Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing New Warnings. #120

Merged
merged 4 commits into from
Oct 29, 2024
Merged

Fixing New Warnings. #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
681934e
Update make.c
mephistolist Oct 29, 2024
5f937cd
Update download.c
mephistolist Oct 29, 2024
8973af3
Update make.c
mephistolist Oct 29, 2024
d82467f
added back a free() call
AleksArt000 Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions src/download.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
#include <stdlib.h>
#include <string.h>

#include <curl/curl.h>

Check failure on line 6 in src/download.c

View workflow job for this annotation

GitHub Actions / c-linter

src/download.c:6:10 [clang-diagnostic-error] 

'curl/curl.h' file not found

// Include necessary headers

Expand All @@ -11,12 +11,11 @@
#include "libspm.h"
#include "cutils.h"

int download(char* url, FILE* fp)
{
int download(char* url, FILE* fp) {
CURL *curl = curl_easy_init();
if(curl)
{
if(curl) {
CURLcode res;
(void) res;
curl_easy_setopt(curl, CURLOPT_USERAGENT, "CCCP/1.0 (https://www.sovietlinux.org/)");
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
curl_easy_setopt(curl, CURLOPT_URL, url);
Expand All @@ -26,4 +25,4 @@
curl_easy_cleanup(curl);
}
return 0;
}
}
14 changes: 9 additions & 5 deletions src/make.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,12 @@
- -2: Failed to install the package.
- -3: No install command found.
*/
int make(char* package_dir, struct package* pkg) {

Check warning on line 26 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:26:5 [readability-function-cognitive-complexity] 

function 'make' has cognitive complexity of 37 (threshold 25)
char* build_dir = getenv("SOVIET_BUILD_DIR");
(void)build_dir;
char* make_dir = getenv("SOVIET_MAKE_DIR");

char* cmd_params;

Check warning on line 31 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:31:11 [cppcoreguidelines-init-variables] 

variable 'cmd_params' is not initialized
if (QUIET) {
cmd_params = "&> /dev/null";
} else {
Expand All @@ -44,7 +45,9 @@
for (int i = 0; i < pkg->filesCount; i++)
{
int download_attempts = 3;
int download_success = 0;
(void)download_attempts;
int download_success = 0;
(void)download_success;

struct stat st_source = {0};
struct stat st_source_loc = {0};
Expand All @@ -60,9 +63,9 @@
char* file_url = strtok(NULL, " ");
char* file_sha256 = strtok(NULL, " ");

sprintf(location, "%s/%s", getenv("SOVIET_MAKE_DIR"), file_name);

Check warning on line 66 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:66:9 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
sprintf(source_location, "%s/%s-%s", getenv("SOVIET_SOURCE_DIR"), getenv("NAME"), getenv("VERSION"));

Check warning on line 67 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:67:9 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
sprintf(source_file_location, "%s/%s-%s/%s", getenv("SOVIET_SOURCE_DIR"), getenv("NAME"), getenv("VERSION"), file_name);

Check warning on line 68 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:68:9 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11

dbg(1, "Downloading %s", file_name);

Expand Down Expand Up @@ -96,7 +99,7 @@
int size = st.st_size;

char* buffer = malloc(size);
FILE *ptr;

Check warning on line 102 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:102:19 [cppcoreguidelines-init-variables] 

variable 'ptr' is not initialized
ptr = fopen(location,"r");
fread(buffer, sizeof(char), size, ptr);

Expand All @@ -107,16 +110,17 @@

SHA256((unsigned char*) buffer, size, hash);

if (hash == NULL) {
/* This caused and warning and functionally does nothing. Here hash is an array of unsigned char, but arrays in C are not pointers that can be NULL. This should probably be done with fread or fopen instead. Commenting out for now to silence the warning*/
/*if (hash == NULL) {
msg(FATAL, "Could not verify the file's hash");
return -1;
}
}*/

dbg(1, "Hash is %s", file_sha256);
for(int k = 0; k < SHA256_DIGEST_LENGTH; k++) {
char* temp = calloc(8, 1);
sprintf(temp, "%02x", hash[k]);

Check warning on line 122 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:122:17 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
strcat(hash_str, temp);

Check warning on line 123 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:123:17 [clang-analyzer-security.insecureAPI.strcpy] 

Call to function 'strcat' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcat'. CWE-119
}

dbg(1, "Got %s", hash_str);
Expand All @@ -136,8 +140,8 @@
dbg(1, "Loading form %s", source_location);
loadFile(source_file_location, location);
}
free(files);

free(files);
free(location);
free(source_location);
free(source_file_location);
Expand All @@ -147,7 +151,7 @@
if (pkg->info.download != NULL && strlen(pkg->info.download) > 0) {
char sources_cmd[64 + strlen(make_dir) + strlen(pkg->info.download)];

sprintf(sources_cmd, "(cd %s && %s) %s ", make_dir, pkg->info.download, cmd_params);

Check warning on line 154 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:154:9 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
dbg(2, "Downloading sources with %s", sources_cmd);
int res = system(sources_cmd);

Expand All @@ -161,7 +165,7 @@
if (pkg->info.prepare != NULL && strlen(pkg->info.prepare) > 0) {
char prepare_cmd[64 + strlen(package_dir) + strlen(pkg->info.prepare) + strlen(cmd_params)];

sprintf(prepare_cmd, "( cd %s && %s ) %s", package_dir, pkg->info.prepare, cmd_params);

Check warning on line 168 in src/make.c

View workflow job for this annotation

GitHub Actions / c-linter

src/make.c:168:9 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] 

Call to function 'sprintf' is insecure as it does not provide bounding of the memory buffer or security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11

dbg(2, "Executing prepare command: %s", prepare_cmd);
if (system(prepare_cmd) != 0) {
Expand Down
Loading