The following issues were found

src/third_party/wiredtiger/test/suite/test_bug003.py
8 issues
Unable to import 'wiredtiger'
Error

Line: 32 Column: 1

              # test_bug003.py
#       Regression tests.

import wiredtiger, wttest
from wtscenario import make_scenarios

# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
    types = [

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 32 Column: 1

              # test_bug003.py
#       Regression tests.

import wiredtiger, wttest
from wtscenario import make_scenarios

# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
    types = [

            

Reported by Pylint.

Unused variable 'cursor'
Error

Line: 55 Column: 9

                          self.session.checkpoint("name=ckpt")
        else:
            self.session.checkpoint()
        cursor = self.session.open_cursor(self.uri, None, "bulk")

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 32 Column: 1

              # test_bug003.py
#       Regression tests.

import wiredtiger, wttest
from wtscenario import make_scenarios

# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
    types = [

            

Reported by Pylint.

Missing class docstring
Error

Line: 36 Column: 1

              from wtscenario import make_scenarios

# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
    types = [
        ('file', dict(uri='file:data')),
        ('table', dict(uri='table:data')),
    ]
    ckpt = [

            

Reported by Pylint.

Class name "test_bug003" doesn't conform to PascalCase naming style
Error

Line: 36 Column: 1

              from wtscenario import make_scenarios

# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
    types = [
        ('file', dict(uri='file:data')),
        ('table', dict(uri='table:data')),
    ]
    ckpt = [

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 49 Column: 5

                  scenarios = make_scenarios(types, ckpt)

    # Confirm bulk-load isn't stopped by checkpoints.
    def test_bug003(self):
        self.session.create(self.uri, "key_format=S,value_format=S")
        if self.name == 1:
            self.session.checkpoint("name=ckpt")
        else:
            self.session.checkpoint()

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_base02.py
8 issues
Unable to import 'wiredtiger'
Error

Line: 38 Column: 1

              #

import json
import wiredtiger, wttest
from wtscenario import make_scenarios

# Test configuration strings.
class test_base02(wttest.WiredTigerTestCase):
    name = 'test_base02a'

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 38 Column: 1

              #

import json
import wiredtiger, wttest
from wtscenario import make_scenarios

# Test configuration strings.
class test_base02(wttest.WiredTigerTestCase):
    name = 'test_base02a'

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 38 Column: 1

              #

import json
import wiredtiger, wttest
from wtscenario import make_scenarios

# Test configuration strings.
class test_base02(wttest.WiredTigerTestCase):
    name = 'test_base02a'

            

Reported by Pylint.

Missing class docstring
Error

Line: 42 Column: 1

              from wtscenario import make_scenarios

# Test configuration strings.
class test_base02(wttest.WiredTigerTestCase):
    name = 'test_base02a'
    extra_config = ''

    scenarios = make_scenarios([
        ('file', dict(uri='file:')),

            

Reported by Pylint.

Class name "test_base02" doesn't conform to PascalCase naming style
Error

Line: 42 Column: 1

              from wtscenario import make_scenarios

# Test configuration strings.
class test_base02(wttest.WiredTigerTestCase):
    name = 'test_base02a'
    extra_config = ''

    scenarios = make_scenarios([
        ('file', dict(uri='file:')),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 53 Column: 5

                      ('table-lsm', dict(uri='table:', extra_config=',type=lsm')),
    ])

    def create_and_drop(self, confstr):
        name = self.uri + self.name
        confstr += self.extra_config
        self.pr('create_and_drop: ' + name + ": " + confstr)
        self.session.create(name, confstr)
        self.session.drop(name, None)

            

Reported by Pylint.

Comparison 'c != None' should be 'c is not None'
Error

Line: 86 Column: 64

                          for col in conf_col:
                for enc in conf_encoding:
                    conflist = [size, col, enc]
                    confstr = ",".join([c for c in conflist if c != None])
                    self.create_and_drop(confstr)

    def test_config_json(self):
        """
        Spot check various combinations of configuration options, using JSON format.

            

Reported by Pylint.

src/third_party/gperftools/dist/src/tests/debugallocation_test.cc
8 issues
Dereferencing 'x' after it is deallocated / released
Error

Line: 197 CWE codes: 416

              #if 1
  int* x = noopt(new int);
  delete x;
  int poisoned_x_value = *x;
  *x = 1;  // a dangling write.

  char* s = noopt(new char[FLAGS_max_free_queue_size]);
  // When we delete s, we push the storage that was previously allocated to x
  // off the end of the free queue.  At that point, the write to that memory

            

Reported by Cppcheck.

