Fix #15124 FN bufferAccessOutOfBounds with wmemcpy() (#8951)

Co-authored-by: chrchr-github <noreply@github.com>

Author: chrchr-github

cfg/gnu.cfg

@@ -650,7 +650,7 @@
       <not-bool/>
     </arg>
   </function>
-  <!-- https://man7.org/linux/man-pages/man3/mempcpy.3.html-->
+  <!-- https://man7.org/linux/man-pages/man3/wmempcpy.3.html -->
   <!-- wchar_t *wmempcpy(wchar_t *restrict dest, const wchar_t *restrict src, size_t n);-->
   <function name="wmempcpy">
     <returnValue type="wchar_t *"/>
@@ -659,12 +659,12 @@
     <not-overlapping-data ptr1-arg="1" ptr2-arg="2" size-arg="3"/>
     <arg nr="1" direction="out">
       <not-null/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="3" direction="in">
       <not-uninit/>

cfg/std.cfg

@@ -3928,7 +3928,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <arg nr="1">
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2" direction="in">
       <not-uninit/>
@@ -3974,12 +3974,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="3" direction="in">
       <not-uninit/>
@@ -4016,12 +4016,12 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <not-overlapping-data ptr1-arg="1" ptr2-arg="2" count-arg="3"/>
     <arg nr="1" direction="out">
       <not-null/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="3" direction="in">
       <not-uninit/>
@@ -4081,13 +4081,13 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <leak-ignore/>
     <arg nr="1" direction="out">
       <not-null/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2">
       <!-- TODO: direction? memory could be overwritten -->
       <not-null/>
       <not-uninit/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="3" direction="in">
       <not-uninit/>
@@ -4141,7 +4141,7 @@ The obsolete function 'gets' is called. With 'gets' you'll get a buffer overrun
     <leak-ignore/>
     <arg nr="1" direction="out">
       <not-null/>
-      <minsize type="argvalue" arg="3"/>
+      <minsize type="argvalue" arg="3" baseType="wchar_t"/>
     </arg>
     <arg nr="2" direction="in">
       <not-uninit/>

test/cfg/gnu.c

@@ -376,6 +376,13 @@ wchar_t *nullPointer_wmempcpy(wchar_t *dest, const wchar_t *src, size_t n)
     return wmempcpy(dest,src,n);
 }
 
+void bufferAccessOutOfBounds_wmempcpy(const wchar_t *src)
+{
+    wchar_t buf[3];
+    // cppcheck-suppress bufferAccessOutOfBounds
+    wmempcpy(buf, src, 5);
+}
+
 int uninitvar_getpw(uid_t uid, char *buf)
 {
     uid_t someUid;

test/cfg/std.c

@@ -619,6 +619,20 @@ void bufferAccessOutOfBounds_wcsncpy()
     wcsncpy(s, L"abc", 17);
 }
 
+void bufferAccessOutOfBounds_wmemcpy()
+{
+    wchar_t a[4];
+    // cppcheck-suppress bufferAccessOutOfBounds
+    wmemcpy(a, L"abcd", 5);
+}
+
+int bufferAccessOutOfBounds_wmemcmp(const wchar_t* b)
+{
+    const wchar_t a[4] = { L'a', L'b', L'c', L'd' };
+    // cppcheck-suppress bufferAccessOutOfBounds
+    return wmemcmp(a, b, 5);
+}
+
 int nullPointer_wcsncmp(const wchar_t* s1, const wchar_t* s2, size_t n)
 {
     // cppcheck-suppress nullPointer
@@ -2940,6 +2954,27 @@ void *bufferAccessOutOfBounds_memchr(const void *s, int c, size_t n)
     return memchr(s,c,n);
 }
 
+bool bufferAccessOutOfBounds_wmemchr(wchar_t c)
+{
+    const wchar_t buf[] = {'a', 'b', 'c'};
+    // cppcheck-suppress bufferAccessOutOfBounds
+    return wmemchr(buf, c, 5) != NULL;
+}
+
+void bufferAccessOutOfBounds_wmemset(wchar_t c)
+{
+    wchar_t buf[3];
+    // cppcheck-suppress bufferAccessOutOfBounds
+    wmemset(buf, c, 5);
+}
+
+void bufferAccessOutOfBounds_wmemmove(const wchar_t* s)
+{
+    wchar_t d[3];
+    // cppcheck-suppress bufferAccessOutOfBounds
+    wmemmove(d, s, 5);
+}
+
 void uninitvar_wmemchr(void)
 {
     const wchar_t *cs;