mirror of
https://github.com/github/codeql.git
synced 2025-12-26 13:46:31 +01:00
52 lines
2.1 KiB
XML
52 lines
2.1 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
|
|
|
|
<overview>
|
|
<p>
|
|
This query finds calls of <tt>scanf</tt>-like functions with missing or
|
|
improper return-value checking.
|
|
</p>
|
|
<p>
|
|
Specifically, the query flags uses of variables that may have been modified by
|
|
<tt>scanf</tt> and subsequently are used without being guarded by a correct
|
|
return-value check. A proper check is one that ensures that the corresponding
|
|
<tt>scanf</tt> has returned (at least) a certain minimum constant.
|
|
</p>
|
|
<p>
|
|
Functions in the <tt>scanf</tt> family return either EOF (a negative value)
|
|
in case of IO failure, or the number of items successfully read from the
|
|
input. Consequently, a simple check that the return value is truthy (nonzero)
|
|
is not enough.
|
|
</p>
|
|
<warning>
|
|
This query has medium precision because, in the current implementation, it
|
|
takes a strict stance on unguarded uses of output variables, and flags them
|
|
as problematic even if they have already been initialized.
|
|
</warning>
|
|
</overview>
|
|
|
|
<recommendation>
|
|
<p>
|
|
Ensure that all subsequent uses of <tt>scanf</tt> output arguments occur in a
|
|
branch of an <tt>if</tt> statement (or similar), in which it is known that the
|
|
corresponding <tt>scanf</tt> call has in fact read all possible items from its
|
|
input. This can be done by comparing the return value to a numerical constant.
|
|
</p>
|
|
</recommendation>
|
|
|
|
<example>
|
|
<p>This example shows different ways of guarding a <tt>scanf</tt> output:
|
|
</p>
|
|
<sample src="MissingCheckScanf.cpp" />
|
|
</example>
|
|
|
|
<references>
|
|
<li>SEI CERT C++ Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/cplusplus/ERR62-CPP.+Detect+errors+when+converting+a+string+to+a+number">ERR62-CPP. Detect errors when converting a string to a number</a>.</li>
|
|
<li>SEI CERT C Coding Standard: <a href="https://wiki.sei.cmu.edu/confluence/display/c/ERR33-C.+Detect+and+handle+standard+library+errors">ERR33-C. Detect and handle standard library errors</a>.</li>
|
|
<li>cppreference.com: <a href="https://en.cppreference.com/w/c/io/fscanf">scanf, fscanf, sscanf, scanf_s, fscanf_s, sscanf_s</a>.</li>
|
|
</references>
|
|
</qhelp>
|