[jeanne]

hi al,pls help for the following code snippet
main()
{
typedef char abc[20];
abc a;
abc b;
strcpy(a,"HI");
printf("Enter string");
scanf("%s",b);

if(strcmp(a,b)==0)
{ printf("\nSUCCESS");
}
else
{
printf("\nFAILURE");
}
}

is anything wrong in the strmp stmt.,when i run my code for deepcheck,it says"Index from user input, so potential overflow/underflow on variable '(const char *)&b' in the function call 'strcmp' ".

[gpraghuram]

I dont think so that there is a issue with your code.

Raghu

[Banfa]

Please do not double post, please do read the posting guidelines.

Banfa
Administrator

[Banfa]

Originally Posted by jeanne

is anything wrong in the strmp stmt.,when i run my code for deepcheck,it says"Index from user input, so potential overflow/underflow on variable '(const char *)&b' in the function call 'strcmp' ".

You code is syntactically correct and should compile.

However deepcheck goes further than just simple syntax checking (I assume it is a static analysis tool). Your variable b is an array of 20 characters. However you are passing a pointer to that array to scanf for string input. Whether the buffer overflows or not is then dependent on how much data the user inputs, <20 characters and you are fine >= 20 characters and you have a buffer overflow which is undefined behaviour.

This is a rather classic example of the poor programming that has lead to security vulnerabilities and an example of program validity being defined at run time not compile time. That is this flaw in using scanf has been the cause of many security vulnerabilities over the years and the behaviour of the program is either good or undefined depending on what the user does.

Instead of using scanf you could use fgets which allows you to pass the buffer size to the function reading the keyboard and prevents buffer overruns.

[JosAH]

Originally Posted by Banfa

You code is syntactically correct and should compile.

However deepcheck goes further than just simple syntax checking (I assume it is a static analysis tool). Your variable b is an array of 20 characters. However you are passing a pointer to that array to scanf for string input.

What surprises me is that that tool is whining about strcmp instead of scanf.

kind regards,

Jos