bug419.cpp

1    #include <stdio.h>
2    #include <string.h>
3
4    char *cvt(const char *s)
5        {
6        static char buf[12];  // 8x3 largest file name
7        char *p;
8
9        strcpy( buf, s );
10       while( p = strstr( buf, "shower" ) )
11           {
12           strncpy( p, "fl", 2 );
13           }
14       return buf;
15       }
16
17   int main()
18       {
19       printf( "%s\n", cvt( " showers.txt" ) );
20       return 0;
21       }

Our programmer wants to change all file names that bear the word "shower" into ones where that word is changed to "flower". But there's a flaw. Can you spot it? (Note, you need two passes using our product to catch the flaw.)

bug419.cpp lint Output

--- Module:   bug419.cpp (C++)
                                       _
    while( p = strstr( buf, "shower" ) )
bug419.cpp(10) : Info 720: Boolean test of assignment

/// Start of Pass 2 ///

--- Module:   bug419.cpp (C++)

During Specific Walk:
  File bug419.cpp line 19: cvt(!=0)
bug419.cpp(9) : Warning 419: Apparent data overrun for function 'strcpy(char *,
    const char *)', argument 2 (size=13) exceeds argument 1 (size=12)
    [Reference: file bug419.cpp: lines 9, 19]

Reference Manual Explanation

419    Apparent data overrun for function 'Symbol', argument Integer
       exceeds argument Integer   -- This message is for data transfer
       functions such as memcpy, strcpy, fgets, etc. when the size
       indicated by the first cited argument (or arguments) exceeds the
       size of the buffer area cited by the second.  The message may
       also be issued for user functions via the -function option.  See
       §10.1 "Function Mimicry" and §10.2.1 "Possible Semantics".