BSTR.OPS.ARITHM

Incorrect arithmetic operation with BSTR value

The BSTR.OPS.ARITHM checker finds instances of address arithmetics with BSTR entities. Using these operations on BSTR values leads to incorrect memory usage.

Vulnerability and risk

Because the two styles are constructed differently, converting COM-style BSTR strings to and from C-style strings needs care. In some cases, conversions between the two compile well, but still produce unexpected results.

Mitigation and prevention

Unlike C-style strings, BSTR strings have a 4-byte length prefix that contains the number of bytes in the following data string. BSTR strings can also contain embedded null characters, and aren't strongly typed. For these reasons, it's best not to use BSTR in new designs.

Vulnerable code example

1  void bstr_arithm() {
2       BSTR foo = SysAllocString(L"abc");
3       foo++; 
4  }

Klocwork flags line 3 in which an arithmetic operation is attempted on a BSTR value.

Related checkers

• BSTR.OPS.COMP
• BSTR.OPS.EQS