mirror of
https://github.com/github/codeql.git
synced 2026-04-29 18:55:14 +02:00
C++: Add another pattern I found in the wild.
This commit is contained in:
@@ -5,3 +5,5 @@
|
||||
| test.cpp:443:11:443:15 | call to scanf | The result of scanf is only checked against 0, but it can also return EOF. |
|
||||
| test.cpp:501:13:501:17 | call to scanf | The result of scanf is only checked against 0, but it can also return EOF. |
|
||||
| test.cpp:512:13:512:17 | call to scanf | The result of scanf is only checked against 0, but it can also return EOF. |
|
||||
| test.cpp:525:10:525:15 | call to sscanf | The result of scanf is only checked against 0, but it can also return EOF. |
|
||||
| test.cpp:541:10:541:15 | call to sscanf | The result of scanf is only checked against 0, but it can also return EOF. |
|
||||
|
||||
@@ -518,3 +518,38 @@ void multiple_checks() {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void switch_cases(const char *data) {
|
||||
float a, b, c;
|
||||
|
||||
switch (sscanf(data, "%f %f %f", &a, &b, &c)) { // [FALSE POSITIVE]
|
||||
case 2:
|
||||
use(a); // GOOD
|
||||
use(b); // GOOD
|
||||
break;
|
||||
case 3:
|
||||
use(a); // GOOD
|
||||
use(b); // GOOD
|
||||
use(c); // GOOD
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
float d, e, f;
|
||||
|
||||
switch (sscanf(data, "%f %f %f", &d, &e, &f)) { // [REPORTED HERE]
|
||||
case 2:
|
||||
use(d); // GOOD
|
||||
use(e); // GOOD
|
||||
use(f); // BAD
|
||||
break;
|
||||
case 3:
|
||||
use(d); // GOOD
|
||||
use(e); // GOOD
|
||||
use(f); // GOOD
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user