False positive: C++ functions named `read` are reported as POSIX `read`

[rikki322]

Hi, I found a false positive regarding the rule buffer/read.

Flawfinder reports FF1029 on C++ member functions and namespace-qualified functions named read, even when they are user-defined functions and not calls to the POSIX read API.

Program

struct Stream {
  int read(void *, unsigned) { return 0; }
};

namespace safe_ops {
int read(int, void *, unsigned) { return 0; }
} // namespace safe_ops

int main() {
  int x = 0;
  Stream stream;
  stream.read(&x, sizeof(x));
  safe_ops::read(0, &x, sizeof(x));
  return 0;
}

The program compiles and runs normally. Neither Stream::read nor safe_ops::read is the POSIX read function.

Actual Result

Flawfinder reports buffer/read warnings at the user-defined member function, the namespace function, and the namespace-qualified call.

FINAL RESULTS:

read_identifier_false_positive.cpp:2:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
read_identifier_false_positive.cpp:6:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).
read_identifier_false_positive.cpp:13:  [1] (buffer) read:
  Check buffer boundaries if used in a loop including recursive loops
  (CWE-120, CWE-20).

Expected Result

Flawfinder should not report buffer/read for C++ member functions or namespace-qualified functions merely because their identifier is named read.

Verification

flawfinder read_identifier_false_positive.cpp

Version: 2.0.20

[david-a-wheeler]

Flawfinder has no way to know which read is in view. It looks a line at a time, and doesn't know about types or values. FOO.read might not be POSIX read, but it might be or it might emulate the POSIX read.

I don't see any obvious way to do what you're requesting.