(root)/
gcc-13.2.0/
gcc/
testsuite/
gcc.dg/
analyzer/
out-of-bounds-curl.c
       1  /* { dg-additional-options "-O2" } */
       2  #include <string.h>
       3  
       4  /* Reduced from curl lib/smb.c.  */
       5  typedef int CURLcode;
       6  
       7  struct smb_conn {
       8    // [...]
       9    char *user;
      10  };
      11  
      12  struct smb_setup {
      13    // [...]
      14    char bytes[48];
      15  } __attribute__((packed));
      16  
      17  struct connectdata {
      18    // [...]
      19    struct smb_conn *smbc;
      20  };
      21  
      22  CURLcode smb_send_setup (struct connectdata *conn)
      23  {
      24    struct smb_conn *smbc = conn->smbc;
      25    struct smb_setup msg;
      26    char *p = msg.bytes;
      27    unsigned char lm[24];
      28  
      29    /* Init to prevent uninit warning.  */
      30    memset(&msg, 0, sizeof(msg));
      31    memset (&lm, 0, sizeof(lm));
      32  
      33    memcpy(p, lm, sizeof(lm));
      34    p += sizeof(lm);
      35    /* Had a false-positive overflow at p. Checker had a number of bytes copied
      36       relative to the start but offset points in the middle the field.  */
      37    strcpy(p, (smbc->user));
      38    p += strlen(smbc->user) + 1;
      39  
      40    return 1;
      41  }