QA·C Help - 2848

	2848	Suspicious: Maximum number of characters to be written is larger than the target buffer size.

Arrays

Dataflow analysis has identified a code construct which is suspicious. The code may be entirely safe but further investigation is advisable.

Certain standard library functions specify a maximum number (M) of characters to be written to a char array (A).

function	A parameter number	M parameter number
asctime_s	1	2
ctime_s	1	2
snprintf	1	2
snprintf_s	1	2
strcpy_s	1	2
strncat	1	3
strncat_s	1	2
strncat_s	1	4
strncat_s	3	4
strncpy	1	3
strncpy_s	1	4

This message is issued whenever a non constant expression is used for M and its value could sometimes be greater than the size of object A. This may result in an access outside the bounds of A.

For example, in the code shown below, the value of 'm' will be '11' unless the parameter 'n' is greater than 0.


/*PRQA S 1-9999 ++*/
/*PRQA S 2848 --*/

#include <string.h>

extern char a[10];
extern char b[11];

void foo (int n)
{
  int i;
  int m = sizeof (b);

  for (i = 0; i < n; ++i)
  {
    --m;
  }
  
  strncpy (a, b, m);   /* 2848 */
}

See also:

2845 Constant: Maximum number of characters to be written is larger than the target buffer size.
2846 Definite: Maximum number of characters to be written is larger than the target buffer size.
2847 Apparent: Maximum number of characters to be written is larger than the target buffer size.

Personality Groups | Glossary | Message Index

Contents