Dereferencing 'x' after it is deallocated / released
Error

Line: 198 CWE codes: 416

                int* x = noopt(new int);
  delete x;
  int poisoned_x_value = *x;
  *x = 1;  // a dangling write.

  char* s = noopt(new char[FLAGS_max_free_queue_size]);
  // When we delete s, we push the storage that was previously allocated to x
  // off the end of the free queue.  At that point, the write to that memory
  // will be detected.

            

Reported by Cppcheck.

Dereferencing 'x' after it is deallocated / released
Error

Line: 216 CWE codes: 416

              TEST(DebugAllocationTest, DanglingWriteAtExitTest) {
  int *x = noopt(new int);
  delete x;
  int old_x_value = *x;
  *x = 1;
  // verify that dangling writes are caught at program termination if the
  // corrupted block never got pushed off of the end of the free queue.
  IF_DEBUG_EXPECT_DEATH(exit(0), "Memory was written to after being freed.");
  *x = old_x_value;  // restore x so that the test can exit successfully.

            

Reported by Cppcheck.

Dereferencing 'x' after it is deallocated / released
Error

Line: 217 CWE codes: 416

                int *x = noopt(new int);
  delete x;
  int old_x_value = *x;
  *x = 1;
  // verify that dangling writes are caught at program termination if the
  // corrupted block never got pushed off of the end of the free queue.
  IF_DEBUG_EXPECT_DEATH(exit(0), "Memory was written to after being freed.");
  *x = old_x_value;  // restore x so that the test can exit successfully.
}

            

Reported by Cppcheck.

Dereferencing 'x' after it is deallocated / released
Error

Line: 227 CWE codes: 416

              TEST(DebugAllocationTest, StackTraceWithDanglingWriteAtExitTest) {
  int *x = noopt(new int);
  delete x;
  int old_x_value = *x;
  *x = 1;
  // verify that we also get a stack trace when we have a dangling write.
  // The " @ " is part of the stack trace output.
  IF_DEBUG_EXPECT_DEATH(exit(0), " @ .*main");
  *x = old_x_value;  // restore x so that the test can exit successfully.

            

Reported by Cppcheck.

Dereferencing 'x' after it is deallocated / released
Error

Line: 228 CWE codes: 416

                int *x = noopt(new int);
  delete x;
  int old_x_value = *x;
  *x = 1;
  // verify that we also get a stack trace when we have a dangling write.
  // The " @ " is part of the stack trace output.
  IF_DEBUG_EXPECT_DEATH(exit(0), " @ .*main");
  *x = old_x_value;  // restore x so that the test can exit successfully.
}

            

Reported by Cppcheck.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 305 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              // based on test program contributed by mikesart@gmail.com aka
// mikesart@valvesoftware.com. See issue-464.
TEST(DebugAllocationTest, ReallocAfterMemalign) {
  char stuff[50];
  memset(stuff, 0x11, sizeof(stuff));
  void *p = tc_memalign(16, sizeof(stuff));
  EXPECT_NE(p, NULL);
  memcpy(stuff, p, sizeof(stuff));


            

Reported by FlawFinder.

atoi - Unless checked, the resulting number can exceed the expected range
Security

Line: 330 Column: 19 CWE codes: 190
Suggestion: If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended)

                if (argc < 2) {
    test_to_run = -1;   // will never match
  } else {
    test_to_run = atoi(argv[1]);
  }
  return RUN_ALL_TESTS();
}

            

Reported by FlawFinder.

src/third_party/icu4c-57.1/source/common/ucnv.c
8 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 93 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              ucnv_openU (const UChar * name,
                         UErrorCode * err)
{
    char asciiName[UCNV_MAX_CONVERTER_NAME_LENGTH];

    if (err == NULL || U_FAILURE(*err))
        return NULL;
    if (name == NULL)
        return ucnv_open (NULL, err);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 136 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                              UConverterPlatform platform,
                UErrorCode * err)
{
    char myName[UCNV_MAX_CONVERTER_NAME_LENGTH];
    int32_t myNameLen;

    if (err == NULL || U_FAILURE (*err))
        return NULL;


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 477 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                                  int32_t length,
                    UErrorCode *err) {
    UAlignedMemory cloneBuffer[U_CNV_SAFECLONE_BUFFERSIZE / sizeof(UAlignedMemory) + 1];
    char chars[UCNV_ERROR_BUFFER_LENGTH];

    UConverter *clone;
    uint8_t *subChars;
    int32_t cloneSize, length8;


            

Reported by FlawFinder.

atol - Unless checked, the resulting number can exceed the expected range
Security

