...
This noncompliant code example reads data from a file stream into a data structure.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
struct myData {
char c;
long l;
};
/* ... */
FILE *file;
struct myData data;
/* Initialize file */
if (fread(&data, sizeof(struct myData), 1, file) < sizeof(struct myData)) {
/* Handle error */
}
|
...
The best solution is to use either a text representation or a special library that ensures data integrity.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
struct myData {
char c;
long l;
};
/* ... */
FILE *file;
struct myData data;
char buf[25];
char *end_ptr;
/* Initialize file */
if (fgets(buf, 1, file) == NULL) {
/* Handle error */
}
data.c = buf[0];
if (fgets(buf, sizeof(buf), file) == NULL) {
/* Handle Error */
}
data.l = strtol(buf, &end_ptr, 10);
if ((ERANGE == errno)
|| (end_ptr == buf)
|| ('\n' != *end_ptr && '\0' != *end_ptr)) {
/* Handle Error */
}
|
...
Tool | Version | Checker | Description |
|---|---|---|---|
Compass/ROSE |
|
| Could flag possible violations of this rule by noting any pointer to |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
...