...
| Code Block |
|---|
|
...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX || size == 0) {
/* Handle Error */
}
new_secret = malloc(size+1); /* allocate space + NULL Terminator */
if (!new_secret) {
/* Handle Error */
}
strcpy(new_secret, secret);
/* Process new_secret... */
free(new_secret);
...
|
...
| Code Block |
|---|
|
...
char *new_secret;
size_t size = strlen(secret);
if (size == SIZE_MAX || size == 0) {
/* Handle Error */
}
new_secret = malloc(size+1); /* allocate space + NULL Terminator */
if (!new_secret) {
/* Handle Error */
}
strcpy(new_secret, secret);
/* Process new_secret... */
memset(new_secret,'\0',size); /* sanitize memory */
free(new_secret);
...
|
...
Risk Assessment
Refernces
http://vulncat.fortifysoftware.com/2/HI.html
Image Removed
http://samate.nist.gov/docs/SAMATE_source_code_analysis_tool_spec_09_15_06.pdfImage Removed
MEM33-C. Do not assume memory allocation routines initialize memory
