walkero
/
flawfinder
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Add rules to detect g_*rand* functions 

Thanks to Michael McConville for this suggestion!

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
This commit is contained in:
David A. Wheeler 2017-07-29 16:35:06 -04:00
parent 6f399a0a25
commit 02029816d4
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
correct-results.html
View File

@ -11,7 +11,7 @@
Here are the security scan results from
<a href="http://www.dwheeler.com/flawfinder">Flawfinder version 2.0.0</a>,
(C) 2001-2017 <a href="http://www.dwheeler.com">David A. Wheeler</a>.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 209
Number of rules (primarily dangerous function names) in C/C++ ruleset: 219
<p>
Examining test.c <br>
Examining test2.c <br>

2
correct-results.txt
View File

@ -1,5 +1,5 @@
Flawfinder version 2.0.0, (C) 2001-2017 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 209
Number of rules (primarily dangerous function names) in C/C++ ruleset: 219
Examining test.c
Examining test2.c

4
flawfinder
View File

@ -1084,10 +1084,10 @@ c_ruleset = {
"integer", "dangers-c", {}),
# Random values. Don't trigger on "initstate", it's too common a term.
"drand48|erand48|jrand48|lcong48|lrand48|mrand48|nrand48|random|seed48|setstate|srand|strfry|srandom":
"drand48|erand48|jrand48|lcong48|lrand48|mrand48|nrand48|random|seed48|setstate|srand|strfry|srandom|g_rand_boolean|g_rand_int|g_rand_int_range|g_rand_double|g_rand_double_range|g_random_boolean|g_random_int|g_random_int_range|g_random_double|g_random_double_range":
(normal, 3,
"This function is not sufficiently random for security-related functions such as key and nonce creation (CWE-327)",
"use a more secure technique for acquiring random values",
"Use a more secure technique for acquiring random values",
"random", "", {}),
"crypt":