UNINIT.STACK.MIGHT.UNCLEAR
Uninitialized variable use under an unresolved condition
The UNINIT.STACK.MIGHT.UNCLEAR checker finds cases in which a local variable of a non-class type may be passed to a function that reads it only when a condition holds and Klocwork can neither prove nor disprove that condition. To report this checker, set the KW_RW_CONDITIONAL environment variable to a value other than 0. This checker is disabled by default.
Vulnerability and risk
In C++, stack variables aren't initialized by default. They generally contain random junk data from the current content of stack memory. When a function reads that value only under a condition that can't be resolved at the call site, the resulting behavior can still be unpredictable and may have security implications.
Mitigation and prevention
Make sure variables are initialized before any function call that might read them. If you enable conditional R/W knowledge base support with KW_RW_CONDITIONAL, expect slower analysis times on some projects.
Vulnerable code example
extern int get_id(void);
struct copy {
int id;
int len;
};
void set(struct copy *arg) {
if (arg->id != 0) {
int my_len = arg->len;
(void)my_len;
}
}
int main() {
struct copy var;
var.id = get_id();
set(&var);
return 0;
}Klocwork flags line 18, indicating that the call to set may read the uninitialized variable var.len when the condition inside set cannot be resolved.