Synopsis

Arguments passed to qsort might cause it to overrun.

Enabled by default

No

Severity/Certainty

High/Medium

Full description

A buffer overrun might be caused by a call to qsort. This is because a buffer length being passed is greater than that of the buffer passed to either function as their first argument.

Coding standards

Code examples

The following code example fails the check and will give a warning:

#include <stdlib.h>
#include <stdio.h>

int cmp(const void *a, const void *b) {
  return a == b;
}

void example(int b) {
  int *a = malloc(sizeof(int) * 10);
  int c;
  if (b) {
    c = 3;  
  } else {
    c = 20;
  }
  qsort(a, c, sizeof(int), &cmp);
}

The following code example passes the check and will not give a warning about this issue:

#include <stdlib.h>
#include <stdio.h>

int cmp(const void *a, const void *b) {
  return a == b;
}

void example(int b) {
  int *a = malloc(sizeof(int) * 10);
  int c;
  if (b) {
    c = 3;  
  } else {
    c = 2;
  }
  qsort(a, c, sizeof(int), &cmp);
}