Example 62 Enabling compile time diagnostic messages for potential security vulnerabilities
#include <stdio.h> #include <stdlib.h> char* get_path()
{
return getenv("BLAHBLAH");
}
int main()
{
char* path = get_path(); // line 11
FILE* my_pipe = popen(path, "r"); // line 13 printf ("%p\n", my_pipe);
}
In this case, cadvise generates the following error:
"popen.c", line 13, procedure main: warning
++tainted value is returned from 'get_path' called by 'main' at line 11 in file popen.c
For example, see the unsafe loop exit condition in the following code and the warning generated.
int a[100]; int loop(int i)
{
for (int j = 0 ; j < i; j++) // line 5 a[j] = 0;
return a[0];
}
int main()
{
int i;
fread(&i, 1,4,stdin); loop(i);
}
In this case, cadvise generates the following error:
"loop1.c", line 5, procedure loop: warning
++'loop' is called by 'main' at line 14 in file loop1.c
++++ Tainted value is obtained from 'main'
8.6Detecting multi-threaded programming issues
The +wlock option detects
The problems detected include acquiring an already acquired lock, releasing an already released lock and unconditionally releasing a lock which has been conditionally acquired. For example, cadvise detects a potential locking error in the following code:
8.6 Detecting