diff --git a/correct-results.html b/correct-results.html index 3a29193..d29886c 100644 --- a/correct-results.html +++ b/correct-results.html @@ -11,7 +11,7 @@ Here are the security scan results from Flawfinder version 1.27, (C) 2001-2004 David A. Wheeler. -Number of dangerous functions in C/C++ ruleset: 158 +Number of dangerous functions in C/C++ ruleset: 160

Examining test.c
Examining test2.c
diff --git a/correct-results.txt b/correct-results.txt index da348ee..a596e28 100644 --- a/correct-results.txt +++ b/correct-results.txt @@ -1,5 +1,5 @@ Flawfinder version 1.27, (C) 2001-2004 David A. Wheeler. -Number of dangerous functions in C/C++ ruleset: 158 +Number of dangerous functions in C/C++ ruleset: 160 Examining test.c Examining test2.c test.c:32: [5] (buffer) gets: diff --git a/flawfinder b/flawfinder index 75a9c38..f0ba461 100755 --- a/flawfinder +++ b/flawfinder @@ -971,6 +971,14 @@ c_ruleset = { "or embedded spaces could allow an attacker to force a different program to run", "shell", "", {'check_for_null' : 1}), + "atoi|atol": + (normal, 2, + "Unless checked, the resulting number can exceed the expected range", + " If source untrusted, check both minimum and maximum, even if the" + + " input had no minus sign (large numbers can roll over into negative" + + " number; consider saving to an unsigned value if that is intended)", + "integer", "dangers-c", {}), + # Random values. Don't trigger on "initstate", it's too common a term. "drand48|erand48|jrand48|lcong48|lrand48|mrand48|nrand48|random|seed48|setstate|srand|strfry|srandom": (normal, 3,