...
Code Block |
---|
int do_auth(void) {
char username[MAX_USER], password[MAX_PASS];
puts("Please enter your username: ");
fgets(username, MAX_USER, stdin);
puts("Please enter your password: ");
fgets(password, MAX_PASS, stdin);
if (!strcmp(username, "user") && !strcmp(password, "password")) {
return 0;
}
return -1;
}
void log_error(int farray, char *msg) {
char *err, *mesg;
char buffer[24];
sprintf(buffer, "Error: %s", mesg);
printf("%s\n", buffer);
}
int main(void) {
if (do_auth() == -1) {
log_error(ERR_CRITIC | ERR_AUTH, "Unable to login");
}
return 0;
}
|
...
Component | Value |
---|---|
Severity | 1 (low) |
Likelihood | 1 (unlikely) |
Remediation cost | 2 (high) |
References
- Exploiting Uninitialized data. mercy. January, 2006. http://www.felinemenace.org/papers/UBehavior.zip
- ISO/IEC 9899-1999 Section 6.7.8 Initialization