Escape sequence runs into the following characters
ID |
c.maintainability.malformed_escape_sequence |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Literal Format |
Language |
C / C++ |
Description
This escape sequence absorbs the characters that follow it. A hexadecimal escape has no length limit, and an octal escape takes up to three digits, so the text meant to come after the escape is swallowed into it and the literal holds a different character than it appears to. Terminate the escape by splitting the literal — write "\x41" "f" rather than "\x41f".
Rationale
This escape sequence absorbs the characters that follow it. A hexadecimal escape has no length limit, and an octal escape takes up to three digits, so the text meant to come after the escape is swallowed into it and the literal holds a different character than it appears to. Terminate the escape by splitting the literal — write "\x41" "f" rather than "\x41f".
The following code illustrates the pattern detected by this rule:
void print_all(void)
{
// FLAGGED: Escape sequence runs into the following characters
const char *hex_run_on = "value\x41f more";
// FLAGGED: Escape sequence runs into the following characters
const char *octal_run_on = "value\1234 more";
const char *hex_terminated = "value\x41" "f more";
const char *octal_ok = "value\101 more";
const char *plain = "value\n";
printf("%s%s%s%s%s\n", hex_run_on, octal_run_on, hex_terminated, octal_ok, plain);
}