Files
codeql/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.c
2018-08-02 17:53:23 +01:00

19 lines
348 B
C

int main(int argc, char** argv) {
char buffer[20];
fgets(buffer, 20, stdin);
int num = atoi(buffer);
// BAD: may overflow if input is very large
int scaled = num + 1000;
// ...
int num2 = atoi(buffer);
int scaled2;
// GOOD: use a guard to prevent overflow
if (num2 < INT_MAX-1000)
scaled2 = num2 + 1000;
else
scaled2 = INT_MAX;
}