[cfe-commits] r128679 - in /cfe/trunk: lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp test/Analysis/security-synta
pageexec at freemail.hu
pageexec at freemail.hu
Fri Apr 1 02:16:36 PDT 2011
On 31 Mar 2011 at 22:09, Lenny Maiorani wrote:
> //===----------------------------------------------------------------------===//
> +// Check: Any use of 'strcpy' is insecure.
> +//
> +// CWE-119: Improper Restriction of Operations within
> +// the Bounds of a Memory Buffer
> +//===----------------------------------------------------------------------===//
i don't think this strategy is correct.
first, there are many valid uses of strcpy and similar functions without an explicit
bounds check so the 'any use' is wrong. as a consequence, this code, as it is, is not
much different from a 'grep strcpy -rn .', i.e., not very useful for clang.
second, as the CWE notes it itself, replacing strcpy with bounds checking versions is
not without its problems, and i don't see you checking those issues, i.e., this code
is quite incomplete.
IMHO, a useful implementation of this kind of checking would be what the CWE description
suggests as well: data flow analysis so that valid uses of strcpy et al. are not reported
as false positives.
cheers,
PaX Team
More information about the cfe-commits
mailing list