SV.TAINTED.FMTSTRUnvalidated input - untrusted data is used as a format string. Vulnerability and riskMitigation and preventionExample 1
1 #define TKS_MAXBUFFER 1024
2 int check_tklines(char *host, char *user, int lifetime) {
3 FILE *iconf, *iconf_tmp;
4 //...
5 if ((iconf = fopen(CPATH, "r")) && (iconf_tmp = fopen(TKSERV_IRCD_CONFIG_TMP, "w"))){
6
7 char buffer[TKS_MAXBUFFER];
8 while (fgets(buffer, TKS_MAXBUFFER, iconf)){
9 if ((*buffer != 'K') || (!strstr(buffer, "tkserv"))){
10 fprintf(iconf_tmp, buffer);
11 }
12 //...
13
14 }
15 }
16 return 0;
17 }
Klocwork produces an issue report at line 10 indicating that unvalidated string 'buffer' received through a call to 'fgets' at line 8 can be used as a format string through a call to 'fprintf' at line 10. Security Guidelines |