github / github/codeql

False positives - cpp/unbounded-write

Abierto
#11,557 3 comentarios 0 reacciones 0 asignados Ver en GitHub
acknowledged C++ false-positive
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the false positive**

CodeQL reports false positives from `cpp/unbounded-write` when the destination buffer passed to `strcpy()` has been allocated to be big enough to fit the string according to `strlen()`.

**Code samples or links to source code**

Here is an example from the OpenZFS source code:

```
int len = strlen(drrb->drr_toname);
cp = umem_alloc(len + 2, UMEM_NOFAIL);
cp[0] = '/';
(void) strcpy(&cp[1], drrb->drr_toname);
```

We allocate `cp` to be 2 larger than the length of `drrb->drr_toname`. Then we do a `strcpy()` command that is guaranteed to be safe.

That is from report 783 below.

**URL to the alert on GitHub code scanning (optional)**

https://github.com/ryao/zfs/security/code-scanning/782
https://github.com/ryao/zfs/security/code-scanning/783
https://github.com/ryao/zfs/security/code-scanning/784

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.