BSTR.OPS.COMP
Incorrect comparison operation with BSTR values
The BSTR.OPS.COMP checker finds instances of comparisons with BSTR entities. Comparison operations can't be used on BSTR values, as they are meaningless in the BSTR context and can cause incorrect memory usage if they're not corrected.
Vulnerability and risk
Because the two styles are constructed differently, converting COM-style BSTR strings to and from C-style strings needs care. In some cases, conversions between the two compile well, but still produce unexpected results.
Mitigation and prevention
Unlike C-style strings, BSTR strings have a 4-byte length prefix that contains the number of bytes in the following data string. BSTR strings can also contain embedded null characters, and aren't strongly typed. For these reasons, it's best not to use BSTR in new designs.
Vulnerable code example
void bstr_comp() {
BSTR foo, bar;
if (foo < bar)
bar = NULL;
}Klocwork flags line 3 in which a comparison operation is attempted on a BSTR value.