<!DOCTYPE qhelp PUBLIC
  "-//Semmle//qhelp//EN"
  "qhelp.dtd">
<qhelp>
<overview>
<p>This rule finds calls to functions that are dangerous to
use. Currently, it checks for calls
to <code>gmtime</code>. See <strong>Related rules</strong>
below for rules that identify other dangerous functions.</p>

<p>The <code>gmtime</code> function fills data into a <code>tm</code>
struct in shared memory and then returns a pointer to that struct. If
the function is called from multiple places in the same program, and
especially if it is called from multiple threads in the same program,
then the calls will overwrite each other's data.</p>

</overview>
<recommendation>

<p>It is safer to use <code>gmtime_r</code>.
With <code>gmtime_r</code>, the application code manages allocation of
the <code>tm</code> struct. That way, separate calls to the function
can use their own storage.</p>

</recommendation>
<example>
<p>The following example checks the local time in two ways:</p>
<sample src="PotentiallyDangerousFunction.c" />

<p>The first version uses <code>gmtime</code>, so it is vulnerable to
its data being overwritten by another thread. Even if this code is not
used in a multi-threaded context right now, future changes may
make the program multi-threaded. The second version of the code
uses <code>gmtime_r</code>. Since it allocates a new <code>tm</code>
struct on every call, it is immune to other calls to <code>gmtime</code>
or <code>gmtime_r</code>.</p>

</example>
<section title="Related rules">
<p>Other dangerous functions identified by CWE-676 ("Use of
Potentially Dangerous Function") include <code>strcpy</code>
and <code>strcat</code>. Use of these functions is highlighted by
rules for the following CWEs:</p>
<ul>
<li>CWE-120 Classic Buffer Overflow
</li><li>CWE-131 Incorrect Calculation of Buffer Size
</li></ul>

</section>
<references>


</references>
</qhelp>
