example2.c

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name example2.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model static -mthread-model posix -mdisable-fp-elim -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -resource-dir /opt/qses/clang9/lib/clang/9.0.0 -internal-isystem /usr/local/include -internal-isystem /opt/qses/clang9/lib/clang/9.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-deprecated-declarations -std=c99 -fdebug-compilation-dir /home/qsesdcc_gmail_com/lab4code -ferror-limit 19 -fmessage-length 0 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-checker security -analyzer-checker security.insecureAPI.gets -analyzer-output=html -faddrsig -o /home/qsesdcc_gmail_com/lab4code/static_analysis/2019-11-07-110128-1986-1 -x c example2.c

File:	example2.c
Warning:	line 14, column 5 Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119

1
2	#include <stdio.h>
3	#include <string.h>
4	#include <stdlib.h>
5
6	int main(int argc, char** argv) {
7	--argc; ++argv;
8
9	// Buffer for name (capacity: 9 chars + '\0' terminator)
10	// In this example we use heap-allocated memory.
11	char* name = (char*) malloc(10);
12
13	if (argc != 0) {
14	strcpy(name, argv[0]);
	Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119
15	} else {
16	gets(name);
17	}
18	// Format string vulnerability
19	printf(name);
20	printf(", you are welcome!\n");
21	return 0;
22	}
23
24

Bug Summary

Annotated Source Code