================
@@ -684,11 +687,56 @@ void WalkAST::checkCall_mkstemp(const CallExpr *CE, const
FunctionDecl *FD) {
// the Bounds of a Memory Buffer
//===----------------------------------------------------------------------===//
+
+void WalkAST::emitUnboundedStringDiagnostic(const CallExpr *CE, StringRef Name,
+ StringRef NarrowReplacement,
+ bool IsWide) {
+ // Construct the warning title and description.
+ SmallString<128> Buf1;
+ SmallString<512> Buf2;
+ llvm::raw_svector_ostream Out1(Buf1);
+ llvm::raw_svector_ostream Out2(Buf2);
+
+ Out1 << "Potential insecure memory buffer bounds restriction in call '"
+ << Name << "'";
+
+ Out2 << "Call to function '" << Name
+ << "' is insecure as it does not "
+ "provide bounding of the memory buffer. Replace "
+ "unbounded copy functions with analogous functions that "
+ "support length arguments";
+
+ if (IsWide)
+ Out2 << " for wide-character strings";
+ else
+ Out2 << " such as '" << NarrowReplacement << "'";
+
+ Out2 << ". CWE-119.";
----------------
steakhal wrote:
I think @benedekaibas might have an opinion about warning messages and
punctuation.
https://github.com/llvm/llvm-project/pull/234582
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
