Re: cppcheck Sept 18

[James Mckenzie]

-----Original Message-----
> From: Henri Verbeet <hverbeet(a)gmail.com>
> Sent: Sep 20, 2009 12:19 PM
> To: Pauli Nieminen <suokkos(a)gmail.com>
> Cc: wine-devel(a)winehq.org, Joris Huizer <joris_huizer(a)yahoo.com>
> Subject: Re: cppcheck Sept 18
>
> 2009/9/20 Pauli Nieminen <suokkos(a)gmail.com>
> > On Sat, Sep 19, 2009 at 1:59 PM, Joris Huizer <joris_huizer(a)yahoo.com> wrote:
> > > [/home/cahrendt/wine-git/dlls/rpcrt4/tests/server.c:1189]: (possible
> > > error) Array index out of bounds
> > >
> > > This one is a false positive, it uses FIELD_OFFSET(cs_t, ca[5]),
> > > and it found an array:
> > > int ca[5];
> >
> > int ca[5];
> > has only entries up to ca[4] (0-4) so to me it looks like bug.
>
> Not quite. For one, the ca[5] that's being used here isn't the local
> variable ca[5], but the field ca[1] of the cs_t structure. The
> expression is used as a way to calculate the size of a cs_t structure
> with 5 elements.

But what is the real size of ca[]?  Is it five, fifty or five-hundred?  Maybe that is why the cppcheck is declaring it out-of-bounds.

James McKenzie

cppcheck Sept 18

[Ben Klein]

2009/9/21 James Mckenzie <jjmckenzie51(a)earthlink.net>:
> -----Original Message-----
> > From: Henri Verbeet <hverbeet(a)gmail.com>
> > Sent: Sep 20, 2009 12:19 PM
> > To: Pauli Nieminen <suokkos(a)gmail.com>
> > Cc: wine-devel(a)winehq.org, Joris Huizer <joris_huizer(a)yahoo.com>
> > Subject: Re: cppcheck Sept 18
> >
> > Not quite. For one, the ca[5] that's being used here isn't the local
> > variable ca[5], but the field ca[1] of the cs_t structure. The
> > expression is used as a way to calculate the size of a cs_t structure
> > with 5 elements.
>
> But what is the real size of ca[]?  Is it five, fifty or five-hundred?  Maybe that is why the cppcheck is declaring it out-of-bounds.

dlls/rpcrt4/tests/server.h:775, ca[] seems to have a length of 1
I'm not exactly sure how FIELD_OFFSET works, but it looks to me like
it's being used to *create* an array large enough for 5 cs_t->ca ints.
I don't think ca[5] is being dereferenced.

My guess is that cppcheck is barfing not at the FIELD_OFFSET macro but
at the local ca[5] variable anyway. If this is true, then it's yet
another bug in cppcheck.