...
Code Block | ||||
---|---|---|---|---|
| ||||
char *copy(size_t n, const char *c_str) { int i; char *p; if (n == 0) { /* Handle unreasonable object size error */ } p = (char *)malloc(n); if (p == NULL) { return NULL; /* Indicate malloc failure */ } for ( i = 0; i < n; ++i ) { p[i] = *c_str++; } return p; } /* ... */ char c_str[] = "hi there"; char *p = copy(sizeof(c_str), c_str); |
Signed integer overflow causes undefined behavior. The following are two possible conditions under which this code constitutes a serious vulnerability:
...
Code Block | ||||
---|---|---|---|---|
| ||||
char *copy(rsize_t n, const char *c_str) { rsize_t i; char *p; if (n == 0 || n > RSIZE_MAX) { /* Handle unreasonable object size error */ } p = (char *)malloc(n); if (p == NULL) { return NULL; /* Indicate malloc failure */ } for (i = 0; i < n; ++i) { p[i] = *c_str++; } return p; } /* ... */ char c_str[] = "hi there"; char *p = copy(sizeof(c_str), c_str); |
Noncompliant Code Example
...