0, sizeof(buf)); // COMPLIANT
33+
memchr(buf, 0, sizeof(buf) + 1); // NON_COMPLIANT
34+
memchr(buf, 0, sizeof(buf) + 1); // NON_COMPLIANT
35+
memchr(buf, 0, sizeof(buf) - 1); // COMPLIANT
36+
memchr(NULL, 0, sizeof(buf)); // NON_COMPLIANT
37+
}
38+
{
39+
char buf[128];
40+
memset(buf, 0, sizeof(buf)); // COMPLIANT
41+
memset(buf, 0, sizeof(buf) + 1); // NON_COMPLIANT
42+
memset(buf, 0, sizeof(buf) + 1); // NON_COMPLIANT
43+
memset(buf, 0, sizeof(buf) - 1); // COMPLIANT
44+
memset(NULL, 0, sizeof(buf)); // NON_COMPLIANT
45+
}
46+
{
47+
char buf1[128];
48+
char buf2[256];
49+
memmove(buf1, buf2, sizeof(buf1)); // COMPLIANT
50+
memmove(buf1, buf2, sizeof(buf1) + 1); // NON_COMPLIANT
51+
memmove(buf1, buf2, sizeof(buf1) - 1); // COMPLIANT
52+
memmove(buf1 + 1, buf2, sizeof(buf1)); // NON_COMPLIANT
53+
memmove(buf1, buf2 + 1, sizeof(buf1)); // COMPLIANT
54+
memmove(buf2, buf1, sizeof(buf2)); // NON_COMPLIANT
55+
memmove(buf2, buf1, sizeof(buf1)); // COMPLIANT
56+
}
57+
{
58+
char buf1[128];
59+
char buf2[256] = {0};
60+
strncpy(buf2, buf1, sizeof(buf1)); // COMPLIANT
61+
strncpy(buf1, buf2, sizeof(buf1)); // COMPLIANT
62+
strncpy(buf1, buf2, sizeof(buf1) + 1); // NON_COMPLIANT
63+
strncpy(buf1, buf2, sizeof(buf1) - 1); // COMPLIANT
64+
strncpy(buf1 + 1, buf2, sizeof(buf1)); // NON_COMPLIANT
65+
}
66+
{
67+
char buf0[10]; // memset after first use
68+
char buf1[10]; // no memset
69+
char buf2[10]; // memset before first use
70+
char buf3[10] = {'\0'};
71+
char buf4[10] = "12345";
72+
73+
strncat(buf0, " ",
74+
1); // NON_COMPLIANT[FALSE_NEGATIVE] - buf0 not null-terminated
75+
memset(buf0, 0, sizeof(buf0)); // COMPLIANT
76+
memset(buf2, 0, sizeof(buf2)); // COMPLIANT
77+
strncat(buf1, " ", 1); // NON_COMPLIANT - not null-terminated
78+
strncat(buf2, " ", 1); // COMPLIANT
79+
strncat(buf3, " ", 1); // COMPLIANT
80+
strncat(buf4, "12345", 5); // NON_COMPLIANT[FALSE_NEGATIVE]
81+
strncat(get_ca_5(), "12345", 5); // NON_COMPLIANT - null-terminator past end
82+
strncat(get_ca_5(), "1234", 4); // COMPLIANT
83+
strncat(get_ca_5() + 1, "1234", 4); // NON_COMPLIANT
84+
strncat(get_ca_5(), "12", 2); // COMPLIANT
85+
}
86+
{
87+
char ca5_good[5] = "test"; // ok
88+
char ca5_bad[5] = "test1"; // no null terminator
89+
char ca6_good[6] = "test1"; // ok
90+
char ca6_bad[6] = "test12"; // no null terminator
91+
strncmp(ca5_good, ca5_bad, 4); // COMPLIANT
92+
strncmp(ca5_good, ca5_bad, 5); // COMPLIANT
93+
strncmp(ca6_good, ca5_bad, 5); // COMPLIANT
94+
strncmp(ca6_good, ca5_good, 6); // COMPLIANT[FALSE_POSITIVE]
95+
strncmp(ca5_good, ca5_bad, 6); // NON_COMPLIANT
96+
}
97+
// strxfrm
98+
{
99+
char buf[64];
100+
char buf2[128];
101+
strxfrm(buf, "abc", sizeof(buf)); // COMPLIANT
102+
strxfrm(buf, "abc", sizeof(buf) + 1); // NON_COMPLIANT
103+
strxfrm(buf, "abc", sizeof(buf) - 1); // COMPLIANT
104+
strxfrm(buf + 1, buf2,
105+
sizeof(buf) - 1); // NON_COMPLIANT - not null-terminated
106+
}
107+
}

0 commit comments

Comments
 (0)