Use of insecure scanf-family functions prone to buffer overflow
ID |
c.buffer_overflow.insecure_api_scanf_etc |
Severity |
critical |
Remediation Complexity |
hard |
Remediation Risk |
high |
Remediation Effort |
medium |
Resource |
Buffer Overflow |
Language |
C / C++ |
Description
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
Rationale
A buffer overflow condition exists when a program attempts to put more data in a buffer than it can hold, or when a program attempts to put data in a memory area outside of the boundaries of a buffer.
The following code illustrates a vulnerable pattern detected by this rule:
void read_string(char *string)
{
char buf[BUFSIZE];
int number;
char fmt[] = "whatever";
// VULNERABLE: Use of insecure scanf-family functions prone to buffer overflow
scanf("%s", buf);
scanf("%d", &number);
// VULNERABLE: Use of insecure scanf-family functions prone to buffer overflow
sscanf(string, "string: %s", buf);
// VULNERABLE: Use of insecure scanf-family functions prone to buffer overflow
scanf(FMT, buf);
// VULNERABLE: Use of insecure scanf-family functions prone to buffer overflow
scanf(fmt, buf);
// VULNERABLE: Use of insecure scanf-family functions prone to buffer overflow
scanf(buf);
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.