test.cpp

typedef unsigned int size_t;

void *memcpy(void *dest, const void *src, size_t count);

void f1(void)
{
	char buffer1[3];
	char buffer2[] = {'a', 'b', 'c'};
	int i;

	for (i = 0; i < 3; i++)
	{
		buffer1[i] = 0; // GOOD
		buffer2[i] = 0; // GOOD
	}
	for (i = 0; i < 4; i++)
	{
		buffer1[i] = 0; // BAD
		buffer2[i] = 0; // BAD
	}

	memcpy(buffer1, buffer2, 3); // GOOD
	memcpy(buffer1, buffer2, 4); // BAD
	memcpy(buffer2, buffer1, 3); // GOOD
	memcpy(buffer2, buffer1, 4); // BAD
}

void f2(char *src)
{
	char buffer[100];
	char *ptr;
	int amount;

	amount = 100;
	memcpy(buffer, src, amount); // GOOD
	amount = amount + 1;
	memcpy(buffer, src, amount); // BAD [NOT DETECTED]
	amount = 101;
	memcpy(buffer, src, amount); // BAD

	ptr = buffer;
	memcpy(ptr, src, 101); // BAD [NOT DETECTED]
	ptr = &(buffer[0]);
	memcpy(ptr, src, 101); // BAD [NOT DETECTED]
	ptr = &(buffer[1]);
	memcpy(ptr, src, 100); // BAD [NOT DETECTED]
}