<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>There is experimental support for buffer overflow checking:</div><div><br></div><div><div>$ clang --analyze -Xclang -analyzer-checker-help t5.c | grep ArrayBound</div><div> alpha.security.ArrayBound Warn about buffer overflows (older checker)</div><div> alpha.security.ArrayBoundV2 Warn about buffer overflows (newer checker)</div></div><div><br></div><div>Neither of these checkers are enabled by default, and neither of them can detect the error in this example. It wouldn't take much work to get those to handle this example, but buffer overflow checking in general requires a lot more work in the analyzer engine as it often involves reasoning about linear equations involving symbolic values, e.g:</div><div><br></div><div> symbolic_index * element size < symbolic_bounds</div><div><br></div><div>That kind of reasoning is currently beyond the analyzer's ability.</div><div><br></div><div>Cheers,</div><div>Ted</div><br><div><div>On Apr 29, 2013, at 9:54 AM, James Courtier-Dutton <<a href="mailto:james.dutton@gmail.com">james.dutton@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Which command line do I use to detect the obvious bounds error in the<br>attached C program?<br><br>Kind Regards<br><br>James<br><span><t5.c></span>_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br><a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a></div></blockquote></div><br></body></html>