Fix

Author: web-flow

lib/checkbufferoverrun.cpp

@@ -636,17 +636,19 @@ static bool checkBufferSize(const Token *ftok, const Library::ArgumentChecks::Mi
         }
         break;
     case Library::ArgumentChecks::MinSize::Type::ARGVALUE: {
-        if (arg && arg->hasKnownIntValue()) {
-            MathLib::bigint myMinsize = arg->getKnownIntValue();
+        if (arg) {
+            const ValueFlow::Value* argVal = arg->hasKnownIntValue() ? &arg->values().front() : arg->getMaxValue(true);
+            if (!argVal)
+                break;
+            MathLib::bigint myMinsize = argVal->intvalue;
             const int baseSize = tokenizer->sizeOfType(minsize.baseType);
             if (baseSize != 0)
                 myMinsize *= baseSize;
             const bool ok = myMinsize <= bufferSize.intvalue;
             if (!ok) {
-                if (bufferSize.errorPath.empty())
-                    bufferSize.errorPath = arg->values().front().errorPath;
+                bufferSize.errorPath.insert(bufferSize.errorPath.end(), argVal->errorPath.begin(), argVal->errorPath.end());
                 if (!bufferSize.condition)
-                    bufferSize.condition = arg->values().front().condition;
+                    bufferSize.condition = argVal->condition;
             }
             return ok;
         }

test/testbufferoverrun.cpp

@@ -3600,10 +3600,18 @@ class TestBufferOverrun : public TestFixture {
               "    int a[1];\n"
               "    if (i != 2) return;\n"
               "    memset(a, 0, i * sizeof(int));\n"
+              "}"
+              "void g(int i) {\n"
+              "    int a[1];\n"
+              "    if (i != 2) {}\n"
+              "    memset(a, 0, i * sizeof(int));\n"
               "}", s);
         ASSERT_EQUALS("[test.cpp:4:12]: warning: Buffer is accessed out of bounds: a [bufferAccessOutOfBounds]\n"
                       "[test.cpp:3:11]: note: Assuming that condition 'i!=2' is not redundant\n"
-                      "[test.cpp:4:12]: note: Buffer overrun\n", errout_str());
+                      "[test.cpp:4:12]: note: Buffer overrun\n"
+                      "[test.cpp:8:12]: warning: Buffer is accessed out of bounds: a [bufferAccessOutOfBounds]\n"
+                      "[test.cpp:7:11]: note: Assuming that condition 'i!=2' is not redundant\n"
+                      "[test.cpp:8:12]: note: Buffer overrun\n", errout_str());
     }
 
     void buffer_overrun_bailoutIfSwitch() {