Synopsis

A call to memset overruns the buffer.

Enabled by default

Yes

Severity/Certainty

High/Medium

Full description

A buffer overrun is caused by a call to memset. If memset is called with a size exceeding the size of the allocated buffer, it will overrun. This might cause a runtime error. Make sure that the size of the buffer passed to memset does not exceed the destination buffer's size. You might need to add a condition before the call to memset.

Coding standards

Code examples

The following code example fails the check and will give a warning:

#include <stdlib.h>

void example(void) {
  char *a = malloc(sizeof(char) * 20);
  memset(a, 'a', 21);
}

The following code example passes the check and will not give a warning about this issue:

#include <stdlib.h>

void example(void) {
  char *a = malloc(sizeof(char) * 20);
  memset(a, 'a', 10);
}