I tried running Polyspace Bug Finder R2022b on your example and I see some more details associated with the result (I am showing the results as seen in the desktop product, but it should be the same on Polyspace Access). See here:
It seems that the size of the flexible array member cannot be determined from the code you have, so Polyspace is assuming zero size (which is the case by default). I modified the example to actually allocate memory for the structure with the flexible array member (such that the array member has size 1) and the violation no longer occurs.
Original code
typedef unsigned char uint8;
typedef struct s_test_struc
{
uint8 test_var1[15];
uint8 test_var2[1];
uint8 test_var3[]; // flexible array (size of array is 1)
} test_struc;
test_struc test_struc_var;
#define test_struc_var_m (&test_struc_var)
uint8 function_where_the_violation_is_detected (const uint8 *var1, uint8 *var2, uint8 *var3)
{
uint8 local_var = *var1 - *var2;
uint8 ret_val = 0;
if(local_var > 0)
{
ret_val = (*var3) + (uint8)1; // ARR30-C/MEM35-C violation detected on the (*var3)
}
return ret_val;
}
uint8 caller_function (void)
{
uint8 ret_val = 0;
// test_struc_var is initialized with 0 using memset in some other function
function_where_the_violation_is_detected(&(test_struc_var_m->test_var1[2])
,&(test_struc_var_m->test_var2[0])
,&(test_struc_var_m->test_var3[0]));
}
To fix the issue, instead of:
#define test_struc_var_m (&test_struc_var)
Allocate memory to test_struc_var_m using an allocation statement like the following (and ofcourse, deallocate later):
test_struc* test_struc_var_m = malloc(sizeof(test_struc) + sizeof(char));
Now, the sizeof(char) in the allocation makes sure that the flexible array member has size 1.
