ret-stack-address.yaml

rules:
  - id: raptor-ret-stack-address
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      references:
        - https://cwe.mitre.org/data/definitions/562
        - https://github.com/struct/mms
        - https://www.sei.cmu.edu/downloads/sei-cert-c-coding-standard-2016-v01.pdf
        - https://docs.microsoft.com/en-us/cpp/sanitizers/asan-error-examples
        - https://rules.sonarsource.com/c/type/Bug/RSPEC-946
      confidence: LOW
      # NOTE: static variables matching apparently is not supported by Semgrep.
      # NOTE: multiple pointer assignments and other ways to persist after 
      # function returns (e.g., output parameter) are not covered.
    message: >-
      A function returns the address of a stack variable, which will cause
      unintended program behavior, typically in the form of a crash.
    severity: INFO
    languages:
      - c
      - cpp
    pattern-either:
      - patterns:
        - pattern: return $PTR;
        - pattern-either:
          # array
          - pattern-inside: |
              $TYPE $PTR[$LEN];
              ...
          - pattern-inside: |
              $TYPE $PTR[$LEN] = $EXPR;
              ...
          # pointer to array
          - pattern-inside: |
              $TYPE $ARR[$LEN];
              ...
              $PTR = $ARR;
              ...
          - pattern-inside: |
              $TYPE $ARR[$LEN] = $EXPR;
              ...
              $PTR = $ARR;
              ...
      - patterns:
        # address of local variable
        - pattern: return &$VAR;
        - pattern-either:
          - pattern-inside: |
              $TYPE $VAR;
              ...
          - pattern-inside: |
              $TYPE $VAR = $EXPR;
              ...
          - pattern-inside: |
              $TYPE $VAR[$LEN];
              ...
          - pattern-inside: |
              $TYPE $VAR[$LEN] = $EXPR;
              ...
          - pattern-inside: |
              $TYPE * $VAR;
              ...
          - pattern-inside: |
              $TYPE * $VAR = $EXPR;
              ...