Line: 686 Column: 34 CWE codes: 190
Suggestion: If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended)

                      if (U_SUCCESS(*err) && standardName) {
            const char *ccsidStr = uprv_strchr(standardName, '-');
            if (ccsidStr) {
                ccsid = (int32_t)atol(ccsidStr+1);  /* +1 to skip '-' */
            }
        }
    }
    return ccsid;
}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1280 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  UBool converterSawEndOfInput, calledCallback;

    /* variables for m:n conversion */
    char replay[UCNV_EXT_MAX_BYTES];
    const char *realSource, *realSourceLimit;
    int32_t realSourceIndex;
    UBool realFlush;

    cnv=pArgs->converter;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1757 Column: 13 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
        /* if an overflow occurs, then get the preflighting length */
        if(*pErrorCode==U_BUFFER_OVERFLOW_ERROR) {
            char buffer[1024];

            destLimit=buffer+sizeof(buffer);
            do {
                dest=buffer;
                *pErrorCode=U_ZERO_ERROR;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 2451 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                   */
    if(*pErrorCode==U_BUFFER_OVERFLOW_ERROR || targetCapacity==0)
    {
        char targetBuffer[CHUNK_SIZE];

        targetLimit=targetBuffer+CHUNK_SIZE;
        do {
            *pErrorCode=U_ZERO_ERROR;
            myTarget=targetBuffer;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 2762 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  /* initial 0xa5 bytes: make sure that if we read <SIG_MAX_LEN
     * bytes we don't misdetect something 
     */
    char start[SIG_MAX_LEN]={ '\xa5', '\xa5', '\xa5', '\xa5', '\xa5' };
    int i = 0;

    if((pErrorCode==NULL) || U_FAILURE(*pErrorCode)){
        return NULL;
    }

            

Reported by FlawFinder.

src/mongo/db/ftdc/file_writer_test.cpp
8 issues
syntax error
Error

Line: 54

              class FTDCFileTest : public ServiceContextTest {};

// File Sanity check
TEST_F(FTDCFileTest, TestFileBasicMetadata) {
    unittest::TempDir tempdir("metrics_testpath");
    boost::filesystem::path p(tempdir.path());
    p /= kTestFile;

    deleteFileIfNeeded(p);

            

Reported by Cppcheck.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 71 Column: 22 CWE codes: 362

                  FTDCConfig config;
    FTDCFileWriter writer(&config);

    ASSERT_OK(writer.open(p));

    ASSERT_OK(writer.writeMetadata(doc1, Date_t()));
    ASSERT_OK(writer.writeMetadata(doc2, Date_t()));

    writer.close().transitional_ignore();

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 79 Column: 22 CWE codes: 362

                  writer.close().transitional_ignore();

    FTDCFileReader reader;
    ASSERT_OK(reader.open(p));

    ASSERT_OK(reader.hasNext());

    BSONObj doc1a = std::get<1>(reader.next());


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 116 Column: 22 CWE codes: 362

                  FTDCConfig config;
    FTDCFileWriter writer(&config);

    ASSERT_OK(writer.open(p));

    ASSERT_OK(writer.writeSample(doc1, Date_t()));
    ASSERT_OK(writer.writeSample(doc2, Date_t()));

    writer.close().transitional_ignore();

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 124 Column: 22 CWE codes: 362

                  writer.close().transitional_ignore();

    FTDCFileReader reader;
    ASSERT_OK(reader.open(p));

    ASSERT_OK(reader.hasNext());

    BSONObj doc1a = std::get<1>(reader.next());


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 154 Column: 27 CWE codes: 362

                        _writer(&_config) {
        deleteFileIfNeeded(_path);

        ASSERT_OK(_writer.open(_path));
    }

    ~FileTestTie() {
        validate();
    }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 178 Column: 30 CWE codes: 362

                      {
            FTDCFileReader reader;

            ASSERT_OK(reader.open(tempfile));

            auto sw = reader.hasNext();
            while (sw.isOK() && sw.getValue()) {
                sw = reader.hasNext();
            }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 304 Column: 22 CWE codes: 362

                  stream.close();

    FTDCFileReader reader;
    ASSERT_OK(reader.open(p));

    auto sw = reader.hasNext();
    ASSERT_NOT_OK(sw);
}


            

Reported by FlawFinder.

buildscripts/resmokeconfig/matrix_suites/tags.py
8 issues
Unable to import 'buildscripts.resmokelib.multiversionconstants'
Error

Line: 2 Column: 1

              """Dynamically Generated tags."""
from buildscripts.resmokelib.multiversionconstants import REQUIRES_FCV_TAG


# TODO SERVER-55857: Let this file be the single source of truth for tags. Remove dupe definitions.
# Base tag for all temporary multiversion exlcusions. Also can be used directly for
# exclusion from all suites.
class Tags(object):
    """Wrapper class for tags."""

