c - 越界访问缓冲区 ''

Question

在使用静态代码分析工具 cppcheck ( http://sourceforge.net/apps/mediawiki/cppcheck/index.php?title=Main_Page) 检查期间，该工具发现代码中存在严重错误:

#define MAX_PICTURE_HISTORY 10

#define PICTURE_INTERLACED_ODD 1
#define PICTURE_INTERLACED_EVEN 2

typedef struct
{
    unsigned char* pData;
    unsigned int Flags;
} TPicture;


typedef struct
{
    TPicture* PictureHistory[MAX_PICTURE_HISTORY];
    unsigned char *Overlay;
    unsigned int OverlayPitch;
    unsigned int LineLength;
    int FrameWidth;
    int FrameHeight;
    int FieldHeight;
    MEMCPY_FUNC* pMemcpy;
    unsigned int InputPitch;
} TDeinterlaceInfo;

代码:

TPicture Picture[ 8 ];
int stride = (width*2);
int i;

Info.FieldHeight = height / 2;
Info.FrameHeight = height;
Info.FrameWidth = width;
Info.InputPitch = stride*2;
Info.LineLength = stride;
Info.OverlayPitch = outstride;
Info.pMemcpy = fast_memcpy;

Picture[ 0 ].pData = data->f0 + stride;
Picture[ 0 ].Flags = PICTURE_INTERLACED_ODD;

Picture[ 1 ].pData = data->f0;
Picture[ 1 ].Flags = PICTURE_INTERLACED_EVEN;

Picture[ 2 ].pData = data->f1 + stride;
Picture[ 2 ].Flags = PICTURE_INTERLACED_ODD;

Picture[ 3 ].pData = data->f1;
Picture[ 3 ].Flags = PICTURE_INTERLACED_EVEN;

Picture[ 4 ].pData = data->f2 + stride;
Picture[ 4 ].Flags = PICTURE_INTERLACED_ODD;

Picture[ 5 ].pData = data->f2;
Picture[ 5 ].Flags = PICTURE_INTERLACED_EVEN;

for( i = 0; i < MAX_PICTURE_HISTORY; i++ ) {
    Info.PictureHistory[ i ] = &(Picture[ i ]);   /* <-- The buffer Picture is accessed out of bounds */
}

上面的代码好像没有什么问题。有什么想法为什么这些会被选中以及如何解决这个问题吗？最好的问候。

Answer 1

MAX_PICTURE_HISTORY 定义为 10 但 Picture 只有 8 个元素