diff --git a/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp --- a/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -2380,9 +2380,9 @@ // Check that the source and destination do not overlap. // Iterate over CE->getNumArgs(), skipping all parameters which are not format // arguments - // For sprintf case, it starts at index 3: + // For sprintf case, it starts at position 3/index 2: // sprintf(char *buffer, const char* format, ... /* format arguments */); - unsigned int format_arguments_start_idx = 3; + unsigned int format_arguments_start_idx = 2; // snprintf case: one extra extra arguments for size // int snprintf(char *buffer, size_t bufsz, const char *format, // ... /* format arguments */); diff --git a/clang/test/Analysis/buffer-overlap.c b/clang/test/Analysis/buffer-overlap.c --- a/clang/test/Analysis/buffer-overlap.c +++ b/clang/test/Analysis/buffer-overlap.c @@ -45,6 +45,16 @@ sprintf(a, "%d/%s", 1, a); // expected-warning{{overlapping}} } +void test_sprintf2() { + char a[4] = {0}; + sprintf(a, "%s", a); // expected-warning{{overlapping}} +} + +void test_sprintf3() { + char a[4] = {0}; + sprintf(a, "%s/%s", a, a); // expected-warning{{overlapping}} +} + void test_snprintf1() { char a[4] = {0}; snprintf(a, sizeof(a), "%d/%s", 1, a); // expected-warning{{overlapping}} @@ -54,3 +64,13 @@ char a[4] = {0}; snprintf(a+1, sizeof(a)-1, "%d/%s", 1, a); // expected-warning{{overlapping}} } + +void test_snprintf3() { + char a[4] = {0}; + snprintf(a, sizeof(a), "%s", a); // expected-warning{{overlapping}} +} + +void test_snprintf4() { + char a[4] = {0}; + snprintf(a, sizeof(a), "%s/%s", a, a); // expected-warning{{overlapping}} +}