# V755\. Copying from potentially tainted data source\. Buffer overflow is possible\.

The analyzer detected that data is copied from a possibly tainted source to the buffer\.

Such sources can be:

* command line arguments whose length is unknown;
* standard library input streams combined with the C strings \(null\-terminated strings\);
* return value of unsafe functions\.

## Unsafe work with command line arguments

Here's an example:

```cpp
int main(int argc, char *argv[])
{
  ....
  const size_t buf_size = 1024;
  char *tmp = (char *) malloc(buf_size);
  ....
  strcpy(tmp, argv[0]);
  ....
}
```

If the copied data size exceeds the buffer size, the buffer overflows\. To avoid this, pre\-calculate the required amount of memory:

```cpp
int main(int argc, char *argv[])
{
  ....
  char buffer[1024];
  errno_t err = strncpy_s(buffer, sizeof(buffer), argv[0], 1024);
  ....
}
```

You can also allocate memory when you need it by using the 'realloc' function\. In C\+\+, you can use all classes, like 'std::string', to work with strings\.

## Unsafe work with input streams

Before C\+\+20, you could use a C string as a receiver buffer for standard input streams \('std::cin', 'std::ifstream'\):

```cpp
void BadRead(char *receiver)
{
  std::cin >> receiver;
}
```

Fortunately, this feature was removed in C\+\+20\. Now you can use the standard library input streams only with arrays of known size\. And there's an implicit limit on a maximum number of characters read\.

```cpp
void Exception2Cpp20()
{
  char *buffer1 = new char[10];
  std::cin >> buffer1;          // Won't compile since C++20

  char buffer2[10];
  std::cin >> buffer2;          // no overflow
                                // max 9 chars will be read
}
```

You can read more about this change \(with examples of use\) in the [P0487R1](https://wg21.link/P0487R1) proposal to the C\+\+20 standard\.

## Unsafe return value

Attackers can manipulate the value returned by some functions\. If you work with those values, be extremely careful:

```cpp
void InsecureDataProcessing()
{
  char oldLocale[50];
  strcpy(oldLocale, setlocale(LC_ALL, nullptr));
  ....
}
```

In this example, a fixed\-size buffer is created\. The 'LC\_ALL' environment variable is read to this buffer\. If an attacker can manipulate it, then reading this variable can lead to the buffer overflow\.

## Exceptions

The analyzer won't issue a warning if the data source is unknown:

```cpp
void Exception1(int argc, char *argv[])
{
  char *src = GetData();
  char *tmp = (char *)malloc(1024);
  strcpy(tmp, src);
  ....
}
```