Main Content

Tainted Data Defects

Defects related to code elements from an unsecure source

Tainted data defects flag the use of tainted data in certain operations. Data that comes from unsecure sources is tainted data. Polyspace® considers these sources as unsecure:

  • Volatile objects.

  • External inputs obtained by using standard library functions. External input can include:

    • User input

    • Environment variables

    • File content or file path

    • Data obtained from hardware

Before using the data, validate the tainted data obtained from such unsecure sources. Malicious attackers can use tainted data that has not been validated to attack your program and cause failures. Tainted data defects flag the use of tainted data that has not been validated in certain operations. For instance, Polyspace flags:

  • Tainted data in different numerical operations.

  • Externally controlled elements, such as paths, commands, environment variables, and host IDs.

  • Tainted data in memory operations such as allocation and dereferencing.

Polyspace Results

Array access with tainted indexArray index from unsecure source possibly outside array bounds
Command executed from externally controlled pathPath argument from an unsecure source
Execution of externally controlled commandCommand argument from an unsecure source vulnerable to operating system command injection
Host change using externally controlled elementsChanging host ID from an unsecure source
Library loaded from externally controlled pathUsing a library argument from an externally controlled path
Loop bounded with tainted valueLoop controlled by a value from an unsecure source
Memory allocation with tainted sizeSize argument to memory function is from an unsecure source
Pointer dereference with tainted offsetOffset is from an unsecure source and dereference might be out of bounds
Tainted division operandOperands of division operation (/) come from an unsecure source
Tainted modulo operandOperands of remainder operation (%) come from an unsecure source
Tainted NULL or non-null-terminated stringArgument is from an unsecure source and might be NULL or not NULL-terminated
Tainted sign change conversionValue from an unsecure source changes sign
Tainted size of variable length arraySize of the variable-length array (VLA) is from an unsecure source and might be zero, negative, or too large
Tainted source used with sensitive functionData obtained from an untrusted source is passed to user-defined sensitive function (Since R2023b)
Tainted string formatInput format argument is from an unsecure source
Use of externally controlled environment variableValue of environment variable is from an unsecure source
Use of tainted pointerPointer from an unsecure source may be NULL or point to unknown memory

Topics