False positive
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
**Description of the false positive**
The error
This 'call to strcpy_s' operation is limited to 512 bytes but the destination is only 256 bytes.
Somehow it is getting a different size for sizeof and the actual size of the array. Not sure why it thinks they are different sizes when it's the same physical array. Code is below.
**Code samples or links to source code**
// Get the full device path
char devPath[ 256 ];
strcpy_s( devPath, sizeof( devPath ), pDetData->DevicePath );
Contributor guide
Research direction
No file, query, entry point, or test is named. Start by locating the CodeQL query that reports the supplied strcpy_s call, then reproduce the report with the shown 256-byte array and 512-byte bound. Done means determining whether the diagnostic is a false positive and validating any query change with a regression case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100