Contents
V2635. MISRA. The function with the 'system' name should not be used.
This diagnostic rule is based on the MISRA (Motor Industry Software Reliability Association) software development guidelines.
This diagnostic rule is relevant only for C.
The system function should not be used, and no macro with a similar name should be expanded.
If the argument of the system function is not sanitized, it can cause exploitable vulnerabilities. An attacker can execute arbitrary commands or read and modify data anywhere on the system.
The code example where the analyzer issues the warning:
void PositiveTestFuncall()
{
system("mkdir tmp_dir");
system("chmod 777 ./myfile");
}The analyzer will also issue warnings for using macros with this name:
#define system printf("msg\n");
void PositiveTestMacro()
{
system("gcc --version");
}This diagnostic is classified as:
|
Was this page helpful?
