Buffer overflow not detected

Rules and Languages Report False-positive / False-negative...
1
  • What language is this for?
    C
  • Which rule?
    C:S3519
  • Are you using
    • SonarCloud
    • SonarLint - Eclipse SonarLint 10.5

When the macro ARRAY_LENGTH is defined in the same file as where it is used, the overflow in the below code is detected. If the macro is moved to an h file and then included, then the buffer overflow does not generate a warning.

//#define ARRAY_LENGTH(array) (sizeof((array))/sizeof((array)[0]))

uint16_t data[8];
uint16_t function(uint16_t in) {

uint16_t out = 0;

for (uint8_t i = 0; i <= ARRAY_LENGTH(data); i++) {
    out += data[i]; // Overflow at iteration 8
}

return out;

}

5

Thanks for reporting it.
I remember this one :slight_smile: We already track it in CPP-3866.
It’s on the radar, and it’s an annoying bug, so we have plans to fix it this year. I can’t give a better ETA, unfortunately.