Why do some static analysis tools not report potential buffer overflows?

Question

I have an example of a strcpy command that seems to be a risk of a buffer overflow, but PVS-Studio doesn’t raise a warning. In my example, strcpy is used to copy a command line argument into a buffer, without checking the size of the command line argument. This could result in a buffer overflow if the argument exceeds the size of the buffer.

Code example:

char carg1[13];
int main(int argc, char* argv[])
{
// Get name from the 1st command line arg
       strcpy(carg1, argv[1]);
…
}

The size of argv[1] isn't checked before being coping into carg1. Shouldn’t this raise a warning?

Answer 1

It's theoretically impossible to build a perfect static analysis tool (this follows from results like the undecidability of the halting problem). As a result, all static analysis tools are at best heuristics that can try to detect certain classes of errors, and even then can't necessarily detect all of those errors.

So yes, the code you've got above looks like it has a potential buffer overflow. I honestly don't know why this particular tool can't detect the error, but my guess is that the internal heuristics the analyzer uses for some reason is failing to detect it.

Hope this helps!