Static Analyzer reports buffer overrun in comdef.h: C6386

The static analyzer doesn't like a section of code in the standard include file comdef.h(258):

m_pszMsg = (LPTSTR)LocalAlloc(0, 32 *sizeof(TCHAR));

if (m_pszMsg != NULL) {

WORD wCode = WCode();

if (wCode != 0) {

_COM_PRINTF_S_1(m_pszMsg, 32, TEXT("Unknown error 0x%0lX"), m_hresult);

To me this seems a hick-up of the static anaylzer. I have see some other post that described that this is caused by the fact that /analyze was defined for the project or just activated by the project menu. But that post was about a pre-release, and I am using the released version of VC2005.

Have anybody else seen this issue and knows a workaround for it?

[1053 byte] By [VBADerks] at [2007-12-20]

«« How to Impersonate in wsHttpBinding?
»» C# & Lotus Notes

# 1

You are correct, this is a problem in static analyzer, which unfortunately was not fixed before release. It is already fixed for upcoming version of VS.

Please try this workaround:

#pragma warning (push)

#pragma warning (disable:6386) // or disable several warnings

#include <comdef.h> // or include other files as well

#pragma warning (pop)

NataliaGlagoleva-MSFT at 2007-9-9 >

top of Msdn Tech,Visual Studio Team System,Visual Studio Performance Tools (Profiler)...

# 2

Thanks for confirming that this is a problem in the current version. I will use the workaround for the moment.

Is there a timeline for the upcoming version?

VBADerks at 2007-9-9 >

# 3

Timelines are hard to predict exactly but the plans are to align Orcas work as closely as possible to CTP release dates, another page that might be worth checking from time to time for info on Orcas is here:

http://msdn.microsoft.com/vstudio/future/default.aspx

Hope that helps!

Eric Jarvi
http://blogs.msdn.com/ejarvi

EricJarviMSFT at 2007-9-9 >

# 4

Since this is a bug and not a feature, shouldn't this be included in Visual Studio 2005 Service Pack 1?

GaryD at 2007-9-9 >

# 5

There's a bug logged for this in Visual Studio and .NET Framework feedback:

https://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=101816

If you think it's important, be sure to validate/vote.

PeterRitchie at 2007-9-9 >