C/C++ Vulnerability Checks

calendarDec 12, 2024 · 1 min read · codereview-knowhow c cpp c++ security tools  ·
Share on: linkedincopy

Tools for checking vulnerabilities in C/C++ code.

Valgrind

1# Install
2sudo apt install valgrind
3
4# Check memory leaks
5valgrind --leak-check=full ./program
6
7# Detailed output
8valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes ./program

AddressSanitizer (ASan)

1# Compile with ASan
2gcc -fsanitize=address -g program.c -o program
3g++ -fsanitize=address -g program.cpp -o program
4
5# Run
6./program

Clang Static Analyzer

1# Scan with scan-build
2scan-build make
3
4# Scan single file
5clang --analyze program.c

Cppcheck

1# Install
2sudo apt install cppcheck
3
4# Check project
5cppcheck --enable=all --inconclusive --std=c++17 src/
6
7# XML output
8cppcheck --enable=all --xml src/ 2> report.xml

Flawfinder

1# Install
2pip install flawfinder
3
4# Scan
5flawfinder src/
6
7# HTML output
8flawfinder --html src/ > report.html

CI/CD Integration

 1# GitHub Actions
 2name: Security Scan
 3
 4on: [push, pull_request]
 5
 6jobs:
 7  security:
 8    runs-on: ubuntu-latest
 9    steps:
10      - uses: actions/checkout@v3
11      
12      - name: Install tools
13        run: |
14          sudo apt-get update
15          sudo apt-get install -y cppcheck valgrind clang-tools          
16      
17      - name: Run Cppcheck
18        run: cppcheck --enable=all --error-exitcode=1 src/
19      
20      - name: Build with ASan
21        run: |
22          mkdir build
23          cd build
24          cmake -DCMAKE_CXX_FLAGS="-fsanitize=address -g" ..
25          make          
26      
27      - name: Run tests with ASan
28        run: |
29          cd build
30          ./tests

Related Snippets