The following issues were found
http.h
4 issues
Line: 121
Column: 8
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
extern ssize_t http_post_buffer;
extern struct credential http_auth;
extern char curl_errorstr[CURL_ERROR_SIZE];
enum http_follow_config {
HTTP_FOLLOW_NONE,
HTTP_FOLLOW_ALWAYS,
HTTP_FOLLOW_INITIAL
Reported by FlawFinder.
Line: 229
Column: 16
CWE codes:
377
unsigned preserve_index_pack_stdout : 1;
FILE *packfile;
struct strbuf tmpfile;
struct active_request_slot *slot;
};
struct http_pack_request *new_http_pack_request(
const unsigned char *packed_git_hash, const char *base_url);
Reported by FlawFinder.
Line: 252
Column: 16
CWE codes:
377
/* Helpers for fetching object */
struct http_object_request {
char *url;
struct strbuf tmpfile;
int localfile;
CURLcode curl_result;
char errorstr[CURL_ERROR_SIZE];
long http_code;
struct object_id oid;
Reported by FlawFinder.
Line: 255
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct strbuf tmpfile;
int localfile;
CURLcode curl_result;
char errorstr[CURL_ERROR_SIZE];
long http_code;
struct object_id oid;
struct object_id real_oid;
git_hash_ctx c;
git_zstream stream;
Reported by FlawFinder.
builtin/show-branch.c
4 issues
Line: 320
Column: 8
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
strbuf_release(&pretty);
}
static char *ref_name[MAX_REVS + 1];
static int ref_name_cnt;
static const char *find_digit_prefix(const char *s, int *v)
{
const char *p;
Reported by FlawFinder.
Line: 624
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
int cmd_show_branch(int ac, const char **av, const char *prefix)
{
struct commit *rev[MAX_REVS], *commit;
char *reflog_msg[MAX_REVS];
struct commit_list *list = NULL, *seen = NULL;
unsigned int rev_mask[MAX_REVS];
int num_rev, i, extra = 0;
int all_heads = 0, all_remotes = 0;
int all_mask, all_revs;
Reported by FlawFinder.
Line: 726
Column: 17
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned int flags = 0;
if (ac == 0) {
static const char *fake_av[2];
fake_av[0] = resolve_refdup("HEAD",
RESOLVE_REF_READING, &oid,
NULL);
fake_av[1] = NULL;
Reported by FlawFinder.
Line: 744
Column: 22
CWE codes:
126
die(Q_("only %d entry can be shown at one time.",
"only %d entries can be shown at one time.",
MAX_REVS), MAX_REVS);
if (!dwim_ref(*av, strlen(*av), &oid, &ref, 0))
die(_("no such ref %s"), *av);
/* Has the base been specified? */
if (reflog_base) {
char *ep;
Reported by FlawFinder.
builtin/shortlog.c
4 issues
Line: 118
Column: 15
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct strbuf ident = STRBUF_INIT;
struct strbuf mapped_ident = STRBUF_INIT;
struct strbuf oneline = STRBUF_INIT;
static const char *author_match[2] = { "Author: ", "author " };
static const char *committer_match[2] = { "Commit: ", "committer " };
const char **match;
if (HAS_MULTI_BITS(log->groups))
die(_("using multiple --group options with stdin is not supported"));
Reported by FlawFinder.
Line: 119
Column: 15
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct strbuf mapped_ident = STRBUF_INIT;
struct strbuf oneline = STRBUF_INIT;
static const char *author_match[2] = { "Author: ", "author " };
static const char *committer_match[2] = { "Commit: ", "committer " };
const char **match;
if (HAS_MULTI_BITS(log->groups))
die(_("using multiple --group options with stdin is not supported"));
Reported by FlawFinder.
