Test | Severity | Type |
---|---|---|
Array Overflow | 3 π΄ | Overflow |
Concat Overflow | 3 π΄ | Overflow |
Gets Overflow | 3 π΄ | Overflow |
Printf Format Overflow | 3 π΄ | Overflow |
Printf String Overflow | 3 π΄ | Overflow |
Quote Overflow 1 | 3 π΄ | Overflow |
Quote Overflow 2 | 3 π΄ | Overflow |
Quote Overflow 3 | 3 π΄ | Overflow |
Scanf Overflow | 3 π΄ | Overflow |
Double Free 1 | 3 π΄ | Memory |
Double Free 2 | 3 π΄ | Memory |
Invalid Pointer | 2 π | Memory |
Memory Leak | 1 π‘ | Memory |
Null Pointer | 2 π | Memory |
Realloc Invalid | 2 π | Memory |
Reallocf Free | 2 π | Memory |
Use After Free 1 | 3 π΄ | Memory |
Use After Free 2 | 3 π΄ | Memory |
Divide By Zero 1 | 2 π | Logical |
Divide By Zero 2 | 2 π | Logical |
Malloc Zero Access | 2 π | Undefined Behavior |
Stack Return 1 | 3 π΄ | Undefined Behavior |
Stack Return 2 | 3 π΄ | Undefined Behavior |
Stack Return 3 | 3 π΄ | Undefined Behavior |
String Literal Modify | 2 π | Undefined Behavior |
Uninitialized Value 1 | 2 π | Undefined Behavior |
Uninitialized Value 2 | 2 π | Undefined Behavior |
Malloc Error | 1 π‘ | Common User Error |
Switch Fall Through | 1 π‘ | Common User Error |
Severity Score | Description |
---|---|
3 π΄ | There are security implications. |
2 π | Your code may/will crash. |
1 π‘ | It's an issue, but the code may run. |
Test | Sonarlint v3.20.2 | Snyk 1.20.3 | CLion 2023.2 | GCC 13.2.0 | Clang 16.0.0 | icx 2023.1.0 | msvc v19.37 | clang-tidy | ChatGPT | CodeQL 2.15.1 |
---|---|---|---|---|---|---|---|---|---|---|
Array Overflow | β | β | β | β | β | β | β | β | ||
Concat Overflow | β * | β * | β * | |||||||
Gets Overflow | β * | β * | β | β * | β * | β | β * | β * | β * | |
Printf Format Overflow | β * | β | β | β * | β | β | β | |||
Printf String Overflow | β | |||||||||
Quote Overflow 1 | β | β & | ||||||||
Quote Overflow 2 | β | |||||||||
Quote Overflow 3 | β | |||||||||
Scanf Overflow | β * | β * | β | |||||||
Double Free 1 | β | β | β | β | β | β | β | β | β | β |
Double Free 2 | β | β | β * | β | β | β | β * | |||
Invalid Pointer | β * | |||||||||
Memory Leak | β | β | β | β & | β | β | ||||
Null Pointer | β | β | β | β | β | β * | ||||
Realloc Invalid | β | β | β | β | β | β | ||||
Reallocf Free | β | β | β | β | β | β | ||||
Use After Free 1 | β | β | β | β | β | β | β | β | β | β |
Use After Free 2 | β | β | β | β * | ||||||
Divide By Zero 1 | β | β | β | β | β | β | β | β | ||
Divide By Zero 2 | β * | |||||||||
Malloc Zero Access | β * | β | β | β | β * | β | β * | |||
Stack Return 1 | β | β | β | β | β | β | β | β * | β | |
Stack Return 2 | β | β | β | β | β | β | β | β * | β | |
Stack Return 3 | β | β | β | β | β | β * | ||||
String Literal Modify | β | β * | ||||||||
Uninitialized Value 1 | β | β | β | β | β | |||||
Uninitialized Value 2 | β | β | β | β | β | β | β | β | ||
Malloc Error | β | β | β | β | ||||||
Switch Fall Through | β * | β | β |
*
True Positive and False Positive
&
Issued Complexity Warning
-
Sonarlint v3.20.2 16 / 29 (55%)
- Quote Overflow 1
- Quote Overflow 2
-
Snyk 1.20.3 4 / 29 (14%)
-
CLion 2023.2 9 / 29 (31%)
-
GCC 13.2.0 18 / 29 (62%)
- String Literal Modify
- Switch Fall Through
-
Clang 16.0.0 15 / 29 (52%)
-
icx 2023.1.0 15 / 29 (52%)
-
msvc v19.37 11 / 29 (38%)
- Printf String Overflow
-
clang-tidy 15 / 29 (52%)
-
ChatGPT 13 / 29 (45%)
- Quote Overflow 3
Test | No San | Clang 11.0.3 | Clang 14.0.0 | GCC 13.2.0 |
---|---|---|---|---|
Array Overflow | β | β | β | |
Concat Overflow | β | β | β | β |
Use After Free | β | β | β | β |
Null Pointer | β | β | β | β |
Invalid Pointer | β | β | β | β |
Uninitialized Value | ||||
printf Overflow | β | β | β | |
malloc Error |
Version 13.2.0
-fanalyzer -Wanalyzer-too-complex -Wall -Wextra -Werror -pedantic -std=c11 -O2 -g
Version 16.0.0
--analyze -Wall -Wextra -Werror -pedantic -std=c11 -O2 -g
Version 2023.2.1
--analyze -Wall -Wextra -Werror -pedantic -std=c11 -O2 -g
Version v19.37
/Wall /WX /wd4710 /wd4820 /wd4996 /wd5045 /wd6255 /std:c11 /analyze /DEBUG /Zi
/wd4710
is needed as otherwise a warning is given for the compiler/w35045
is needed to avoid warnings about speculative execution mitigation/wd4996
is needed to allowopen()
on Windows. Does disable thescanf()
check.
ChatGPT August 3 Version
Analyze the following C program for any issues that could cause it to crash. Please report if any security issues or other issues are present in the program.
Report on any issues that would cause a program to potentially crash. If the program has no serious issues, say "there are no issues".
*** Header comment removed
Analyzing on the first few sentences of its answer So long as it get the point, it counts as a pass, even if it did state incorrect information about the code.
Godbolt was used to evaluate compilers
codeql database create codeql_scan --language cpp
codeql pack install
codeql database analyze codeql_scan --format=csv --output=scan_results.csv