...
| Code Block | ||
|---|---|---|
| ||
void f2() {
float a[4];
const size_t n= sizeof(int) * 4ARR_SIZE;
void *p = a;
memset(p, 0, n);
/* More program code */
}
|
...
| Code Block | ||
|---|---|---|
| ||
void f2() {
float a[4];
const size_t n= sizeof(float) * 4ARR_SIZE;
void *p = a;
memset(p, 0, n);
/* More program code */
}
|
...
Note: A possibility of this code being safe would be on architectures where sizeof (*int) is equal to sizeof (*float).
Compliant Solution // (need to work on this)
...
| Code Block | ||
|---|---|---|
| ||
wchar_t *f7() {
const wchar_t *p = L"Hello, World!";
const size_t n = sizeof(wchar_t) * (wcslen(p) + 1);
wchar_t *q = (wchar_t *)malloc(n);
return q;
}
|
Given below is a non-exhaustive list of library functions that can be vulnerable:
Risk Assessment
Depending on the library function called, the attacker may be able to use a heap overflow vulnerability to run arbitrary code. The detection of checks specified in description can be automated but the remediation has to be manual.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ARR38-C | high | likely | medium | P18 | L1 |
Related Guidelines
WG14 Document: N1579 - Rule 5.34 Forming Invalid pointers by library functions.
...