...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char *get_filled_buffer(void) {
char temp[32];
char *ret = NULL;
char *endsize_t full_length = ret0;
while (fgets(temp, sizeof(temp), stdin)) {
size_t len = strlen(temp);
constif size_t(SIZE_MAX - len - 1 < full_sizelength) {
= end - ret + lenbreak;
}
char *r_temp = realloc(ret, full_sizelength + len + 1); /* NTBS */
if (r_temp == NULL) {
break;
}
ret = r_temp;
strcatstrcpy(ret + full_length, temp);
/* concatenate */
end = retfull_length += full_sizelen;
if (feof(stdin) || temp[len-1] == '\n') {
return ret;
}
}
free(ret);
return NULL;
} |
...
Incorrectly assuming a newline character is read by fgets() or fgetws() can result in data truncation.
Recommendation | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level | |
|---|---|---|---|
FIO20-C | Medium | Likely | No |
Yes | P12 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Helix QAC |
| C3591 | |||||||
| LDRA tool suite |
| 44 S | Enhanced enforcement |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Bibliography
...
...