Examples of errors detected by the V505 diagnostic

V505. The 'alloca' function is used inside the loop. This can quickly overflow stack.

Crystal Space 3D SDK

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. applighter2 scene.cpp 942

#define CS_ALLOC_STACK_ARRAY(type, var, size) \
  type *var = (type *)alloca ((size) * sizeof (type))

void Scene::PropagateLight (....)
{
  ....
  PortalRefArray::Iterator it =
    sourceSector->allPortals.GetIterator ();
  while (it.HasNext ())
  {
    ....
    CS_ALLOC_STACK_ARRAY(csVector3,
      tmpVertices, portal->worldVertices.GetSize ());
    ....
  }
}

Multi-threaded Dynamic Queue

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. GridCtrl gridctrl.cpp 2332

COleDataSource* CGridCtrl::CopyTextFromGrid()
{
  ....
  for (int row = Selection.GetMinRow();
    row <= Selection.GetMaxRow(); row++)
  {
    ....
    sf.Write(T2A(str.GetBuffer(1)), str.GetLength());
    ....
  }
  ....
}

This code is potentially dangerous. T2A() macro uses alloca() function. As alloca() function is called from within the loop, it can quickly lead to stack overflow.

Pixie

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. ri polygons.cpp 1120

inline  void  triangulatePolygon(....) {
  ....
  for (i=1;i<nloops;i++) {
    ....
    do {
      ....
      do {
        ....
        CTriVertex *snVertex =
          (CTriVertex *) alloca(2*sizeof(CTriVertex));
        ....
      } while(dVertex != loops[0]);
      ....
    } while(sVertex != loops[i]);
    ....
  }
  ....
}

DeSmuME

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. DeSmuME_VS2005 7zip.cpp 161

ArchiveFile::ArchiveFile(const char* filename)
{
  ....
  for(size_t i = 0;
      i < s_formatInfos.size() && m_typeIndex < 0;
      i++)
  {
    ....
    char* fileSig = (char*)_alloca(len);
    ....
  }
  ....
}

Synergy

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. rijndael.cpp 1206

size_t Rijndael::Enc::AdvancedProcessBlocks(....) const
{
  ....
  do {
    space = (byte *)alloca(255+sizeof(Locals));
    space += (256-(size_t)space%256)%256;
  }
  while (AliasedWithTable(space, space+sizeof(Locals)));
  ....
}

Similar errors can be found in some other places:

• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. cmswindowsscreensaver.cpp 398

Tizen

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. audio_io_test.c 247

int audio_io_loopback_in_test()
{
  ....
  while (1) {
    char *buffer = alloca(size);
    if ((ret = audio_in_read(input, (void *)buffer, size)) >
                                           AUDIO_IO_ERROR_NONE) {
      fwrite(buffer, size, sizeof(char), fp);
      printf("PASS, size=%d, ret=0x%x\n", size, ret);
    } else {
      printf("FAIL, size=%d, ret=0x%x\n", size, ret);
    }
  }
  ....
}

EFL Core Libraries

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. evas_font_dir.c 129

static Eina_List *
evas_font_set_get(const char *name)
{
  ....
  const char *pp;
  char *nm;
  pp = name;
  while (p)
  {
    nm = alloca(p - pp + 1);
    strncpy(nm, pp, p - pp);
    nm[p - pp] = 0;
    fonts = eina_list_append(fonts, eina_stringshare_add(nm));
    pp = p + 1;
    p = strchr(pp, ',');
    if (!p) fonts = eina_list_append(fonts,
                                     eina_stringshare_add(pp));
  }
  ....
}

Similar errors can be found in some other places:

• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. eina_benchmark.c 285
• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. eina_module.c 547
• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. eldbus_message_from_eina_value.c 327
• And 21 additional diagnostic messages.

TDengine

V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. mndVgroup.c 807

#define TSWAP(a, b)                  \
  do {                               \
    char *__tmp = (char*)alloca(sizeof(a)); \
    (void)memcpy(__tmp, &(a), sizeof(a));  \
    (void)memcpy(&(a), &(b), sizeof(a));   \
    (void)memcpy(&(b), __tmp, sizeof(a));  \
  } while (0)

void mndSortVnodeGid(SVgObj *pVgroup) {
  for (int32_t i = 0; i < pVgroup->replica; ++i) {
    for (int32_t j = 0; j < pVgroup->replica - 1 - i; ++j) {
      if (pVgroup->vnodeGid[j].dnodeId > pVgroup->vnodeGid[j + 1].dnodeId) {
        TSWAP(pVgroup->vnodeGid[j], pVgroup->vnodeGid[j + 1]);
      }
    }
  }
}

Similar errors can be found in some other places:

• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. mergeoperator.c 361
• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. mergejoin.c 3085
• V505 The 'alloca' function is used inside the loop. This can quickly overflow stack. mergejoin.c 3147
• And 5 additional diagnostic messages.