title: How to analyze, find & fix security flaws in a C++ function?
body: <p>As a work example, we can deal with the following code:</p>
  
  <pre><code>    #include &lt;sys/socket.h&gt;
  
      #define size_t   SOCKET
  
      int receive_socket_data(SOCKET sock,//socket representing remote connection
                              unsigned long&amp; version_number,//validPtr-&gt;version #
                              unsigned long&amp; message_size,//validPtr-&gt;sizeof packet
                              char*&amp; buf // where to copy data from packet
                             )
      {
         int nlen = 0;
         buf = NULL;
  
         // Receive version_number from the packet
         nlen = recv(sock, (char*) &amp;version_number, sizeof(version_number), 0);
         if (nlen == 0 || nlen == -1) return ERROR_RECEIVING;
         version_number = ntohl(version_number);
  
         // Receive message_size from the entire packet 
         // (ulong + ulong + sizeof data)
         nlen = recv(sock, (char*) &amp;message_size, sizeof(message_size), 0);
         if (nlen == 0 || nlen == -1) return ERROR_RECEIVING;
         message_size = ntohl(message_size);
         // Allocate a buffer to copy the data part of the packet
         buf = new char[message_size + 1 - 2 * sizeof(unsigned long)];
         buf[message_size - 2 * sizeof(unsigned long)] = '\0';
  
        // Copy the data part from the packet to the buffer
        if (recv(sock, (char*) buf, message_size-2*sizeof(unsigned long), 0) == -1)
           return ERROR_RECEIVING;
  
        return SUCCESS_RECEIVING;
      }
  </code></pre>
  
  <p>Things I have in mind, for example, is the potential throw of an error by operator <em>new</em>.<br>
  I am not sure if the array's index calculation might cause problems too.</p>