Line: 73
Column: 20
CWE codes:
126
oneline++;
eol = strchr(oneline, '\n');
if (!eol)
eol = oneline + strlen(oneline);
if (starts_with(oneline, "[PATCH")) {
char *eob = strchr(oneline, ']');
if (eob && (!eol || eob < eol))
oneline = eob + 1;
}
Reported by FlawFinder.
Line: 97
Column: 35
CWE codes:
126
size_t namelen, maillen;
struct ident_split ident;
if (split_ident_line(&ident, in, strlen(in)))
return -1;
namebuf = ident.name_begin;
mailbuf = ident.mail_begin;
namelen = ident.name_end - ident.name_begin;
Reported by FlawFinder.
builtin/credential-store.c
4 issues
Line: 110
Column: 8
CWE codes:
362/367!
Suggestion:
Set up the correct permissions (e.g., using setuid()) and try to open the file directly
return;
for_each_string_list_item(fn, fns)
if (!access(fn->string, F_OK)) {
store_credential_file(fn->string, c);
return;
}
/*
* Write credential to the filename specified by fns->items[0], thus
Reported by FlawFinder.
Line: 137
Column: 8
CWE codes:
362/367!
Suggestion:
Set up the correct permissions (e.g., using setuid()) and try to open the file directly
if (!c->protocol && !c->host && !c->path && !c->username)
return;
for_each_string_list_item(fn, fns)
if (!access(fn->string, F_OK))
rewrite_credential_file(fn->string, c, NULL);
}
static void lookup_credential(const struct string_list *fns, struct credential *c)
{
Reported by FlawFinder.
Line: 20
Column: 7
CWE codes:
362
struct credential entry = CREDENTIAL_INIT;
int found_credential = 0;
fh = fopen(fn, "r");
if (!fh) {
if (errno != ENOENT && errno != EACCES)
die_errno("unable to open %s", fn);
return found_credential;
}
Reported by FlawFinder.
Line: 166
Column: 2
CWE codes:
732
OPT_END()
};
umask(077);
argc = parse_options(argc, (const char **)argv, prefix, options, usage, 0);
if (argc != 1)
usage_with_options(usage, options);
op = argv[0];
Reported by FlawFinder.
abspath.c
4 issues
Line: 238
Column: 23
CWE codes:
120/785!
Suggestion:
Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN
struct strbuf realpath = STRBUF_INIT;
char *retval = NULL;
if (strbuf_realpath(&realpath, path, die_on_error))
retval = strbuf_detach(&realpath, NULL);
strbuf_release(&realpath);
return retval;
Reported by FlawFinder.
Line: 239
Column: 27
CWE codes:
120/785!
Suggestion:
Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN
char *retval = NULL;
if (strbuf_realpath(&realpath, path, die_on_error))
retval = strbuf_detach(&realpath, NULL);
strbuf_release(&realpath);
return retval;
}
Reported by FlawFinder.
Line: 241
Column: 18
CWE codes:
120/785!
Suggestion:
Ensure that the destination buffer is at least of size MAXPATHLEN, andto protect against implementation problems, the input argument should also be checked to ensure it is no larger than MAXPATHLEN
if (strbuf_realpath(&realpath, path, die_on_error))
retval = strbuf_detach(&realpath, NULL);
strbuf_release(&realpath);
return retval;
}
/*
Reported by FlawFinder.
Line: 268
Column: 25
CWE codes:
126
char *prefix_filename(const char *pfx, const char *arg)
{
struct strbuf path = STRBUF_INIT;
size_t pfx_len = pfx ? strlen(pfx) : 0;
if (!pfx_len)
; /* nothing to prefix */
else if (is_absolute_path(arg))
pfx_len = 0;
Reported by FlawFinder.
t/helper/test-pkt-line.c
4 issues
Line: 22
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
for (i = 0; i < argc; i++)
pack_line(argv[i]);
} else { /* read from stdin */
char line[LARGE_PACKET_MAX];
while (fgets(line, sizeof(line), stdin)) {
pack_line(line);
}
}
}
Reported by FlawFinder.
