Radovan =?utf-8?q?Božić?= <[email protected]>,
Radovan =?utf-8?q?Božić?= <[email protected]>
Message-ID:
In-Reply-To: <llvm.org/llvm/llvm-project/pull/[email protected]>
================
@@ -120,6 +126,14 @@ void call_bcopy_bzero(void) {
__builtin_bzero(dst, 11); // expected-warning {{'bzero' will always
overflow; destination buffer has size 10, but size argument is 11}}
}
+void call_fread_fwrite_fgets(FILE *fp) {
+ char src[4];
+ fread(src, 2, 3, fp); // expected-warning {{'fread' will always overflow;
destination buffer has size 4, but size argument is 6}}
+ fwrite(src, 2, 3, fp); // expected-warning {{'fwrite' will always read past
the end of the source buffer; source buffer has size 4, but the size is 6}}
+ fgets(src, 5, fp); // expected-warning {{'fgets' size argument is too large;
destination buffer has size 4, but size argument is 5}}
----------------
nickdesaulniers wrote:
What happens if someone calls `fgets` with a negative value?
Example:
```c
fgets(src, -1, fp);
```
Do we correctly diagnose that? Please add a unit test checking that.
https://github.com/llvm/llvm-project/pull/204337
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
