Idea Detail view

 
 
 

Out Of Bounds Checking at Start Of Array

 

This is 'out-of-bounds' is detected:

 

 unsigned char buffer[5];
 unsigned char* buffer_ptr = &buffer[4];

 ++buffer_ptr;       // ERROR! now points to 1 byte after &buffer[4]
 *buffer_ptr = 0x12; // assign to memory outside of buffer[]

 


This 'out-of-bounds' is NOT detected:

 

 unsigned char buffer[5];
 unsigned char* buffer_ptr = &buffer[0];

 --buffer_ptr;       // ERROR! now points to 1 byte before &buffer[0]
 *buffer_ptr = 0x12; // assign to memory outside of buffer[]

 

As 'buffer_ptr' has been 'bound' to 'buffer' via the assignment I would have expected PC-lint to have detected this.

 

Pending

5 Votes