Synopsis

A call to memchr might cause a buffer overrun.

Enabled by default

No

Severity/Certainty

High/Medium

Full description

A call to memchr might cause a buffer overrun. If memchr is called with a size greater than the size of the allocated buffer, it will overrun and might cause a runtime error.

Coding standards

Code examples

The following code example fails the check and will give a warning:

#include <stdlib.h>

void example(int b) {
  char *a = malloc(sizeof(char) * 20);
  int c;
  if (b) {
    c = 21;
  } else {
    c = 5;
  }
  memchr(a, 'a', c);
}

The following code example passes the check and will not give a warning about this issue:

#include <stdlib.h>

void example(void) {
  char *a = malloc(sizeof(char) * 20);
  memchr(a, 'a', 10);
}