out-of-bounds
Default severity: error · Identifier: weavec::out-of-bounds
What it means
Section titled “What it means”An access reaches past the object it is in, or before its start (RFC 0011). Direct accesses: '<p>[<i>]' is out of bounds: index <k> of an object of <n> bytes (both constant; the index is spelled as written, with its folded value in parentheses when that differs), '<p>[<i>]' is out of bounds: '<i>' is the number of elements of '<p>' / '<i>' is at least '<n>', the number of elements of '<p>' / '<i>' is above '<n>', ... (the index related to the count by a condition), '<p>[<i>]' may be out of bounds: '<i>' may equal '<n>', the number of elements of '<p>' (i <= n: the boundary is one past) / '<i>' may reach one below '<n>', and '<p>' has <n> * 4 bytes (p[i + 1] under i < n), '<p>[<i>]' may be out of bounds: '<i>' may be 7 in an object of 4 bytes (the index bounded above by a constant: for (i = 0; i < 8; i++)), '<p>[<i>]' is out of bounds: index <k> is before the start of '<p>'. Library calls with a buffer and a length (memcpy, memmove, memset, memcmp, fgets, snprintf, read, write, strncpy, …): 'memcpy' accesses 16 bytes of '<p>', which has 8 bytes and the relational forms ('memset' accesses 'm' bytes of 'p', which has 'n' bytes ('m' is above 'n'), 'memset' may access past the end of 'buf': 'n' may be 8, and 'buf' has 4 bytes). A callee’s requirement at the call: 'put7' requires 8 bytes behind '<p>', which has 4 bytes. Notes: '<p>' is allocated here / '<p>' is declared here / the object behind '<p>' is declared here. Extents come from allocations (malloc(n), calloc(n, sz), realloc(p, n), and every function in the program that returns one: xmalloc(n) returns fresh extent=n), from the declared size of a variable, an array or an array member, from string literals, from WEAVEC_SIZED_BY on a parameter, and from the count of a sized field (RFC 0012), declared or inferred ('b->data[b->cap]' is out of bounds: 'b->cap' is the number of elements of 'b->data', note 'b->data' is declared here). Strings (RFC 0012): a copy that needs the length plus the terminator is checked like a length ('strcpy' accesses 6 bytes of 'buf', which has 4 bytes, 'strcpy' accesses 'strlen(s)' + 1 bytes of 'd', which has 'strlen(s)' bytes on malloc(strlen(s)), 'strcat' accesses 5 bytes of 'buf', which has 4 bytes counting what buf already holds, 'sprintf' accesses at least 5 bytes of 'buf', which has 4 bytes from the format’s minimum), and a terminator-seeking read (strlen, strcpy’s source, strcat’s, puts, printf("%s")) of an object the checker knows has no terminator (strncpy that filled it, char a[4] = "abcd", memset(a, 'x', sizeof a)) is 'strlen' reads past the end of 'name', which is not NUL-terminated, note 'name' is left without a terminator here. Relations one step further (RFC 0012): 'a[i + 1]' may be out of bounds: 'i' may reach one below 'n', and 'a' has 'n' * 4 bytes under i <= n - 1, 'buf[i]' is out of bounds: 'i' is at least 8 in an object of 8 bytes under i >= 8. RFC 0017 also checks actual converted or wrapped allocation sizes, represented products, VLA dimensions and allocated flexible-array tails; a dimension violation can say '<access>' is out of bounds for its variable array dimension, and a caller interval can say '<callee>' requires '<p>' before its start. Unresolved indices, unknown sizes or offsets, unsupported field layouts and unknown string lengths do not by themselves produce this error or establish safety.
How to resolve it
Section titled “How to resolve it”Compare the access against the actual allocation size, including element size and space for string terminators. Array indices must be smaller than the element count. Establish and preserve bounds across calls; a capacity field does not enlarge the allocation it describes.