            

Reported by Pylint.

TODO SERVER-55857: Let this file be the single source of truth for tags. Remove dupe definitions.
Error

Line: 5 Column: 3

              from buildscripts.resmokelib.multiversionconstants import REQUIRES_FCV_TAG


# TODO SERVER-55857: Let this file be the single source of truth for tags. Remove dupe definitions.
# Base tag for all temporary multiversion exlcusions. Also can be used directly for
# exclusion from all suites.
class Tags(object):
    """Wrapper class for tags."""


            

Reported by Pylint.

TODO SERVER-55857: move this value to remsoke's internal config and move generate_exclude_yaml to resmoke.
Error

Line: 16 Column: 3

                  # Base exclusion tag list.
    EXCLUDE_TAGS_TEMPLATE = f"{REQUIRES_FCV_TAG},multiversion_incompatible,{BACKPORT_REQUIRED_TAG}"

    # TODO SERVER-55857: move this value to remsoke's internal config and move generate_exclude_yaml to resmoke.
    # Call generate_exclude_yaml() when fetching fixture files so we only reach out to github once and
    # call `mongo --version` once.
    EXCLUDE_TAGS_FILE = "multiversion_exclude_tags.yml"

    # TODO SERVER=55857: move to resmoke and get list of multiversion suites from resmoke.py

            

Reported by Pylint.

TODO SERVER=55857: move to resmoke and get list of multiversion suites from resmoke.py
Error

Line: 21 Column: 3

                  # call `mongo --version` once.
    EXCLUDE_TAGS_FILE = "multiversion_exclude_tags.yml"

    # TODO SERVER=55857: move to resmoke and get list of multiversion suites from resmoke.py
    MULTIVERSION_CONFIG_KEY = "use_in_multiversion"

            

Reported by Pylint.

Too few public methods (0/2)
Error

Line: 8 Column: 1

              # TODO SERVER-55857: Let this file be the single source of truth for tags. Remove dupe definitions.
# Base tag for all temporary multiversion exlcusions. Also can be used directly for
# exclusion from all suites.
class Tags(object):
    """Wrapper class for tags."""

    BACKPORT_REQUIRED_TAG = "backport_required_multiversion"

    # Base exclusion tag list.

            

Reported by Pylint.

Class 'Tags' inherits from object, can be safely removed from bases in python3
Error

Line: 8 Column: 1

              # TODO SERVER-55857: Let this file be the single source of truth for tags. Remove dupe definitions.
# Base tag for all temporary multiversion exlcusions. Also can be used directly for
# exclusion from all suites.
class Tags(object):
    """Wrapper class for tags."""

    BACKPORT_REQUIRED_TAG = "backport_required_multiversion"

    # Base exclusion tag list.

            

Reported by Pylint.

Line too long (112/100)
Error

Line: 16 Column: 1

                  # Base exclusion tag list.
    EXCLUDE_TAGS_TEMPLATE = f"{REQUIRES_FCV_TAG},multiversion_incompatible,{BACKPORT_REQUIRED_TAG}"

    # TODO SERVER-55857: move this value to remsoke's internal config and move generate_exclude_yaml to resmoke.
    # Call generate_exclude_yaml() when fetching fixture files so we only reach out to github once and
    # call `mongo --version` once.
    EXCLUDE_TAGS_FILE = "multiversion_exclude_tags.yml"

    # TODO SERVER=55857: move to resmoke and get list of multiversion suites from resmoke.py

            

Reported by Pylint.

Line too long (102/100)
Error

Line: 17 Column: 1

                  EXCLUDE_TAGS_TEMPLATE = f"{REQUIRES_FCV_TAG},multiversion_incompatible,{BACKPORT_REQUIRED_TAG}"

    # TODO SERVER-55857: move this value to remsoke's internal config and move generate_exclude_yaml to resmoke.
    # Call generate_exclude_yaml() when fetching fixture files so we only reach out to github once and
    # call `mongo --version` once.
    EXCLUDE_TAGS_FILE = "multiversion_exclude_tags.yml"

    # TODO SERVER=55857: move to resmoke and get list of multiversion suites from resmoke.py
    MULTIVERSION_CONFIG_KEY = "use_in_multiversion"

            

Reported by Pylint.

