Hi @ARommel784014 (Community Member)​ ,

Veracode Static Analysis focusses on finding security risks in the application.

As such, it requires that the input is manipulatable through some application input.

The input in the given example appears to be hardcoded.

Thank you,

Boy Baukema

OK, THX - that's what we thought in the meanwhile. We changed our test to the following - but got the same result: No message 😦

:

wchar_t shortbuf[ 12 ];

char answer[ 1024 ];

puts( "# of chars to build a string?" ); gets( answer );

_stprintf( shortbuf, _T("%s"), build_string( atoi( answer ) );

:

wchar_t *build_string( int count )

{

static wchar_t buf[ 1000 ];

   for( int i = 0; i < count; i++ )

       buf[i] = L'*';

   buf[ count ] = 0;

   return buf;

}

Hi @ARommel784014 (Community Member)​ ,

In this example the user input only indirectly causes the overflow, all with hardcoded characters. This too will not be reported by Veracode Static Analysis. Our analysis must see attacker data go into the destination buffer.

I would recommend using code from your application that is already reported by Veracode Static Analysis as our analysis is tuned for finding flaws in production code with a low false positive count.

Thank you,

Boy Baukema

THX again. Scanner seems to be more intelligent than me ;-)

Using code from our application is somewhat complicated and because we're in an evalutation phase of using Veracode on our own (and not only on request of a end-customer), we want to get familiar with its pros and cons.

The easiest way to get attacker data to a limited destination buffer might be

char shortbuf[ 12 ], answer[ 1024 ];

puts( "provide a large string: " ); gets_s( answer );

sprintf( shortbuf, "%s", answer );

But this is OK for Veraocde - in spite of runtime breaks within VisualStudio (Stack corrupted) and coding-time error-messages in Klocwork :-(. Can it be a false-negative?