The following issues were found
builtin/revert.c
2 issues
Line: 210
Column: 25
CWE codes:
807
20
Suggestion:
Check environment variables carefully before using them
/* These option values will be free()d */
opts->gpg_sign = xstrdup_or_null(opts->gpg_sign);
opts->strategy = xstrdup_or_null(opts->strategy);
if (!opts->strategy && getenv("GIT_TEST_MERGE_ALGORITHM"))
opts->strategy = xstrdup(getenv("GIT_TEST_MERGE_ALGORITHM"));
if (cmd == 'q') {
int ret = sequencer_remove_state(opts);
if (!ret)
Reported by FlawFinder.
Line: 211
Column: 28
CWE codes:
807
20
Suggestion:
Check environment variables carefully before using them
opts->gpg_sign = xstrdup_or_null(opts->gpg_sign);
opts->strategy = xstrdup_or_null(opts->strategy);
if (!opts->strategy && getenv("GIT_TEST_MERGE_ALGORITHM"))
opts->strategy = xstrdup(getenv("GIT_TEST_MERGE_ALGORITHM"));
if (cmd == 'q') {
int ret = sequencer_remove_state(opts);
if (!ret)
remove_branch_state(the_repository, 0);
Reported by FlawFinder.
compat/apple-common-crypto.h
2 issues
Line: 64
Column: 14
CWE codes:
126
CFRelease(input);
CFRelease(encoder);
return (int)strlen((const char *)out);
}
#define EVP_DecodeBlock git_CC_EVP_DecodeBlock
static int inline git_CC_EVP_DecodeBlock(unsigned char *out,
const unsigned char *in, int inlen)
Reported by FlawFinder.
Line: 94
Column: 14
CWE codes:
126
CFRelease(input);
CFRelease(decoder);
return (int)strlen((const char *)out);
}
#endif /* APPLE_LION_OR_NEWER */
Reported by FlawFinder.
builtin/checkout--worker.c
2 issues
Line: 45
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
pc_item->ce = make_empty_transient_cache_entry(fixed_portion->name_len, NULL);
pc_item->ce->ce_namelen = fixed_portion->name_len;
pc_item->ce->ce_mode = fixed_portion->ce_mode;
memcpy(pc_item->ce->name, variant, pc_item->ce->ce_namelen);
oidcpy(&pc_item->ce->oid, &fixed_portion->oid);
pc_item->id = fixed_portion->id;
pc_item->ca.crlf_action = fixed_portion->crlf_action;
pc_item->ca.ident = fixed_portion->ident;
Reported by FlawFinder.
Line: 134
Column: 24
CWE codes:
126
usage_with_options(checkout_worker_usage, checkout_worker_options);
if (state.base_dir)
state.base_dir_len = strlen(state.base_dir);
/*
* Setting this on a worker won't actually update the index. We just
* need to tell the checkout machinery to lstat() the written entries,
* so that we can send this data back to the main process.
Reported by FlawFinder.
advice.h
2 issues
Line: 81
Column: 24
CWE codes:
134
Suggestion:
Use a constant for the format specification
};
int git_default_advice_config(const char *var, const char *value);
__attribute__((format (printf, 1, 2)))
void advise(const char *advice, ...);
/**
* Checks if advice type is enabled (can be printed to the user).
* Should be called before advise().
Reported by FlawFinder.
Line: 93
Column: 24
CWE codes:
134
Suggestion:
Use a constant for the format specification
/**
* Checks the visibility of the advice before printing.
*/
__attribute__((format (printf, 2, 3)))
void advise_if_enabled(enum advice_type type, const char *advice, ...);
int error_resolve_conflict(const char *me);
void NORETURN die_resolve_conflict(const char *me);
void NORETURN die_conclude_merge(void);
Reported by FlawFinder.
match-trees.c
2 issues
Line: 202
Column: 7
CWE codes:
126
unsigned short mode;
tree_entry_extract(&desc, &name, &mode);
if (strlen(name) == toplen &&
!memcmp(name, prefix, toplen)) {
if (!S_ISDIR(mode))
die("entry %s in tree %s is not a tree", name,
oid_to_hex(oid1));
Reported by FlawFinder.
