"Memory copy function overflows destination buffer" - cpp:S3519 false positive?

SonarQube Server / Community Build
1

I’m coming from the Java area and I’m used that SonarQube is mostly correct with such kind of findings. Now I’m confronted with a small c/c++ project where SonarQube flags code that was originally found in the net as Memory copy function overflows destination buffer I can not not see the point - can you see who is right? I hope it is not all to obvious?

https://sonarcloud.io/project/issues?id=Friends-of-OpenBikeSensor_OpenBikeSensorFirmware&issues=AXVSCjrR3HHzkZhCc1vE&open=AXVSCjrR3HHzkZhCc1vE - I’ve already reduced the severity from blocker to critical.

Is this a bug in my or SonarQubes logic?

The full project is at https://github.com/Friends-of-OpenBikeSensor/OpenBikeSensorFirmware and the Github action at https://github.com/Friends-of-OpenBikeSensor/OpenBikeSensorFirmware/actions

BTW: I’ve to mention that I’m impressed by the SonarCloud offering, thanks!

3

Hello @Andreas_Mandel and welcome to the Sonarsource community!

We are glad you appreciate our products for C and C++.

As for your problem, it seems like a real false-positive. Thank you for reporting.
For now, it seems related to the issue in this ticket.

To speed up further investigations, would you mind generating a reproducer and sending it back to us?Steps are as follow:

  • Add the reproducer option to the scanner configuration:
    sonar.cfamily.reproducer= “Full path to the .cpp file that has or include the file that has the false-positive”
  • Re-unning the scanner should generate a file named sonar-cfamily.reproducer in the project folder.
  • Please share this file. if you think this file contains private information we can send it privately.

Thanks,

1 Like
4

Hello @Geoffray,

thanks for looking into this. I’ve added the requested options to the scanner call. Since all is OSS there should be no private data included. sonar-cfamily.zip (685.2 KB)

The culprit file is https://github.com/Friends-of-OpenBikeSensor/OpenBikeSensorFirmware/blob/master/OpenBikeSensorFirmware/vector.h but I assume that is now all part of the attached file.

Kind regards,
Andreas.

Kind regards,
Andreas.

1 Like
5

Thanks Andreas. It should indeed include all the necessary material.

1 Like
7

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.