CWE Rule 1429

Returned value of a sensitive function not checked occurs when you call a function designated as critical in your code behavior specifications file, but you:

This checker requires you to specify which functions in your codebase are security-critical by using a -code-behavior-specifications datalog file. In the datalog file, include these components:

sensitive_function.is_critical("foo").

Specify the datalog file as the input to the option -code-behavior-specifications.

If you do not check the return value of critical functions, security-relevant failures can remain undetected:

Capture and check the return value of all functions designated as critical in your code behavior specifications. Do not cast the return value to void for critical functions.

In this example, the function encrypt_data is designated as critical in the code behavior specifications file. The program calls encrypt_data without capturing its return value.

extern int encrypt_data(const char *input, char *output, int length);
extern void transmit(const char *data, int length);

void process_message(const char *message, int length) {
    char encrypted[256];

    encrypt_data(message, encrypted, length);  // Noncompliant
    transmit(encrypted, length);
}

The call to encrypt_data can fail without any feedback. If the encryption operation fails, the program transmits unprocessed data, potentially exposing sensitive information.

To specify encrypt_data as a critical function, use this datalog code in a .dl file and specify the file as input to -code-behavior-specifications:

.include "models/interfaces/sensitive_function.dl"

sensitive_function.is_critical("encrypt_data").

One possible correction is to capture and check the return value of encrypt_data before proceeding with transmission.

#include <stdlib.h>

extern int encrypt_data(const char *input, char *output, int length);
extern void transmit(const char *data, int length);

void process_message(const char *message, int length) {
    char encrypted[256];

    int result = encrypt_data(message, encrypted, length);  // Compliant
    if (result != 0) {
        /* Handle encryption failure */
        abort();
    }
    transmit(encrypted, length);
}

Use the datalog code to specify the critical function:

.include "models/interfaces/sensitive_function.dl"

sensitive_function.is_critical("encrypt_data").