title: input validation with std::ifstream
body: <p>I'm reading a file using something like:</p>
  
  <pre><code>    std::ifstream is( file_name );
      std::string s;
  
      if( !is.good() ) {
          std::cout &lt;&lt; "error opening file: " &lt;&lt; file_name &lt;&lt; std::endl;
      } else {
          while( !is.eof() ) {
              s.clear();
              is &gt;&gt; s;
              if (s.empty())  continue;
              if (s.size() &lt; 1 || s.size()&gt;0x7FFFFFFF ) {
                 std::cout &lt;&lt; "implausible data" &lt;&lt; std::endl;
                 continue;
              }
              char *ss = new char[ s.size() + 1 ]; // COVERITY bails out
              // do something with the data
              delete[]ss;
          }
      }
  </code></pre>
  
  <p>When I analyse the above code with the static code analysis tool <a href="http://coverity.com/" rel="nofollow">coverity</a> (free version), the line marked with <em>COVERITY bails out</em> throws an error:</p>
  
  <pre><code> Untrusted value as argument (TAINTED_SCALAR)
     tainted_data: Passing tainted variable &gt; s.size() + 1UL to a tainted sink.
  </code></pre>
  
  <p>I understand that I must not trust any data read from a file, but I fail to see how to validate the data at this stage.
  I'm already checking that <code>s.size()</code> is within a plausible (albeit rather large) range in the <code>if</code>-clause above the erroneous line.</p>
  
  <p>So why is coverity throwing a warning at me?</p>
  
  <p>Also, which other strategies for input-validation should I apply?</p>