insecure-api-atoi-atol-atof.yaml

rules:
  - id: raptor-insecure-api-atoi-atol-atof
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://rules.sonarsource.com/c/type/Bug/RSPEC-989
        - https://wiki.sei.cmu.edu/confluence/display/c/ERR34-C.+Detect+errors+when+converting+a+string+to+a+number
      confidence: HIGH
      # NOTE: some function variants are missing.
    message: >-
      The atoi(), atol(), atof(), and similar functions don't handle errors.
      They don't check for integer overflow and can return a negative value. 
      They have undefined behavior if the value of the result cannot be 
      represented. They return 0 (or 0.0) if the string does not represent 
      an integer (or decimal), which is indistinguishable from a correctly 
      formatted, zero-denoting input string.
    severity: INFO
    languages:
      - c
      - cpp
    pattern-either:
      - pattern: atoi(...)
      - pattern: atol(...)
      - pattern: atof(...)
      - pattern: atoll(...)