Question

Consider the following code fragment and answer below

1. Read(fd, user entry, size of (user entry));

2. Comp=memcmp(userEntry, correct password, stream( user Entry));

3. If (Comp!=0)

4. Return BAD_PASS

- identify any 3 problems with code 8 for each defect describe:

- A) what is this problem

- B) how it can be found (code, review, Static analysis.....)

- C) how it can be solved

Answer 1

Ans :

The 3 defects are:
1. read function call. The 3rd argument should be the number of bytes to be read from the file into the buffer and not the buffer size.
This problem can be found by static analysis.
It can be solved by replacing sizeof(userEntry) with n_bytes (or number of bytes to read ).

2. Usage of memcmp:
Since the code is just trying to compare user input to the password, it is best to use strcmp (string copare) instead of memcmp because generally passwords dont occupy multiple bytes of memory area.
This defect can be found by code review.
It can be solved by using strcmp function instead of memcmp>

3. The third parameter in the compare function should not be sent. This is because if ur password is say hello123 and ur input is say hello, this will compare only the length of user input which is 5 and will try to match only those many characters in password i.e. hello and not the entire string hello123. This is a defect and bug.
This can be foud only on testing different scenarios.
Solution for this is to have full matches of 2 strings and not provide length parameter

Thank you...