SV.FMT_STR.BAD_SCAN_FORMATMissing width field for format stringImproper string-length checking can result in a buffer overflow situation that can be exploited by a malicious user. The SV.FMT_STR.BAD_SCAN_FORMAT checker finds instances of omitted width specification (%s) in a format string. Vulnerability and riskSeveral string-width checking issues can result in an exploitable vulnerability. The most common are when a wide or multi-byte character string is incorrectly calculated as single-byte characters, or in a case of mixed standard-width and wide-string functions for a single string. In either case, an exploitable buffer overflow condition can arise. Mitigation and preventionTo avoid this type of error:
Vulnerable code example
1 void main() {
2 char s[16];
3 scanf("%s",s);
4 }
Klockwork flags an error at line 3 because the width of the string is missing from the %s specification. Any situation in which the width field for the string is missing can result in a buffer overflow condition that can be exploited by a malicious user. Fixed code example
1 void main() {
2 char s[16];
3 scanf("%15s",s);
4 }
In the fixed code, width of the string is provided correctly, ensuring that the destination buffer won't overflow. Related checkersExternal guidance
|