...
In this noncompliant example, the the tainted integer color_index is used in pointer arithmetic to index into the array table.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
const char *table[] = { "black", "white", "blue", "green" };
const char *set_background_color(void) {
int color_index;
GET_TAINTED_INTEGER(int, color_index);
const char *color = table[color_index]; /* violation */
/* ... */
return color;
} |
...
This compliant solution defines the acceptable range for color_index as [1, MAX_COLOR_INDEX]. :
| Code Block | ||||
|---|---|---|---|---|
| ||||
enum { MAX_COLOR_INDEX = 3 };
const char *table[] = { "black", "white", "blue", "green" };
const char *set_background_color(void) {
int color_index;
GET_TAINTED_INTEGER(int, color_index);
if (color_index < 0 || colo_index > MAX_COLOR_INDEX)
return NULL; /* indicate error to caller */
const char *color = table[color_index];
/* ... */
return color;
} |
...