mirror of
https://github.com/github/codeql.git
synced 2026-05-30 11:01:24 +02:00
37 lines
1.8 KiB
XML
37 lines
1.8 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
<overview>
|
|
<p>The program uses input from the user, propagated via a global variable, as a format string for <code>printf</code> style functions.
|
|
This can lead to buffer overflows or data representation problems. An attacker can exploit this weakness to crash the program,
|
|
disclose information or even execute arbitrary code.</p>
|
|
|
|
<p>This rule only identifies inputs from the user that are transferred through global variables before being used in <code>printf</code> style functions.
|
|
Analyzing the flow of data through global variables is more prone to errors and so this rule may identify some examples of code where
|
|
the input is not really from the user. For example, when a global variable is set in two places, one that comes from the user and one that does not.
|
|
In this case we would mark all usages of the global variable as input from the user, but the input from the user may always came after the call to the
|
|
<code>printf</code> style functions.</p>
|
|
|
|
<p>The results of this rule should be considered alongside the related rule "Uncontrolled format string" which tracks the flow of the
|
|
values input by a user, excluding global variables, until the values are used as the format argument for a <code>printf</code> like function call.</p>
|
|
|
|
</overview>
|
|
<recommendation>
|
|
<p>Use constant expressions as the format strings. If you need to print a value from the user, use <code>printf("%s", value_from_user)</code>.</p>
|
|
|
|
</recommendation>
|
|
<example>
|
|
<sample src="UncontrolledFormatStringThroughGlobalVar.c" />
|
|
|
|
</example>
|
|
<references>
|
|
|
|
<li>CERT C Coding
|
|
Standard: <a href="https://www.securecoding.cert.org/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings">FIO30-C. Exclude
|
|
user input from format strings</a>.</li>
|
|
|
|
|
|
</references>
|
|
</qhelp>
|