Line: 218
Column: 9
CWE codes:
126
* know it points into our non-const "buf"
*/
rewrite_here = (unsigned char *)(desc.entry.path +
strlen(desc.entry.path) +
1);
break;
}
update_tree_entry(&desc);
}
Reported by FlawFinder.
reflog-walk.c
2 issues
Line: 163
Column: 31
CWE codes:
126
if (!reflogs || reflogs->nr == 0) {
struct object_id oid;
char *b;
int ret = dwim_log(branch, strlen(branch),
&oid, &b);
if (ret > 1)
free(b);
else if (ret == 1) {
free_complete_reflog(reflogs);
Reported by FlawFinder.
Line: 247
Column: 8
CWE codes:
126
return;
info = &commit_reflog->reflogs->items[commit_reflog->recno+1];
len = strlen(info->message);
if (len > 0)
len--; /* strip away trailing newline */
strbuf_add(sb, info->message, len);
}
Reported by FlawFinder.
builtin/remote-fd.c
2 issues
Line: 26
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static void command_loop(int input_fd, int output_fd)
{
char buffer[MAXCOMMAND];
while (1) {
size_t i;
if (!fgets(buffer, MAXCOMMAND - 1, stdin)) {
if (ferror(stdin))
Reported by FlawFinder.
Line: 36
Column: 7
CWE codes:
126
return;
}
/* Strip end of line characters. */
i = strlen(buffer);
while (i > 0 && isspace(buffer[i - 1]))
buffer[--i] = 0;
if (!strcmp(buffer, "capabilities")) {
printf("*connect\n\n");
Reported by FlawFinder.
walker.c
2 issues
Line: 20
Column: 3
CWE codes:
134
Suggestion:
Use a constant for the format specification
if (walker->get_verbosely) {
va_list ap;
va_start(ap, fmt);
vfprintf(stderr, fmt, ap);
va_end(ap);
}
}
static void report_missing(const struct object *obj)
Reported by FlawFinder.
Line: 265
Column: 10
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
while (targets--) {
free(target[targets]);
if (write_ref)
free((char *) write_ref[targets]);
}
}
int walker_fetch(struct walker *walker, int targets, char **target,
const char **write_ref, const char *write_ref_log_details)
Reported by FlawFinder.
builtin/check-attr.c
2 issues
Line: 45
Column: 4
CWE codes:
134
Suggestion:
Use a constant for the format specification
value = "unspecified";
if (nul_term_line) {
printf("%s%c" /* path */
"%s%c" /* attrname */
"%s%c" /* attrvalue */,
file, 0,
git_attr_name(check->items[j].attr), 0, value, 0);
} else {
Reported by FlawFinder.
Line: 64
Column: 32
CWE codes:
126
const char *file)
{
char *full_path =
prefix_path(prefix, prefix ? strlen(prefix) : 0, file);
if (collect_all) {
git_all_attrs(&the_index, full_path, check);
} else {
git_check_attr(&the_index, full_path, check);
Reported by FlawFinder.
refs/ref-cache.c
2 issues
Line: 208
Column: 45
CWE codes:
126
dir = find_containing_dir(dir, refname, 0);
if (!dir)
return NULL;
entry_index = search_ref_dir(dir, refname, strlen(refname));
if (entry_index == -1)
return NULL;
entry = dir->entries[entry_index];
return (entry->flag & REF_DIR) ? NULL : entry;
}
Reported by FlawFinder.
Line: 217
Column: 20
CWE codes:
126
int remove_entry_from_dir(struct ref_dir *dir, const char *refname)
{
int refname_len = strlen(refname);
int entry_index;
struct ref_entry *entry;
int is_dir = refname[refname_len - 1] == '/';
if (is_dir) {
/*
Reported by FlawFinder.