Text  |   XML   |   Visible Warnings:

Pvm : Pvm analysis 1 : strncpy Does Not Null-terminate  at lpvmgen.c:3119

Categories: POSIX.STRINGS.NTERM CWE:170
Warning ID: 2802.2862
Procedure: pvmgetenvars
Trace: View
Modified: Wed Sep 2 12:47:29 2009   show details
 
Priority: None
State: None
Finding: None
Owner: None
  edit properties

Legend [ X ]
Warning Location
Contributes
Parse Error
Other Warning
Two or More Loop Iterations
On Execution Path
Comment
Macro
Preprocessor
Include
Keyword
Preprocessed Away
Legend
Warning Location Contributes Parse Error
Other Warning Two or More Loop Iterations On Execution Path
Comment Macro Preprocessor
Include Keyword Preprocessed Away

Source  |  Language: C Hide Legend     
ProblemLineSource
   /u1/paul/SATE/2010/c/pvm/pvm3/src/lpvmgen.c
   Enter pvmgetenvars
$input_12 = 2013098 pvmgetenvars(ep) 
 3099         char ***ep;
 3100 {
 3101         char **xpl;                     /* vars to export */ 
 3102         int mxpl;                       /* cur length of xpl */ 
 3103         int nxpl;                       /* num vars found */ 
 3104         char buf[200];
 3105         char *p, *q;
 3106         int n;
 3107  
 3108         if (p = getenv("PVM_EXPORT")) {
 3109                 mxpl = 5;
 3110                 xpl = TALLOC(mxpl, char *, "env");
 3111                 xpl[0] = p - 11;   /* Null Pointer Dereference (ID: 2803.2863) */
 3112                 nxpl = 1;
 3113                 while (1) {
 3114                         while (*p == ':')
strlen(p) = 2013115                                 p++;
 3116                         if (!*p)
 3117                                 break;
strlen(p) = 2003118                         n = (q = CINDEX(p, ':')) ? q - p : strlen(p);
n = 2003119                         strncpy(buf, p, n);     /* strncpy Does Not Null-terminate */  /* Buffer Overrun (ID: 2801.2861) */
Preconditions 
((char*)&$heap_186497)[1] != 0
((char*)&$heap_186497)[1] != 58
$input_12 >= 2
Postconditions 
ep' = $param_1
$heap_186497' = 58
bytes_after(&$heap_186497)' = $input_12 + 1
$heap_186497' is allocated by malloc
bytes_before(&$heap_186497)' = 0
strlen(&$heap_186497)' = $input_12
$heap_186498' = &$heap_186497 - 11
bytes_after(&$heap_186498)' = 40
$heap_186498' is allocated by malloc
$heap_186498' is allocated
bytes_before(&$heap_186498)' = 0
mxpl' = 5
n' = $input_12 - 1
nxpl' = 1
p' = &$heap_186497 + 1
q' = 0
xpl' = &$heap_186498



Change Warning 2802.2862 : strncpy Does Not Null-terminate

Priority:
State:
Finding:
Owner:
Note: