Merge pull request #4922 from eholk/c6200-heuristics

C6200 heuristics

Author: JamesJBarnett

docs/code-quality/c6200.md

@@ -8,9 +8,9 @@ ms.assetid: bbeb159b-4e97-4317-9a07-bb83cd03069a
 ---
 # Warning C6200
 
-> Index '*index*' is out of valid index range '*min*' to '*max*' for non-stack buffer '*parameter-name*'
+> Index '*index*' is out of valid index range '*min*' to '*max*' for nonstack buffer '*parameter-name*'
 
-This warning indicates that an integer offset into the specified non-stack array exceeds the maximum bounds of that array, potentially causing random behavior and/or crashes.
+This warning indicates that an integer offset into the specified nonstack array exceeds the maximum bounds of that array, causing undefined behavior and potentially crashes.
 
 ## Remarks
 
@@ -47,3 +47,27 @@ void f()
     delete[] buff;
 }
 ```
+
+## Heuristics
+
+Code analysis can't always prove whether an array index is in range. This can happen, for example, when the index is computed from a complex expression, including those expressions that call into other functions. In these cases, code analysis may fall back on other clues to determine the range an array index expression may fall into.
+
+For example, consider the following function that uses `rand()` in index calculations as a stand-in for a function call that code analysis can't analyze:
+
+```cpp
+#include <stdlib.h>
+
+void f()
+{
+    int* buff = new int[14];
+    for (int i = 1; i < 14; i++)
+    {
+        buff[rand()] = 0;       // no warning, nothing is known about the return value of rand()
+        buff[rand() % 15] = 0;  // warning C6200, rand() % 15 is known to be in the range 0..14 and index 14 is out of bounds
+        buff[rand() % 14] = 0;  // no warning, rand() % 14 is known to be in the range 0..13
+    }
+    delete[] buff;
+}
+```
+
+Code analysis doesn't warn with just `rand()` because it doesn't have any information about its return value. On the other hand, `rand() % 15` and `rand() % 14` provide hints as to the range of the return value of `rand()` and code analysis can use that information to determine that the index is out of bounds in the first case but not the second.