title: How to improve code around flawfinder memset warning?
body: <p>In my code, all calls to <code>memset</code> appear as warnings with the <a href="https://dwheeler.com/flawfinder/" rel="nofollow noreferrer"><code>flawfinder</code> tool</a>.</p>
  <p>In the simplest case it could boil down to the equivalent to</p>
  <pre><code>    float f1;
      float f2;
      void* p1 = &amp;f1;
      void* p2 = &amp;f2;
      memcpy(p1, p2, sizeof(float));
  </code></pre>
  <p>The message is</p>
  <pre><code>./file.cpp:10:  [2] (buffer) memcpy:
    Does not check for buffer overflows when copying to destination (CWE-120).
    Make sure destination can always hold the source data.
  </code></pre>
  <p>I absolutely understand that this could be replaced by a simple copy, this is just a simplified example.
  I also understand what are the potential problems with using memcpy and buffer overrun.</p>
  <p>The question is <strong>what is exactly flawfinder asking me to do here?</strong></p>
  <p>Perhaps something like adding an <code>assert</code>? (this didn't suppress the warning)</p>
  <pre><code>    assert( sizeof(*p1) == sizeof(*p2) );
      memcpy(p1, p2, sizeof(float));
  </code></pre>
  <p>Or is it just telling me just don't use <code>memset</code>?</p>
  <p>I am programming in C++, but I am pretty sure the question and the solution is common to both C and C++ languages.</p>