mcp-server-semgrep/semgrep-rules/c/lang/correctness/incorrect-use-sscanf-fn.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: incorrect-use-sscanf-fn
    patterns:
      - pattern: sscanf($STR, $FMT, $PTR);
      - metavariable-regex:
          metavariable: $FMT
          regex: '"%(l{0,2}|L)([fegEa]|[dDiouxX])"'
    message: >-
      Avoid 'sscanf()' for number conversions. Its use can lead to undefined
      behavior, slow processing, and integer overflows. Instead prefer the
      'strto*()' family of functions.
    metadata:
      references:
        - https://stackoverflow.com/q/22865622
        - https://stackoverflow.com/q/7021725
        - https://www.mattkeeter.com/blog/2021-03-01-happen/
      category: correctness
      technology:
        - c
    languages: [c]
    severity: WARNING