Line: 103
Column: 29
CWE codes:
126
const char *primary = "\001primary: regular output\n";
const char *part2 = " world!\n";
send_sideband(1, 2, part1, strlen(part1), LARGE_PACKET_MAX);
packet_write(1, primary, strlen(primary));
send_sideband(1, 2, part2, strlen(part2), LARGE_PACKET_MAX);
packet_response_end(1);
return 0;
Reported by FlawFinder.
Line: 104
Column: 27
CWE codes:
126
const char *part2 = " world!\n";
send_sideband(1, 2, part1, strlen(part1), LARGE_PACKET_MAX);
packet_write(1, primary, strlen(primary));
send_sideband(1, 2, part2, strlen(part2), LARGE_PACKET_MAX);
packet_response_end(1);
return 0;
}
Reported by FlawFinder.
Line: 105
Column: 29
CWE codes:
126
send_sideband(1, 2, part1, strlen(part1), LARGE_PACKET_MAX);
packet_write(1, primary, strlen(primary));
send_sideband(1, 2, part2, strlen(part2), LARGE_PACKET_MAX);
packet_response_end(1);
return 0;
}
Reported by FlawFinder.
parse-options.c
4 issues
Line: 437
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static void parse_options_check(const struct option *opts)
{
int err = 0;
char short_opts[128];
memset(short_opts, '\0', sizeof(short_opts));
for (; opts->type != OPTION_END; opts++) {
if ((opts->flags & PARSE_OPT_LASTARG_DEFAULT) &&
(opts->flags & PARSE_OPT_OPTARG))
Reported by FlawFinder.
Line: 679
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (options[j].type == OPTION_ALIAS)
BUG("No please. Nested aliases are not supported.");
memcpy(newopt + i, options + j, sizeof(*newopt));
newopt[i].short_name = short_name;
newopt[i].long_name = long_name;
newopt[i].help = strbuf_detach(&help, NULL);
newopt[i].flags |= PARSE_OPT_FROM_ALIAS;
break;
Reported by FlawFinder.
Line: 416
Column: 6
CWE codes:
126
static void check_typos(const char *arg, const struct option *options)
{
if (strlen(arg) < 3)
return;
if (starts_with(arg, "no-")) {
error(_("did you mean `--%s` (with two dashes)?"), arg);
exit(129);
Reported by FlawFinder.
Line: 488
Column: 36
CWE codes:
126
; /* ok. (usually accepts an argument) */
}
if (opts->argh &&
strcspn(opts->argh, " _") != strlen(opts->argh))
err |= optbug(opts, "multi-word argh should use dash to separate words");
}
if (err)
exit(128);
}
Reported by FlawFinder.
csum-file.c
4 issues
Line: 117
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
* Copy to the hashfile's buffer, flushing only
* if it became full.
*/
memcpy(f->buffer + f->offset, buf, nr);
f->offset += nr;
left -= nr;
if (!left)
hashflush(f);
}
Reported by FlawFinder.
Line: 134
Column: 9
CWE codes:
362
int sink, check;
struct hashfile *f;
sink = open("/dev/null", O_WRONLY);
if (sink < 0)
die_errno("unable to open /dev/null");
check = open(name, O_RDONLY);
if (check < 0)
die_errno("unable to open '%s'", name);
Reported by FlawFinder.
Line: 137
Column: 10
CWE codes:
362
sink = open("/dev/null", O_WRONLY);
if (sink < 0)
die_errno("unable to open /dev/null");
check = open(name, O_RDONLY);
if (check < 0)
die_errno("unable to open '%s'", name);
f = hashfd(sink, name);
f->check_fd = check;
f->check_buffer = xmalloc(f->buffer_len);
Reported by FlawFinder.
