mirror of
https://github.com/github/codeql.git
synced 2025-12-22 11:46:32 +01:00
CPP: Apply suggestions from code review of incorrect scanf check
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
This commit is contained in:
committed by
GitHub
parent
f3f53570a4
commit
2e92689810
@@ -1,7 +1,7 @@
|
||||
{
|
||||
int i, j;
|
||||
|
||||
// BAD:The result is only checked against zero
|
||||
// BAD: The result is only checked against zero
|
||||
if (scanf("%d %d", &i, &j)) {
|
||||
use(i);
|
||||
use(j);
|
||||
|
||||
@@ -10,11 +10,11 @@ This query finds calls of <tt>scanf</tt>-like functions with
|
||||
improper return-value checking.
|
||||
</p>
|
||||
<p>
|
||||
Specifically, the query flags uses of scanf wehere the reurn value is checked
|
||||
Specifically, the query flags uses of <code>scanf</code> where the return value is checked
|
||||
only against zero.
|
||||
</p>
|
||||
<p>
|
||||
Functions in the <tt>scanf</tt> family return either EOF (a negative value)
|
||||
Functions in the <tt>scanf</tt> family return either <tt>EOF</tt> (a negative value)
|
||||
in case of IO failure, or the number of items successfully read from the
|
||||
input. Consequently, a simple check that the return value is nonzero
|
||||
is not enough.
|
||||
|
||||
Reference in New Issue
Block a user