[cfe-commits] r128679 - in /cfe/trunk: lib/StaticAnalyzer/Checkers/CheckSecuritySyntaxOnly.cpp test/Analysis/security-synta

[pageexec at freemail.hu]

On 31 Mar 2011 at 22:09, Lenny Maiorani wrote:

>  //===----------------------------------------------------------------------===//
> +// Check: Any use of 'strcpy' is insecure.
> +//
> +// CWE-119: Improper Restriction of Operations within 
> +// the Bounds of a Memory Buffer 
> +//===----------------------------------------------------------------------===//

i don't think this strategy is correct.

first, there are many valid uses of strcpy and similar functions without an explicit
bounds check so the 'any use' is wrong. as a consequence, this code, as it is, is not
much different from a 'grep strcpy -rn .', i.e., not very useful for clang.

second, as the CWE notes it itself, replacing strcpy with bounds checking versions is
not without its problems, and i don't see you checking those issues, i.e., this code
is quite incomplete.

IMHO, a useful implementation of this kind of checking would be what the CWE description
suggests as well: data flow analysis so that valid uses of strcpy et al. are not reported
as false positives.

cheers,

 PaX Team