Skip to content

Commit 3e71ef2

Browse files
committed
Add more MissingCheckScanf test cases
1 parent c62ae3b commit 3e71ef2

File tree

2 files changed

+76
-10
lines changed

2 files changed

+76
-10
lines changed
Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
| test.cpp:23:3:23:7 | call to scanf | This is a call to scanf. |
22
| test.cpp:39:3:39:7 | call to scanf | This is a call to scanf. |
3-
| test.cpp:48:3:48:8 | call to fscanf | This is a call to scanf. |
4-
| test.cpp:55:3:55:8 | call to sscanf | This is a call to scanf. |
5-
| test.cpp:135:3:135:7 | call to scanf | This is a call to scanf. |
6-
| test.cpp:143:3:143:7 | call to scanf | This is a call to scanf. |
7-
| test.cpp:151:3:151:7 | call to scanf | This is a call to scanf. |
8-
| test.cpp:163:3:163:7 | call to scanf | This is a call to scanf. |
9-
| test.cpp:173:3:173:7 | call to scanf | This is a call to scanf. |
3+
| test.cpp:56:3:56:7 | call to scanf | This is a call to scanf. |
4+
| test.cpp:70:3:70:8 | call to fscanf | This is a call to scanf. |
5+
| test.cpp:77:3:77:8 | call to sscanf | This is a call to scanf. |
6+
| test.cpp:178:3:178:7 | call to scanf | This is a call to scanf. |
7+
| test.cpp:186:3:186:7 | call to scanf | This is a call to scanf. |
8+
| test.cpp:194:3:194:7 | call to scanf | This is a call to scanf. |
9+
| test.cpp:206:3:206:7 | call to scanf | This is a call to scanf. |
10+
| test.cpp:216:3:216:7 | call to scanf | This is a call to scanf. |

cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp

Lines changed: 68 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,30 @@ int main()
3636
{
3737
int i = 0;
3838

39+
scanf("%d", &i); // BAD. Design choice: already initialized variables shouldn't make a difference.
40+
use(i);
41+
}
42+
43+
{
44+
int i;
45+
use(i);
46+
47+
if (scanf("%d", &i) == 1) // GOOD: only care about uses after scanf call
48+
{
49+
use(i);
50+
}
51+
}
52+
53+
{
54+
int i; // Reused variable
55+
3956
scanf("%d", &i); // BAD
4057
use(i);
58+
59+
if (scanf("%d", &i) == 1) // GOOD
60+
{
61+
use(i);
62+
}
4163
}
4264

4365
// --- different scanf functions ---
@@ -94,22 +116,43 @@ int main()
94116
}
95117
}
96118

119+
{
120+
int r;
121+
int i;
122+
123+
r = scanf("%d", &i); // GOOD
124+
125+
if (r >= 1)
126+
{
127+
use(i);
128+
}
129+
}
130+
97131
{
98132
bool b;
99133
int i;
100134

101-
b = scanf("%d", &i); // GOOD
135+
b = scanf("%d", &i); // BAD [NOT DETECTED]: scanf can return EOF (boolifies true)
102136

103137
if (b >= 1)
104138
{
105139
use(i);
106140
}
107141
}
108142

143+
{
144+
bool b;
145+
int i;
146+
147+
b = scanf("%d", &i); // BAD [NOT DETECTED]
148+
149+
use(i);
150+
}
151+
109152
{
110153
int i, j;
111154

112-
if (scanf("%d %d", &i) >= 2) // GOOD
155+
if (scanf("%d %d", &i) >= 2) // GOOD: `j` is not a scanf arg, so out of scope of MissingCheckScanf
113156
{
114157
use(i);
115158
use(j);
@@ -165,7 +208,7 @@ int main()
165208
}
166209

167210
// --- different use ---
168-
211+
169212
{
170213
int i;
171214
int *ptr_i = &i;
@@ -203,3 +246,25 @@ int main()
203246
}
204247
}
205248
}
249+
250+
// Non-local cases:
251+
252+
bool my_scan_int(int &i)
253+
{
254+
return scanf("%d", &i) == 1; // GOOD
255+
}
256+
257+
void my_scan_int_test()
258+
{
259+
int i;
260+
261+
use(i); // GOOD: used before scanf
262+
263+
my_scan_int(i); // BAD [NOT DETECTED]
264+
use(i);
265+
266+
if (my_scan_int(i)) // GOOD
267+
{
268+
use(i);
269+
}
270+
}

0 commit comments

Comments
 (0)