Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Increase memory space to avoid overflow #306

Merged
merged 2 commits into from
Dec 1, 2020

Conversation

klebertarcisio
Copy link
Contributor

This pull request is concerned with avoiding overflows in this project. For this, I increased the memory space of some variables to ensure that these variables always have the value they should have.

Issue 164

@klebertarcisio klebertarcisio mentioned this pull request Dec 1, 2020
@ThomasAdam
Copy link
Member

Hi @klebertarcisio

Thanks for this. How did you derive which variables to change here? Have you encountered problems where the code had larger values and hence overran? Or something else?

I'm happy to apply this change -- I'm just wondering how many other instances there might be...

@klebertarcisio
Copy link
Contributor Author

Hi @ThomasAdam,

I used a static analysis tool focused on finding points for improvement. In this specific case, the tool detected a weakness classified as CWE 120. (https://cwe.mitre.org/data/definitions/120.html) (Buffer Copy without Checking Size of Input)
Have you encountered problems where the code had larger values and hence overran?
We did not find a case that used more memory than was allocated. In fact, this pull request is a matter of prevention.

How did you derive which variables to change here?
I believe the tool used types to suggest what the real size should be. I believe the tool checks whether "sprintf" and similar operations are working with the correct (or maximum) memory allocation. To verify this, I believe that the tool needs to know the types.

I'm happy to apply this change
Thanks!

I'm just wondering how many other instances there might be...
Since we are dealing with a system that can be used on multiple platforms, it is not so simple to detect all instances. However, I would be happy to send more pull requests in other moments.

@ThomasAdam ThomasAdam merged commit 5316b06 into fvwmorg:master Dec 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

2 participants