codeql/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/test.cpp

typedef unsigned int size_t;
void *memcpy(void *s1, const void *s2, size_t n);
size_t strlen(const char *s);
int ntohl(int x);

void test1(const char *source, size_t len)
{
	char buffer[256];
	size_t len2 = ntohl(len);

	memcpy(buffer, source, ntohl(len)); // BAD

	if (len2 < 256)
	{
		memcpy(buffer, source, len2); // GOOD
	}

	if (source != 0)
	{
		memcpy(buffer, source, len2); // BAD
	}

	if ((len2 < 256) && (source != 0))
	{
		memcpy(buffer, source, len2); // GOOD
	}

	if ((len2 < 256) || (source != 0))
	{
		memcpy(buffer, source, len2); // BAD
	}

	if (len2 < 256)
	{
		if (source != 0)
		{
			memcpy(buffer, source, len2); // GOOD
		}
	}

	if (len2 >= 256)
	{
		// fail
	} else {
		memcpy(buffer, source, len2); // GOOD
	}

	if (len2 + 1 < 256)
	{
		memcpy(buffer, source, len2 + 1); // GOOD
	}

	if (strlen(source) < 256)
	{
		memcpy(buffer, source, strlen(source)); // GOOD
	}

	if (strlen(source) < 256)
	{
		memcpy(buffer, source, len2); // BAD
	}

	buffer[len2] = 0; // BAD

	if (len2 < 256)
	{
		buffer[len2] = 0; // GOOD
	}

	{
		unsigned short lens = len2;
		buffer[lens] = 0; // BAD
	}

	if (len2 < 256)
	{
		unsigned short lens = len2;
		buffer[lens] = 0; // GOOD
	}

	size_t len3 = 0;
	if (len3 < 256)
	{
		len3 = ntohl(len);
		buffer[len3] = 0; // BAD
	}
}

void test2(size_t len)
{
	char buffer[256];

	buffer[len] = 0; // BAD
}

void test3(size_t len)
{
	test2(ntohl(len));
}