Fix #7570: Support address-of operator on variables in getBufferSize()

[flovent]

Detect address-of token in getBufferSize() and get the underlying variable's corresponding buffer size.

stringNotZeroTerminated() also calls getBuffersize(), so it will also benefit.

[chrchr-github]

Thanks for your contribution.
How do we handle &buf[i]?
Can you fix the error message, so that it only mentions the buffer itself?

[flovent]

How do we handle &buf[i]?

This patch didn't consider that because getBufferSize can't deal buf[i] without address-of, i think we need to add more logic after we get the variable in this function to handle this.

Can you fix the error message, so that it only mentions the buffer itself?

Should we remove & in all the testcases or only when variable is a pointer/array buffer, i think it might be reasonable to keep that for variables like int i;.

[chrchr-github]

How do we handle &buf[i]?

This patch didn't consider that because getBufferSize can't deal buf[i] without address-of, i think we need to add more logic after we get the variable in this function to handle this.

Ok, so maybe we should add a negative test/TODO for that case?

Can you fix the error message, so that it only mentions the buffer itself?

Should we remove & in all the testcases or only when variable is a pointer/array buffer, i think it might be reasonable to keep that for variables like int i;.

Ideally we would say 'Variable' for &i and just mention c (without &) if it is a buffer/array.

[flovent]

getBufferSize can't deal buf[i] without address-of

I mean something like this, it's not triggered now.

void f() {
  int* i[10];
  memset(i[1], 0, 1000);
}

And also, there is a TODO before getBufferSize, it only handles variables now, not for some complicated expression i think:

// TODO: strcpy(buf+10, "hello");
const ValueFlow::Value bufferSize = getBufferSize(argtok);

[chrchr-github]

Please use Token here since it's not much longer than auto.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[danmar]

could you run the tools/test-my-pr.py script please? to see what warnings this will produce and then we can see if there are false positives.

[danmar]

just skipping the address of like this feels dangerous spontanously to me. It feels like there could be false positives.

[danmar]

could you run the tools/test-my-pr.py script please? to see what warnings this will produce and then we can see if there are false positives.

try to run it yourself first. if you have trouble to run it maybe we can run it on some vm.. maybe you can run on 1000 packages or something like that..