...
| Code Block | ||||
|---|---|---|---|---|
| ||||
char* name; /* initialized externally */ char filename[128]; sprintf(filename, "%s.txt", name); /* openOpen filename * / |
However, because the sprintf() function makes no guarantees regarding the length of the string generated, a sufficiently long string in name could generate a buffer overflow.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
char* name; /* initialized externally */ char filename[128]; sprintf(filename, "%.123s.txt", name); /* openOpen filename * / |
Compliant Solution (snprintf())
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
char* name; /* initialized externally */ char filename[128]; snprintf(filename, sizeof(filename), "%s.txt", name); /* openOpen filename * / |
Risk Assessment
...
Tool | Version | Checker | Description | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE |
|
| Can detect violations of the rule. However, it is unable to handle cases involving | ||||||||||||||
| Coverity | 6.5 | STRING_OVERFLOW STRING_SIZE | Fully Implemented. Fully implemented. | ||||||||||||||
Fortify SCA | 5.0 |
|
| ||||||||||||||
|
|
| |||||||||||||||
|
|
|
|
|
| ||||||||||||
Splint |
|
|
|
...
| [Dowd 2006] | Chapter 7, "Program Building Blocks" ("Loop Constructs," pp. 327–336) |
| [Seacord 2005a2013] | Chapter 2, "Strings" |
| [xorl 2009] | FreeBSD-SA-09:11: NTPd Remote Stack Based Buffer Overflows |
...