Sitelet https://github.com/cppcheck-opensource/cppcheck/pull/8772
Skip to content

Fix 14956: FP arrayIndexOutOfBounds with break in loop - #8772

Open
pfultz2 wants to merge 3 commits into
cppcheck-opensource:mainfrom
pfultz2:valueflow-skip-unconditional-break
Open

Fix 14956: FP arrayIndexOutOfBounds with break in loop#8772
pfultz2 wants to merge 3 commits into
cppcheck-opensource:mainfrom
pfultz2:valueflow-skip-unconditional-break

Conversation

@pfultz2

@pfultz2 pfultz2 commented Aug 2, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

" arr[idx] = 0;\n"
"}\n");
ASSERT_EQUALS(
"[test.cpp:9:8]: (error) Array 'arr[3]' accessed at index 3, which is out of bounds. [arrayIndexOutOfBounds]\n",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi! I am new so sorry if this is a silly question.

I thought that if we want to return an error, we must be guaranteed that it is actually an error. In this input it looks like the array access is only out of bounds if c is true. Since we don't know anything about c, I thought we couldn't report any errors. I would expect the correct output for this testcase to be no errors.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @aadanen thanks for your question. Sorry for slow reply.
I feel this testcase is OK. If c is always false then the error would technically be a false positive. However then the condition would be redundant and the user should remove it.
Theoretically it would be an improvement to say something like "Either the condition (c) is redundant or there can be array index out of bounds".

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I understand now. Thanks!

@aadanen

aadanen commented Aug 5, 2026

Copy link
Copy Markdown

I wonder if we could catch cases like this as well:

int s[5];
void f()
{
  short i;
  for (i = 0; 1; i++)
  {
    if ( i == 4 )
      break;
  }
  s[i] = 0;
}

which currently produces

break.c:10:3: error: Array 's[5]' accessed at index 9999, which is out of bounds. [arrayIndexOutOfBounds]
 s[i] = 0;
  ^
break.c:5:2: note: After for loop, i has value 9999
 for (i = 0; 1; i++)
 ^
break.c:10:3: note: Array index out of bounds
 s[i] = 0;

@danmar

danmar commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

which currently produces

that is a false positive! @pfultz2 I assume a ticket should be created? I can create it unless you feel you will fix it in this PR..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants