SV.TAINTED.GLOBAL

Use of Unvalidated Integer in an Assignment Operation

This checker reports a defect whenever tainted data is used to assign a global variable.

Vulnerability and risk

Global variables are visible in the entire program scope. It can be difficult for a programmer or an analysis tool to fully control their assignments or reads in the program. The possibility of a reduced understanding of the global variable effect on the program control flow can introduce a security risk when integer data input to the code is not validated properly and is used to assign a global variable.

Vulnerable code example

Copy 
   #define MAX  10
   int gVar = 0;
   int getTaintedData()
   {
       int i;
       scanf(“%d” , &i);
       return i;
   }
   void foo() 
  {
      int t = getTaintedData();
      gVar = t;    
  }

In the above example, an attacker can provide an arbitrary value for global variable 'gVar' that can later be potentially used elsewhere in code that the programmer has no control or is not even aware of. This potentially introduces the risk of a security vulnerability involving that variable.

Klockwork reports a SV.TAINTED.GLOBAL defect at line 12, indicating: "Unvalidated integer value 't' that is received from 'getTaintedData' at line 11 is used to initialize a global variable at line 12."

Fixed code example

Copy 
   #define MAX  10
   int gVar = 0;
   int getTaintedData()
   {
      int i;
      scanf(“%d” , &i);
      return i;
   }
   void foo() 
  {
     int t = getTaintedData();
     if( t < MAX )
     { 
         // value validated
         gVar = t;   
     }
  }

In this example, Klocwork no longer reports a defect because the integer value 't' is validated.

Related checkers