Line: 223
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
int hashfile_checksum_valid(const unsigned char *data, size_t total_len)
{
unsigned char got[GIT_MAX_RAWSZ];
git_hash_ctx ctx;
size_t data_len = total_len - the_hash_algo->rawsz;
if (total_len < the_hash_algo->rawsz)
return 0; /* say "too short"? */
Reported by FlawFinder.
pack-write.c
4 issues
Line: 78
Column: 9
CWE codes:
362
index_name = strbuf_detach(&tmp_file, NULL);
} else {
unlink(index_name);
fd = open(index_name, O_CREAT|O_EXCL|O_WRONLY, 0600);
if (fd < 0)
die_errno("unable to create '%s'", index_name);
}
f = hashfd(fd, index_name);
}
Reported by FlawFinder.
Line: 259
Column: 9
CWE codes:
362
rev_name = strbuf_detach(&tmp_file, NULL);
} else {
unlink(rev_name);
fd = open(rev_name, O_CREAT|O_EXCL|O_WRONLY, 0600);
if (fd < 0)
die_errno("unable to create '%s'", rev_name);
}
f = hashfd(fd, rev_name);
} else if (flags & WRITE_REV_VERIFY) {
Reported by FlawFinder.
Line: 373
Column: 13
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
the_hash_algo->update_fn(&old_hash_ctx, buf, n);
partial_pack_offset -= n;
if (partial_pack_offset == 0) {
unsigned char hash[GIT_MAX_RAWSZ];
the_hash_algo->final_fn(hash, &old_hash_ctx);
if (!hasheq(hash, partial_pack_hash))
die("Unexpected checksum for %s "
"(disk corruption?)", pack_name);
/*
Reported by FlawFinder.
Line: 399
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
char *index_pack_lockfile(int ip_out, int *is_well_formed)
{
char packname[GIT_MAX_HEXSZ + 6];
const int len = the_hash_algo->hexsz + 6;
/*
* The first thing we expect from index-pack's output
* is "pack\t%40s\n" or "keep\t%40s\n" (46 bytes) where
Reported by FlawFinder.
tempfile.c
4 issues
Line: 187
Column: 11
CWE codes:
807
20
Suggestion:
Check environment variables carefully before using them
struct tempfile *tempfile = new_tempfile();
const char *tmpdir;
tmpdir = getenv("TMPDIR");
if (!tmpdir)
tmpdir = "/tmp";
strbuf_addf(&tempfile->filename, "%s/%s", tmpdir, filename_template);
tempfile->fd = git_mkstemps_mode(tempfile->filename.buf, suffixlen, mode);
Reported by FlawFinder.
Line: 138
Column: 17
CWE codes:
362
struct tempfile *tempfile = new_tempfile();
strbuf_add_absolute_path(&tempfile->filename, path);
tempfile->fd = open(tempfile->filename.buf,
O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, mode);
if (O_CLOEXEC && tempfile->fd < 0 && errno == EINVAL)
/* Try again w/o O_CLOEXEC: the kernel might not support it */
tempfile->fd = open(tempfile->filename.buf,
O_RDWR | O_CREAT | O_EXCL, mode);
Reported by FlawFinder.
Line: 142
Column: 18
CWE codes:
362
O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, mode);
if (O_CLOEXEC && tempfile->fd < 0 && errno == EINVAL)
/* Try again w/o O_CLOEXEC: the kernel might not support it */
tempfile->fd = open(tempfile->filename.buf,
O_RDWR | O_CREAT | O_EXCL, mode);
if (tempfile->fd < 0) {
deactivate_tempfile(tempfile);
return NULL;
}
Reported by FlawFinder.
Line: 282
Column: 17
CWE codes:
362
BUG("reopen_tempfile called for an inactive object");
if (0 <= tempfile->fd)
BUG("reopen_tempfile called for an open object");
tempfile->fd = open(tempfile->filename.buf, O_WRONLY|O_TRUNC);
return tempfile->fd;
}
int rename_tempfile(struct tempfile **tempfile_p, const char *path)
{
Reported by FlawFinder.