bugprone-misplaced-operator-in-strlen-in-alloc¶
Finds cases where 1
is added to the string in the argument to strlen()
,
strnlen()
, strnlen_s()
, wcslen()
, wcsnlen()
, and wcsnlen_s()
instead of the result and the value is used as an argument to a memory
allocation function (malloc()
, calloc()
, realloc()
, alloca()
) or
the new[]
operator in C++. The check detects error cases even if one of
these functions (except the new[]
operator) is called by a constant function
pointer. Cases where 1
is added both to the parameter and the result of the
strlen()
-like function are ignored, as are cases where the whole addition is
surrounded by extra parentheses.
C example code:
void bad_malloc(char *str) {
char *c = (char*) malloc(strlen(str + 1));
}
The suggested fix is to add 1
to the return value of strlen()
and not
to its argument. In the example above the fix would be
char *c = (char*) malloc(strlen(str) + 1);
C++ example code:
void bad_new(char *str) {
char *c = new char[strlen(str + 1)];
}
As in the C code with the malloc()
function, the suggested fix is to
add 1
to the return value of strlen()
and not to its argument. In the
example above the fix would be
char *c = new char[strlen(str) + 1];
Example for silencing the diagnostic:
void bad_malloc(char *str) {
char *c = (char*) malloc(strlen((str + 1)));
}