
...
Code Block |
---|
typedef char True; typedef struct { char a[2]; } False; template <typename T><typename T> True isPtr(T *); False isPtr(...); #define is_ptr(e) (sizeof(isPtr(e)) == sizeof(True)) |
...
Code Block | ||
---|---|---|
| ||
#include <cstdarg><cstdarg> char *concatenate(char const *s, ...) { // code to actually concatenate the strings } char *separator = /* some reasonable value */; char *t = concatenate("hello""hello", separator, "world""world", NULL); |
Calling this function without the trailing null pointer, or with an argument of any type other than "pointer to possibly-CV-qualified char" yields undefined behavior:
Code Block | ||
---|---|---|
| ||
char *u = concatenate("hello""hello", separator, "world""world"); // undefined behavior char *v = concatenate("hello""hello", ' ', "world""world", NULL); // undefined behavior |
...
Code Block | ||
---|---|---|
| ||
#include <string><string> string separator = /* some reasonable value */; string s = "hello""hello" + separator + "world""world"; |
Risk Assessment
Incorrectly using a variadic function can result in abnormal program termination, unintended information disclosure, or execution of arbitrary code.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
DCL33-C | 3 (high) | 2 (probable) | 3 (low) | P18 | L1 |
...
DCL32-C. Avoid runtime static initialization of objects with external linkage 02. Declarations and Initialization (DCL) 03. Expressions (EXP)