Zennoxa Shield
Rules / C/C++
SHIELD-CPP-005

Unbounded scanf %s read

highC/C++CWE-120CVSS 8.1

What it detects

scanf with %s reads into a buffer without a width limit and can overflow it.

How to fix

Specify a maximum field width such as %31s matching the buffer size.

Vulnerable — Shield flags thisread_city.c
#include <stdio.h>

int main(void) {
    char city[32];
    scanf("%s", city);   /* no width limit - overflows city[] */
    printf("%s\n", city);
    return 0;
}
Fixed — scans cleanread_city.c
#include <stdio.h>

int main(void) {
    char city[32];
    scanf("%31s", city); /* width bounded to the buffer */
    printf("%s\n", city);
    return 0;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-005: Unbounded scanf %s read — Zennoxa Shield