1*1f5207b7SJohn Levon #include "check_debug.h" 2*1f5207b7SJohn Levon 3*1f5207b7SJohn Levon void strcpy(char *to, char *from, int size); 4*1f5207b7SJohn Levon func(char * a,char * b)5*1f5207b7SJohn Levonvoid func (char *a, char *b) 6*1f5207b7SJohn Levon { 7*1f5207b7SJohn Levon char c[4]; 8*1f5207b7SJohn Levon char d[4]; 9*1f5207b7SJohn Levon char e[4]; 10*1f5207b7SJohn Levon char f[4]; 11*1f5207b7SJohn Levon 12*1f5207b7SJohn Levon b = "1234"; 13*1f5207b7SJohn Levon strcpy(a, b); 14*1f5207b7SJohn Levon a[5] = '\0'; 15*1f5207b7SJohn Levon strcpy(c, b); 16*1f5207b7SJohn Levon strcpy(d, "123"); 17*1f5207b7SJohn Levon strcpy(e, "1234"); 18*1f5207b7SJohn Levon strcpy(f, "12"); 19*1f5207b7SJohn Levon f[3] = '\0'; 20*1f5207b7SJohn Levon } 21*1f5207b7SJohn Levon /* 22*1f5207b7SJohn Levon * check-name: smatch strcpy overflow 23*1f5207b7SJohn Levon * check-command: smatch -I.. sm_overflow3.c 24*1f5207b7SJohn Levon * 25*1f5207b7SJohn Levon * check-output-start 26*1f5207b7SJohn Levon sm_overflow3.c:15 func() error: strcpy() 'b' too large for 'c' (5 vs 4) 27*1f5207b7SJohn Levon sm_overflow3.c:17 func() error: strcpy() '"1234"' too large for 'e' (5 vs 4) 28*1f5207b7SJohn Levon * check-output-end 29*1f5207b7SJohn Levon */ 30