diff --git a/infer/src/bufferoverrun/bufferOverrunModels.ml b/infer/src/bufferoverrun/bufferOverrunModels.ml index cfafdf2d2..9f2ebc9bc 100644 --- a/infer/src/bufferoverrun/bufferOverrunModels.ml +++ b/infer/src/bufferoverrun/bufferOverrunModels.ml @@ -120,7 +120,10 @@ let calloc size_exp stride_exp = let memcpy dest_exp src_exp size_exp = - let exec _ ~ret:_ mem = mem + let exec _ ~ret:_ mem = + let dest_loc = Sem.eval_locs dest_exp mem in + let v = Dom.Mem.find_set (Sem.eval_locs src_exp mem) mem in + Dom.Mem.update_mem dest_loc v mem and check {location; integer_type_widths} mem cond_set = BoUtils.Check.lindex_byte integer_type_widths ~array_exp:dest_exp ~byte_index_exp:size_exp ~last_included:true mem location cond_set diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp b/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp index 5f4363cdd..f282a7304 100644 --- a/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp +++ b/infer/tests/codetoanalyze/c/bufferoverrun/issues.exp @@ -186,6 +186,8 @@ codetoanalyze/c/bufferoverrun/models.c, memcpy_bad1, 3, BUFFER_OVERRUN_L1, no_bu codetoanalyze/c/bufferoverrun/models.c, memcpy_bad2, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 44 Size: 40] codetoanalyze/c/bufferoverrun/models.c, memcpy_bad3, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 18446744073709551615 Size: 40] codetoanalyze/c/bufferoverrun/models.c, memcpy_bad4, 4, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 8 Size: 4] +codetoanalyze/c/bufferoverrun/models.c, memcpy_contents_Bad, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Assignment,,Array declaration,Array access: Offset: 5 Size: 5] +codetoanalyze/c/bufferoverrun/models.c, memcpy_integer_Bad, 5, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Assignment,,Array declaration,Array access: Offset: 5 Size: 5] codetoanalyze/c/bufferoverrun/models.c, memmove_bad1, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 44 Size: 40] codetoanalyze/c/bufferoverrun/models.c, memmove_bad2, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 44 Size: 40] codetoanalyze/c/bufferoverrun/models.c, memmove_bad3, 3, BUFFER_OVERRUN_L1, no_bucket, ERROR, [,Array declaration,Array access: Offset added: 18446744073709551615 Size: 40] diff --git a/infer/tests/codetoanalyze/c/bufferoverrun/models.c b/infer/tests/codetoanalyze/c/bufferoverrun/models.c index 13f707e72..fd92a82b7 100644 --- a/infer/tests/codetoanalyze/c/bufferoverrun/models.c +++ b/infer/tests/codetoanalyze/c/bufferoverrun/models.c @@ -251,3 +251,35 @@ void strncpy_good5_FP() { char dst[5]; strncpy(dst, src, 10); } + +void memcpy_contents_Good() { + int src[3] = {5, 5, 5}; + int dst[3]; + memcpy(dst, src, sizeof(dst)); + int a[6]; + a[dst[0]] = 0; +} + +void memcpy_contents_Bad() { + int src[3] = {5, 5, 5}; + int dst[3]; + memcpy(dst, src, sizeof(dst)); + int a[5]; + a[dst[0]] = 0; +} + +void memcpy_integer_Good() { + int src = 5; + int dst; + memcpy(&dst, &src, sizeof(int)); + int a[10]; + a[dst] = 0; +} + +void memcpy_integer_Bad() { + int src = 5; + int dst; + memcpy(&dst, &src, sizeof(int)); + int a[5]; + a[dst] = 0; +}