Fix severity, use index, fix config, restore warning

Author: web-flow

cfg/posix.cfg

@@ -2148,11 +2148,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
+      <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
     <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
+      <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
     <arg nr="3" direction="in">

cfg/windows.cfg

@@ -4319,11 +4319,13 @@ HFONT CreateFont(
     <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
+      <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
     <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
+      <strz/>
       <minsize type="argvalue" arg="3"/>
     </arg>
     <arg nr="3" direction="in">

lib/checkbufferoverrun.cpp

@@ -606,10 +606,11 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons
             }
         } else if (checkStringLiteral && bufTok->tokType() == Token::Type::eString && bufTok->valueType()) {
             ValueFlow::Value strSizeVal;
+            strSizeVal.setKnown();
             strSizeVal.valueType = ValueFlow::Value::ValueType::BUFFER_SIZE;
             const size_t charSize = bufTok->valueType()->getSizeOf(settings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointee);
             if (charSize > 0) {
-                strSizeVal.intvalue = Token::getStrArraySize(bufTok) * charSize;
+                strSizeVal.intvalue = (Token::getStrArraySize(bufTok) - index) * charSize;
                 return strSizeVal;
             }
         }

lib/checkfunctions.cpp

@@ -102,12 +102,14 @@ void CheckFunctionsImpl::functionCalledError(const Token* tok, Severity severity
     reportError(tok, severity, prefix + "Called", msg, CWE477, Certainty::normal);
 }
 
-static bool hasArgMinSize(const Token* ftok, int argnr, const Settings& settings)
+static bool hasArgMinReadSize(const Token *ftok, int argnr, const Library &library)
 {
-    if (const std::vector<Library::ArgumentChecks::MinSize>* minsizes = settings.library.argminsizes(ftok, argnr)) {
-        return std::any_of(minsizes->begin(), minsizes->end(), [](const Library::ArgumentChecks::MinSize& ms) {
-            return ms.type == Library::ArgumentChecks::MinSize::Type::ARGVALUE;
-        });
+    if (library.getArgDirection(ftok, argnr) == Library::ArgumentChecks::Direction::DIR_IN) {
+        if (const std::vector<Library::ArgumentChecks::MinSize> *minsizes = library.argminsizes(ftok, argnr)) {
+            return std::any_of(minsizes->begin(), minsizes->end(), [](const Library::ArgumentChecks::MinSize &ms) {
+                return ms.type == Library::ArgumentChecks::MinSize::Type::ARGVALUE;
+            });
+        }
     }
     return false;
 }
@@ -147,7 +149,7 @@ void CheckFunctionsImpl::invalidFunctionUsage()
                         invalidFunctionArgError(argtok, functionToken->str(), argnr, nullptr, mSettings.library.validarg(functionToken, argnr));
                 }
                 // check <strz>
-                if (mSettings.library.isargstrz(functionToken, argnr) && !hasArgMinSize(functionToken, argnr, mSettings)) {
+                if (mSettings.library.isargstrz(functionToken, argnr) && !hasArgMinReadSize(functionToken, argnr, mSettings.library)) {
                     if (Token::Match(argtok, "& %var% !![") && argtok->next() && argtok->next()->valueType()) {
                         const ValueType * valueType = argtok->next()->valueType();
                         const Variable * variable = argtok->next()->variable();

test/cfg/std.c

@@ -78,6 +78,9 @@ void invalidFunctionArgStr_strncat(void)
     // No warning is expected for
     strncat (str1, &src, 1);
     puts (str1);
+    char d[] = {'a','b','c'};
+    // cppcheck-suppress invalidFunctionArgStr
+    strncat(d, "def", 1);
 }
 
 char * invalidFunctionArgStr_strpbrk( const char *p )

test/testbufferoverrun.cpp

@@ -3650,7 +3650,7 @@ class TestBufferOverrun : public TestFixture {
               "    char buf[128];\n"
               "    memcpy(buf, \"abc\", 5);\n"
               "}\n");
-        ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
+        ASSERT_EQUALS("[test.cpp:3:17]: (error) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
                       errout_str());
 
         check("void f() {\n"
@@ -3663,7 +3663,7 @@ class TestBufferOverrun : public TestFixture {
               "    char buf[128];\n"
               "    memcpy(buf, L\"abc\", 4 * sizeof(wchar_t) + 1);\n"
               "}\n");
-        ASSERT_EQUALS("[test.cpp:3:17]: (warning) Buffer is accessed out of bounds: L\"abc\" [bufferAccessOutOfBounds]\n",
+        ASSERT_EQUALS("[test.cpp:3:17]: (error) Buffer is accessed out of bounds: L\"abc\" [bufferAccessOutOfBounds]\n",
                       errout_str());
 
         check("int f(char* s) {\n"
@@ -3675,6 +3675,12 @@ class TestBufferOverrun : public TestFixture {
               "    return memcmp(buf, u\"abc\", 4 * sizeof(char16_t));\n"
               "}\n");
         ASSERT_EQUALS("", errout_str());
+
+        check("int f(const char* buf) {\n"
+              "    return memcmp(buf, &\"abc\"[2], 4 * sizeof(char));\n"
+              "}\n");
+        ASSERT_EQUALS("[test.cpp:2:24]: (error) Buffer is accessed out of bounds: &\"abc\"[2] [bufferAccessOutOfBounds]\n",
+                      errout_str());
     }
 
     void buffer_overrun_errorpath() {
@@ -4657,7 +4663,7 @@ class TestBufferOverrun : public TestFixture {
         check("void f() {\n"
               "  mymemset(\"abc\", 0, 20);\n"
               "}\n", settings);
-        ASSERT_EQUALS("[test.cpp:2:12]: (warning) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
+        ASSERT_EQUALS("[test.cpp:2:12]: (error) Buffer is accessed out of bounds: \"abc\" [bufferAccessOutOfBounds]\n",
                       errout_str());
 
         check("void f() {\n"