| 482 | } |
| 483 | |
| 484 | void CheckIOImpl::invalidScanfError(const Token *tok) |
| 485 | { |
| 486 | const std::string fname = (tok ? tok->str() : std::string("scanf")); |
| 487 | reportError(tok, Severity::warning, |
| 488 | "invalidscanf", fname + "() without field width limits can crash with huge input data.\n" + |
| 489 | fname + "() without field width limits can crash with huge input data. Add a field width " |
| 490 | "specifier to fix this problem.\n" |
| 491 | "\n" |
| 492 | "Sample program that can crash:\n" |
| 493 | "\n" |
| 494 | "#include <stdio.h>\n" |
| 495 | "int main()\n" |
| 496 | "{\n" |
| 497 | " char c[5];\n" |
| 498 | " scanf(\"%s\", c);\n" |
| 499 | " return 0;\n" |
| 500 | "}\n" |
| 501 | "\n" |
| 502 | "Typing in 5 or more characters may make the program crash. The correct usage " |
| 503 | "here is 'scanf(\"%4s\", c);', as the maximum field width does not include the " |
| 504 | "terminating null byte.\n" |
| 505 | "Source: http://linux.die.net/man/3/scanf\n" |
| 506 | "Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c", |
| 507 | CWE119, Certainty::normal); |
| 508 | } |
| 509 | |
| 510 | //--------------------------------------------------------------------------- |
| 511 | // printf("%u", "xyz"); // Wrong argument type |
no test coverage detected