bug669.cpp

1    #include <stdio.h>
2    #include <string.h>
3    #define LEN 20
4    class Wedding
5        {
6      public:
7        char *bouq;
8        Wedding() { bouq = new char[LEN+1]; }
9        void init() { memset( bouq, LEN, '*' );
10                     bouq[LEN] = 0;   }
11       ~Wedding() { delete[] bouq; }
12       };
13   int main()
14       {
15       Wedding w;
16       w.init();
17       printf( "The bouquet: %s\n", w.bouq );
18       return 0;
19       }

For Jack and Jill's wedding, Jill wanted a wedding bouquet of 20 asterisks (she's a programmer). But Jack's program has a slight flaw. Can you spot it?

bug669.cpp lint Output

--- Module:   bug669.cpp (C++)
                       _
    Wedding() { bouq = new char[LEN+1]; }
bug669.cpp(8) : Info 1732: new in constructor for class 'Wedding' which has no
    assignment operator
bug669.cpp(8) : Info 1733: new in constructor for class 'Wedding' which has no
    copy constructor
                                          _
    void init() { memset( bouq, LEN, '*' );
bug669.cpp(9) : Warning 669: Possible data overrun for function 'memset(void *,
    int, unsigned int)', argument 3 (size=42) exceeds argument 1 (size=21)
    [Reference: file bug669.cpp: lines 8, 9] 

Reference Manual Explanation

669    Possible data overrun for function 'Symbol', argument Integer exceeds
       argument Integer Reference   -- This message is for data transfer functions
       such as memcpy, strcpy, fgets, etc. when the size indicated by the first
       cited argument (or arguments) can possibly exceed the size of the buffer area
       cited by the second.  The message may also be issued for user functions via the
       -function option See Function Mimicry and Value Tracking.