Fix #7570: Support address-of operator on variables in getBufferSize()

[flovent]

Detect address-of token in getBufferSize() and get the underlying variable's corresponding buffer size.

stringNotZeroTerminated() also calls getBuffersize(), so it will also benefit.

[chrchr-github]

Thanks for your contribution.
How do we handle &buf[i]?
Can you fix the error message, so that it only mentions the buffer itself?

[flovent]

How do we handle &buf[i]?

This patch didn't consider that because getBufferSize can't deal buf[i] without address-of, i think we need to add more logic after we get the variable in this function to handle this.

Can you fix the error message, so that it only mentions the buffer itself?

Should we remove & in all the testcases or only when variable is a pointer/array buffer, i think it might be reasonable to keep that for variables like int i;.

[chrchr-github]

How do we handle &buf[i]?

This patch didn't consider that because getBufferSize can't deal buf[i] without address-of, i think we need to add more logic after we get the variable in this function to handle this.

Ok, so maybe we should add a negative test/TODO for that case?

Can you fix the error message, so that it only mentions the buffer itself?

Should we remove & in all the testcases or only when variable is a pointer/array buffer, i think it might be reasonable to keep that for variables like int i;.

Ideally we would say 'Variable' for &i and just mention c (without &) if it is a buffer/array.

[flovent]

getBufferSize can't deal buf[i] without address-of

I mean something like this, it's not triggered now.

void f() {
int* i[10];
memset(i[1], 0, 1000);
}

And also, there is a TODO before getBufferSize, it only handles variables now, not for some complicated expression i think:

// TODO: strcpy(buf+10, "hello");
const ValueFlow::Value bufferSize = getBufferSize(argtok);

[chrchr-github]

Please use Token here since it's not much longer than auto.

[danmar]

could you run the tools/test-my-pr.py script please? to see what warnings this will produce and then we can see if there are false positives.

[danmar]

could you run the tools/test-my-pr.py script please? to see what warnings this will produce and then we can see if there are false positives.

try to run it yourself first. if you have trouble to run it maybe we can run it on some vm.. maybe you can run on 1000 packages or something like that..

[flovent]

could you run the tools/test-my-pr.py script please? to see what warnings this will produce and then we can see if there are false positives.

try to run it yourself first. if you have trouble to run it maybe we can run it on some vm.. maybe you can run on 1000 packages or something like that..

I try to run it locally, but it seems will take a long time since my cpu only has 6 cores and 12 threads.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[danmar]

I merged this. Thank you for your contribution! Is your name listed in our AUTHORS file? Otherwise can you create a PR that adds your name to AUTHORS please?

[flovent]

I merged this. Thank you for your contribution! Is your name listed in our AUTHORS file? Otherwise can you create a PR that adds your name to AUTHORS please?

My pleasure! That's my first commit to cppcheck, i just create #7858.