Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

C++ causing VIRUS errors?

You might call me crazy after reading this post, but I would really request you to trust me when you read what I say here. In my attempt to understand situations where memory leak or other errors could be caused, I wrote the following code and tried compiling on my pc,

#include <iostream>

using namespace std;

class game
{
   int x;

   public : 
   char *s;
   char read();
   char manipulation();
};

char game :: read()
{
   char string[100];
   cout<<"Enter name ";
   cin>>string;
   s = string;
   cout<<"Name is "<<&s<<endl;
}

int main()
{ 
   game games,games1;
  // games.read();
   cout<<"Name is "<<games.s<<endl;
   return 0;
}

If i execute games.read() in my main, my anti-virus software BITDEFENDER shows me the following error, "BITDEFENDER has detected an infected item in c:/c++/inline.exe. Virus name : Gen:Variant.Graftor.51542. The file was disinfected for your protection"

inline.cpp is the name of my program. If i remove that line "games.read()", it compiles fine. Is the pointer causing a memory leak somewhere?

like image 915
SandBag_1996 Avatar asked Dec 06 '22 10:12

SandBag_1996


2 Answers

Your anti-virus program just found a use-after-free vulnerability.

string is a local array.
You can't use it after read() exits.

like image 165
SLaks Avatar answered Dec 09 '22 15:12

SLaks


If your system claims your code is a virus, then it's nothing to worry about in the sense that you are losing your mind; you are not.

Virus scanners will look for patterns of behaviors consistent with viruses and report them. They are not perfect, and non-virus behavior can look like a virus at times.

For instance, a classic virus strategy is to use invalid pointer writes to run arbitrary code. One of the first viruses used this and it's still a common strategy (I recall an IE update not long ago to fix this). So if you have a pointer error (as the previous poster noted) then it could look like a virus.

like image 36
RonaldBarzell Avatar answered Dec 09 '22 15:12

RonaldBarzell