Daniel Krupp 289725f11c [analyzer] New optin.taint.TaintedAlloc checker for catching unbounded memory allocation calls (#92420) ...

A new optional checker (optin.taint.TaintedAlloc) will warn if a memory
allocation function (malloc, calloc, realloc, alloca, operator new[]) is
called with a tainted (attacker controlled) size parameter.
A large, maliciously set size value can trigger memory exhaustion. To
get this warning, the alpha.security.taint.TaintPropagation checker also
needs to be switched on.

The warning will only be emitted, if the analyzer cannot prove that the
size is below reasonable bounds (<SIZE_MAX/4).

2024-06-05 16:33:31 +02:00

6.3 KiB

Raw Blame History

View Raw