Bug Summary
| File: | example2.c |
| Warning: | line 16, column 5
Call to function 'gets' is extremely insecure as it can always result in a buffer overflow |
Annotated Source Code
Press '?'
to see keyboard shortcuts
clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name example2.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model static -mthread-model posix -mdisable-fp-elim -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -resource-dir /opt/qses/clang9/lib/clang/9.0.0 -internal-isystem /usr/local/include -internal-isystem /opt/qses/clang9/lib/clang/9.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-deprecated-declarations -std=c99 -fdebug-compilation-dir /home/qsesdcc_gmail_com/lab4code -ferror-limit 19 -fmessage-length 0 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-checker security -analyzer-checker security.insecureAPI.gets -analyzer-output=html -faddrsig -o /home/qsesdcc_gmail_com/lab4code/static_analysis/2019-11-07-110128-1986-1 -x c example2.c
| 1 | |
| 2 | #include <stdio.h> |
| 3 | #include <string.h> |
| 4 | #include <stdlib.h> |
| 5 | |
| 6 | int main(int argc, char** argv) { |
| 7 | --argc; ++argv; |
| 8 | |
| 9 | |
| 10 | |
| 11 | char* name = (char*) malloc(10); |
| 12 | |
| 13 | if (argc != 0) { |
| 14 | strcpy(name, argv[0]); |
| 15 | } else { |
| 16 | gets(name); |
| Call to function 'gets' is extremely insecure as it can always result in a buffer overflow |
| 17 | } |
| 18 | |
| 19 | printf(name); |
| 20 | printf(", you are welcome!\n"); |
| 21 | return 0; |
| 22 | } |
| 23 | |
| 24 | |