codeql/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp

// tests1.cpp

typedef unsigned int size_t;

size_t strlen(const char *str);
size_t wcslen(const wchar_t *wcs);

char *strcpy(char *destination, const char *source);
wchar_t *wcscpy(wchar_t *strDestination, const wchar_t *strSource);

void *malloc(size_t size);
void *calloc(size_t num, size_t size);
void *realloc(void* ptr, size_t size);
void free(void *ptr);

void tests1(int case_num)
{
	const char *str = "abc";
	const wchar_t *wstr = L"12345";
	char *buffer = 0;
	wchar_t *wbuffer = 0;

	switch (case_num)
	{
		case 1:
			buffer = (char *)malloc(strlen(str)); // BAD
			strcpy(buffer, str);
			break;

		case 2:
			buffer = (char *)malloc(strlen(str) + 1); // GOOD
			strcpy(buffer, str);
			break;

		case 3:
			buffer = (char *)malloc(strlen(str) * sizeof(char)); // BAD
			strcpy(buffer, str);
			break;

		case 4:
			buffer = (char *)malloc((strlen(str) + 1) * sizeof(char)); // GOOD
			strcpy(buffer, str);
			break;

		case 5:
			buffer = (char *)calloc(strlen(str), sizeof(char)); // BAD [NOT DETECTED]
			strcpy(buffer, str);
			break;

		case 6:
			buffer = (char *)calloc(strlen(str) + 1, sizeof(char)); // GOOD
			strcpy(buffer, str);
			break;

		case 7:
			buffer = (char *)realloc(buffer, strlen(str)); // BAD
			strcpy(buffer, str);
			break;

		case 8:
			buffer = (char *)realloc(buffer, strlen(str) + 1); // GOOD
			strcpy(buffer, str);
			break;

		case 9:
			int len1 = strlen(str);
			buffer = (char *)malloc(len1); // BAD
			strcpy(buffer, str);
			break;

		case 10:
			int len2 = strlen(str) + 1;
			buffer = (char *)malloc(len2); // GOOD
			strcpy(buffer, str);
			break;

		case 11:
			int len3 = strlen(str);
			buffer = (char *)malloc(len3 + 1); // GOOD
			strcpy(buffer, str);
			break;

		case 12:
			buffer = (char *)malloc(strlen(str) + 0); // BAD [NOT DETECTED]
			strcpy(buffer, str);
			break;

		case 101:
			wbuffer = (wchar_t *)malloc(wcslen(wstr)); // BAD
			wcscpy(wbuffer, wstr);
			break;

		case 102:
			wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // BAD (no sizeof) [NOT DETECTED]
			wcscpy(wbuffer, wstr);
			break;

		case 103:
			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // BAD [NOT DETECTED]
			wcscpy(wbuffer, wstr);
			break;

		case 104:
			wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // BAD (wrong sizeof) [NOT DETECTED]
			wcscpy(wbuffer, wstr);
			break;

		case 105:
			wbuffer = (wchar_t *)malloc(wcslen(wstr) * sizeof(wchar_t)); // BAD
			wcscpy(wbuffer, wstr);
			break;

		case 106:
			wbuffer = (wchar_t *)malloc((wcslen(wstr) + 1) * sizeof(wchar_t)); // GOOD
			wcscpy(wbuffer, wstr);
			break;

		case 107:
			wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // BAD [NOT DETECTED]
			wcscpy(wbuffer, wstr);
			break;

		case 108:
			wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(wchar_t)); // GOOD
			wcscpy(wbuffer, wstr);
			break;
	}
	
	if (buffer != 0)
	{
		free(buffer);
	}
	if (wbuffer != 0)
	{
		free(wbuffer);
	}
}