This checks array index out of bounds.(for now, one-dimensional array)
- CWE-129: refer to http://cwe.mitre.org/data/definitions/129.html
refer to below example:
Caution: It is possible there will be more test cases.
case 1 | void function(int* array_parameter) { int basic_array[9]={0,};
for(int i=0 ; i<11 ; i++) { basic_array[i]=0; } printf("basic_array[10] : %d ",basic_array[10]); printf("*(basic_array+10) : %d ",*(basic_array+10));
for(int i=0; i<11; i++) { array_parameter[i]=0; } } |
|---|---|
| case 2 | void function(int array_parameter[]) { int basic_array[9]={0,};
for(int i=0 ; i<11 ; i++) { basic_array[i]=0; } printf("basic_array[10] : %d ",basic_array[10]); printf("*(basic_array+10) : %d ",*(basic_array+10));
for(int i=0; i<11; i++) { array_parameter[i]=0; } }
|
the checker config can be like below:
{ "code": "CHECK_ARRAY_INDEX_OUT_OF_BOUNDS", "name": "Checking array index out of bounds", "type": "BOTH", "categoryName": "Tizen", "severityCode": "CRI", "version": "2.5.33", "description": "Array index out of bounds", "isActive": false, "properties": { }, "cwe": 129} |
...
1) assign signed or char type variable, which has smaller bit size, into unsigned variable (Sign extension problem)
ex) 32bit unsigned = 8bit / 16bit signed ,, (occur sing extension)
ex) 32bit unsigned = char (worse! It depends on compiler option)
unsigned aaa;
char zzs;
signed char ss;
ss= zzs = 0xF0;
aaa = ss ; //expected aaa, but 0xFFFF FFF0
aaa = zzs ; //expect aaa <= 0xF0, but it has different value depending on compiler option
For gcc, the default is signed, but you can modify that with -funsigned-char. note: for gcc in Android NDK, the default is unsigned. You can also explicitly ask for signed characters with -fsigned-char.
2) when compare char variables, it has different values depending on signed or unsigned
depends on compiler option
for (char depth = 3; depth >= 0 ; --depth)
char has 3 types
char : not allowed to use as number
signed char : -128 ~ 127
unsigned char : 0 ~ 255
Ie, this is error when you compare with char variables
=> It is fine when you use signed char or unsigned char