Incorrect Use of Memset Detection
Detection Workflow
- Identify memset operations: Find all memset() calls, locate buffer clearing operations, identify memory initialization, map sensitive data handling
- Analyze argument order: Verify memset argument order, check pointer/value/size order, assess argument correctness, review common mistakes
- Check size calculation: Verify size parameter, check sizeof usage, assess size correctness, review buffer dimensions
- Assess security impact: Does incorrect memset leave data? Is sensitive data exposed? Can compiler optimize away memset? What's the security impact?
Key Patterns
- Wrong argument order: memset with wrong argument order, size and value arguments swapped, pointer and size arguments swapped, common memset mistakes
- Incorrect size calculation: sizeof on pointer instead of buffer, off-by-one errors in size, size calculation with overflow, wrong size for buffer type
- Misunderstood memset behavior: expecting memset to return filled value, assuming memset validates arguments, thinking memset checks for NULL, misunderstanding memset return value
- Ineffective clearing: memset on optimized-away variables, compiler removing memset calls, incomplete buffer clearing, missing memset on sensitive data
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, memset_call, correct_order, arguments, actual_operation, expected_operation, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Incorrect memset leaving sensitive data
- MEDIUM: Incorrect memset causing memory corruption
- LOW: Minor memset errors
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-incorrect-memset3description: Detects incorrect use of memset() including wrong argument order, incorrect size calculations, and misunderstood behavior. Use when analyzing memory initialization, buffer clearing, or investigating memset() usage errors.4---5
6# Incorrect Use of Memset Detection
7
8## Detection Workflow
9
101. **Identify memset operations**: Find all memset() calls, locate buffer clearing operations, identify memory initialization, map sensitive data handling
112. **Analyze argument order**: Verify memset argument order, check pointer/value/size order, assess argument correctness, review common mistakes
123. **Check size calculation**: Verify size parameter, check sizeof usage, assess size correctness, review buffer dimensions
134. **Assess security impact**: Does incorrect memset leave data? Is sensitive data exposed? Can compiler optimize away memset? What's the security impact?
14
15## Key Patterns
16
17- Wrong argument order: memset with wrong argument order, size and value arguments swapped, pointer and size arguments swapped, common memset mistakes
18- Incorrect size calculation: sizeof on pointer instead of buffer, off-by-one errors in size, size calculation with overflow, wrong size for buffer type
19- Misunderstood memset behavior: expecting memset to return filled value, assuming memset validates arguments, thinking memset checks for NULL, misunderstanding memset return value
20- Ineffective clearing: memset on optimized-away variables, compiler removing memset calls, incomplete buffer clearing, missing memset on sensitive data
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, memset_call, correct_order, arguments, actual_operation, expected_operation, exploitable, attack_scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Incorrect memset leaving sensitive data
29- **MEDIUM**: Incorrect memset causing memory corruption
30- **LOW**: Minor memset errors
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
majiayu000