CodeSonar : pvm3.4.6 : Buffer Overrun

pvm3.4.6 : pvm3.4.6 analysis 2 : Buffer Overrun at lpvmgen.c:3120

Categories:	LANG.MEM.BO CWE:120 CWE:121 CWE:122 CWE:126
Warning ID:	385.29089
Procedure:	pvmgetenvars
Trace:	view
Modified:	Thu Nov 26 11:31:45 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/pvm3/src/lpvmgen.c

			Enter pvmgetenvars

pvmgetenvars(ep)

char ***ep;

{

char **xpl; /* vars to export */

3102

int mxpl; /* cur length of xpl */

3103

int nxpl; /* num vars found */

char buf[200];

char *p, *q;

int n;

if (p = getenv("PVM_EXPORT")) {

3109

mxpl = 5;

3110

xpl = TALLOC(mxpl, char *, "env");

3111

xpl[0] = p - 11; /* Null Pointer Dereference (ID: 388.29092) */

nxpl = 1;

while (1) {

while (*p == ':')

p++;

if (!*p)

break;

n = (q = CINDEX(p, ':')) ? q - p : strlen(p);

3119

strncpy(buf, p, n); /* No Space For Null Terminator (ID: 22125.29091) */ /* Buffer Overrun (ID: 386.29090) */

n > 199

3120

buf[n] = 0; /* Buffer Overrun */

Preconditions

((char*)&$heap_370564)[1] != 0
((char*)&$heap_370564)[1] != 58
$input_12 >= 2

Postconditions

buf[0]' = ((char*)&$heap_370564)[1]
strlen(&buf[0])' != $input_12 - 2
$heap_370564' = 58
bytes_after(&$heap_370564)' = $input_12 + 1
$heap_370564' is allocated by malloc
bytes_before(&$heap_370564)' = 0
strlen(&$heap_370564)' = $input_12
$heap_370565' = &$heap_370564 - 11
bytes_after(&$heap_370565)' = 20
$heap_370565' is allocated by malloc
$heap_370565' is allocated
bytes_before(&$heap_370565)' = 0
mxpl' = 5
n' = $input_12 - 1
nxpl' = 1
p' = &$heap_370564 + 1
q' = 0
xpl' = &$heap_370565

Change Warning 385.29089 : Buffer Overrun

Priority:
State:
Finding:
Owner:
Note: