[cfe-commits] [Patch] Checker for assignment of non-Boolean value to Boolean variable

[Ryan Govostes]

On Dec 8, 2011, at 7:23 AM, Ted Kremenek wrote:

> (3) It's worth indicating in the diagnostic that this is a security problem.  E.g:
> 
>  Assignment of a non-boolean value to a variable of type 'Boolean' (potentially insecure)
> 
> As a further refinement, including the CERT advisory # might be scary enough for some people to take the warning more seriously.


On Dec 8, 2011, at 8:13 AM, David Blaikie wrote:

> Indeed, to be honest at first blush I wasn't sure of the point of this
> diagnostic. MSVC likes to warn about 'performance' issues when
> implicitly converting from int->bool & that usually just annoys me (
> http://msdn.microsoft.com/en-us/library/b6801kcy.aspx ) rather than
> providing anything terribly useful.
> 
> What's the actual security issue at stake here?

The checker was originally developed with security in mind, but I tend to think now that it primarily useful for code cleanliness to preserve the semantics of Boolean data types, which helps prevent subsequent logic errors that may lead to a security exposure.

There may be a CWE number that covers this issue, but then you could probably add a CWE to virtually any diagnostic.

Ryan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20111208/6a572dd2/attachment.html>