rules-c

RISK: system() invokes /bin/sh, so any unsanitized user input in the argument leads to shell command injection (CWE-78). FIX: Use execve()/posix_spawn() with an explicit argv[] array (no shell expansion), or avoid spawning subprocesses entirely.

RISK: Using a variable as the format string argument to printf/fprintf/sprintf enables format string attacks (CWE-134) — an attacker who controls the string can read stack memory (%x) or write arbitrary addresses (%n), leading to information disclosure or RCE. FIX: Always pass a literal format string: printf("%s", user_input).

Complex multi-statement preprocessor macro detected. Consider refactoring into an 'inline' function for better type checking, scope control, and debuggability. The Google C++ Style Guide and general best practice discourage complex macros because they can cause unexpected side effects and are difficult to test.

RISK: rand()/srand() produce a predictable pseudo-random sequence — they must not be used for keys, nonces, session IDs, or any security-sensitive purpose (CWE-338). FIX: Use getrandom(2) (Linux 3.17+) or read /dev/urandom; on Windows use BCryptGenRandom.

RISK: Multiplying operands inside malloc() without overflow checks (e.g., malloc(n * size)) can wrap around to a small allocation when n is attacker-controlled, causing a heap overflow on write (CWE-190/CWE-122). FIX: Use calloc(n, size) which checks for overflow, or validate that n <= SIZE_MAX / size before calling malloc.

RISK: Returning a pointer to a local (stack-allocated) variable creates a dangling pointer (CWE-825/CWE-562) — the memory is invalid as soon as the function returns, causing undefined behaviour on use. FIX: Allocate on the heap with malloc() (and document the caller's responsibility to free), or require the caller to pass a buffer.

RISK: gets() has no length limit — any input longer than the buffer is a guaranteed buffer overflow (CWE-242). It was removed from C11. FIX: Replace with fgets(buf, sizeof(buf), stdin) or getline(), which accept a maximum length.

RISK: sprintf() writes into the destination with no length check — a format result longer than the buffer silently overflows (CWE-120). FIX: Replace with snprintf(dst, sizeof(dst), fmt, ...) and check the return value to detect truncation.

RISK: strcat() appends without a length limit — when the combined length exceeds the destination buffer, the overflow is silent (CWE-120). FIX: Use strlcat(dst, src, sizeof(dst)) or track remaining capacity manually with strncat(dst, src, sizeof(dst) - strlen(dst) - 1).

RISK: strcpy() performs no bounds check — a source longer than the destination causes a stack/heap buffer overflow (CWE-120), which is exploitable for code execution. FIX: Use strlcpy(dst, src, sizeof(dst)) (BSD/glibc 2.38+), or snprintf(dst, sizeof(dst), "%s", src) for portability.