Use of dangerous standard function

Dangerous functions cause possible buffer overflow in destination buffer

Description

This issue occurs when your code uses standard functions that write data to a buffer in a way that can result in buffer overflows.

The following table lists dangerous standard functions, the risks of using each function, and what function to use instead. The checker flags:

• Any use of an inherently dangerous function.

• An use of a possibly dangerous function only if the size of the buffer to which data is written can be determined at compile time. The checker does not flag an use of such a function with a dynamically allocated buffer.

Dangerous Function	Risk Level	Safer Function
gets	Inherently dangerous — You cannot control the length of input from the console.	fgets
cin	Inherently dangerous — You cannot control the length of input from the console.	Avoid or prefaces calls to cin with cin.width.
strcpy	Possibly dangerous — If the source length is greater than the destination, buffer overflow can occur.	strncpy
stpcpy	Possibly dangerous — If the source length is greater than the destination, buffer overflow can occur.	stpncpy
lstrcpy or StrCpy	Possibly dangerous — If the source length is greater than the destination, buffer overflow can occur.	StringCbCopy, StringCchCopy, strncpy, strcpy_s, or strlcpy
strcat	Possibly dangerous — If the concatenated result is greater than the destination, buffer overflow can occur.	strncat, strlcat, or strcat_s
lstrcat or StrCat	Possibly dangerous — If the concatenated result is greater than the destination, buffer overflow can occur.	StringCbCat, StringCchCat, strncay, strcat_s, or strlcat
wcpcpy	Possibly dangerous — If the source length is greater than the destination, buffer overflow can occur.	wcpncpy
wcscat	Possibly dangerous — If the concatenated result is greater than the destination, buffer overflow can occur.	wcsncat, wcslcat, or wcncat_s
wcscpy	Possibly dangerous — If the source length is greater than the destination, buffer overflow can occur.	wcsncpy
sprintf	Possibly dangerous — If the output length depends on unknown lengths or values, buffer overflow can occur.	snprintf
vsprintf	Possibly dangerous — If the output length depends on unknown lengths or values, buffer overflow can occur.	vsnprintf

Risk

These functions can cause buffer overflow, which attackers can use to infiltrate your program.

Fix

The fix depends on the root cause of the defect. Often the result details show a sequence of events that led to the defect. You can implement the fix on any event in the sequence. If the result details do not show the event history, you can trace back using right-click options in the source code and see previous related events. See also Interpret Bug Finder Results in Polyspace Desktop User Interface.

See examples of fixes below.

If you do not want to fix the issue, add comments to your result or code to avoid another review. See Address Polyspace Results Through Bug Fixes or Justifications.

Examples

Using sprintf

#include <stdio.h>
#include <string.h>
#include <iostream>

#define BUFF_SIZE 128


int dangerous_func(char *str)
{
    char dst[BUFF_SIZE];
    int r = 0;

    if (sprintf(dst, "%s", str) == 1)
    {
        r += 1;
        dst[BUFF_SIZE-1] = '\0';
    }
    
    return r;
}

This example function uses sprintf to copy the string str to dst. However, if str is larger than the buffer, sprintf can cause buffer overflow.

Correction — Use snprintf with Buffer Size

One possible correction is to use snprintf instead and specify a buffer size.

#include <stdio.h>
#include <string.h>
#include <iostream>

#define BUFF_SIZE 128


int dangerous_func(char *str)
{
    char dst[BUFF_SIZE];
    int r = 0;

    if (snprintf(dst, sizeof(dst), "%s", str) == 1)
    {
        r += 1;
        dst[BUFF_SIZE-1] = '\0';
    }
    
    return r;
}

Result Information

Group: Security

Language: C | C++

Default: Off

Command-Line Syntax: DANGEROUS_STD_FUNC

Impact: Low

CWE ID: 242, 676