On 31 Mar 2011 at 22:09, Lenny Maiorani wrote: > > //===----------------------------------------------------------------------===// > +// Check: Any use of 'strcpy' is insecure. > +// > +// CWE-119: Improper Restriction of Operations within > +// the Bounds of a Memory Buffer > +//===----------------------------------------------------------------------===//
i don't think this strategy is correct. first, there are many valid uses of strcpy and similar functions without an explicit bounds check so the 'any use' is wrong. as a consequence, this code, as it is, is not much different from a 'grep strcpy -rn .', i.e., not very useful for clang. second, as the CWE notes it itself, replacing strcpy with bounds checking versions is not without its problems, and i don't see you checking those issues, i.e., this code is quite incomplete. IMHO, a useful implementation of this kind of checking would be what the CWE description suggests as well: data flow analysis so that valid uses of strcpy et al. are not reported as false positives. cheers, PaX Team _______________________________________________ cfe-commits mailing list [email protected] http://lists.cs.uiuc.edu/mailman/listinfo/cfe-commits