src/third_party/gperftools/dist/src/internal_logging.cc
8 issues
printf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 175 Column: 24 CWE codes: 134
Suggestion: Use a constant for the format specification

              
}  // end tcmalloc namespace

void TCMalloc_Printer::printf(const char* format, ...) {
  if (left_ > 0) {
    va_list ap;
    va_start(ap, format);
    const int r = perftools_vsnprintf(buf_, left_, format, ap);
    va_end(ap);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 53 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static SpinLock crash_lock(base::LINKER_INITIALIZED);
static bool crashed = false;
static const int kStatsBufferSize = 16 << 10;
static char stats_buffer[kStatsBufferSize] = { 0 };

namespace tcmalloc {

static void WriteMessage(const char* msg, int length) {
  write(STDERR_FILENO, msg, length);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 73 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                static const int kBufSize = 200;
  char* p_;
  char* end_;
  char buf_[kBufSize];
};

void Log(LogMode mode, const char* filename, int line,
         LogItem a, LogItem b, LogItem c, LogItem d) {
  Logger state;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 154 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                if (end_ - p_ < n) {
    return false;
  } else {
    memcpy(p_, str, n);
    p_ += n;
    return true;
  }
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 162 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
bool Logger::AddNum(uint64_t num, int base) {
  static const char kDigits[] = "0123456789abcdef";
  char space[22];  // more than enough for 2^64 in smallest supported base (10)
  char* end = space + sizeof(space);
  char* pos = end;
  do {
    pos--;
    *pos = kDigits[num % base];

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 81 Column: 26 CWE codes: 126

                Logger state;
  state.p_ = state.buf_;
  state.end_ = state.buf_ + sizeof(state.buf_);
  state.AddStr(filename, strlen(filename))
      && state.AddStr(":", 1)
      && state.AddNum(line, 10)
      && state.AddStr("]", 1)
      && state.Add(a)
      && state.Add(b)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 115 Column: 41 CWE codes: 126

                (*log_message_writer)(state.buf_, msglen);
  if (first_crash && mode == kCrashWithStats) {
    MallocExtension::instance()->GetStats(stats_buffer, kStatsBufferSize);
    (*log_message_writer)(stats_buffer, strlen(stats_buffer));
  }

  abort();
}


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 130 Column: 34 CWE codes: 126

              
  switch (item.tag_) {
    case LogItem::kStr:
      return AddStr(item.u_.str, strlen(item.u_.str));
    case LogItem::kUnsigned:
      return AddNum(item.u_.unum, 10);
    case LogItem::kSigned:
      if (item.u_.snum < 0) {
        // The cast to uint64_t is intentionally before the negation

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/cxx.py
8 issues
Redefining name 'SCons' from outer scope (line 37)
Error

Line: 63 Column: 5

                  Add Builders and construction variables for Visual Age C++ compilers
    to an Environment.
    """
    import SCons.Tool
    import SCons.Tool.cc
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    for suffix in CXXSuffixes:
        static_obj.add_action(suffix, SCons.Defaults.CXXAction)

            

Reported by Pylint.

Reimport 'SCons.Tool' (imported line 37)
Error

Line: 63 Column: 5

                  Add Builders and construction variables for Visual Age C++ compilers
    to an Environment.
    """
    import SCons.Tool
    import SCons.Tool.cc
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    for suffix in CXXSuffixes:
        static_obj.add_action(suffix, SCons.Defaults.CXXAction)

            

Reported by Pylint.

Line too long (114/100)
Error

Line: 33 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/cxx.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os.path

import SCons.Tool
import SCons.Defaults

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 47 Column: 1

              if SCons.Util.case_sensitive_suffixes('.c', '.C'):
    CXXSuffixes.append('.C')

def iscplusplus(source):
    if not source:
        # Source might be None for unusual cases like SConf.
        return 0
    for s in source:
        if s.sources:

            

Reported by Pylint.

Variable name "s" doesn't conform to snake_case naming style
Error

Line: 51 Column: 9

                  if not source:
        # Source might be None for unusual cases like SConf.
        return 0
    for s in source:
        if s.sources:
            ext = os.path.splitext(str(s.sources[0]))[1]
            if ext in CXXSuffixes:
                return 1
    return 0

            

Reported by Pylint.

Import outside toplevel (SCons.Tool)
Error

Line: 63 Column: 5

                  Add Builders and construction variables for Visual Age C++ compilers
    to an Environment.
    """
    import SCons.Tool
    import SCons.Tool.cc
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    for suffix in CXXSuffixes:
        static_obj.add_action(suffix, SCons.Defaults.CXXAction)

            

Reported by Pylint.

Import outside toplevel (SCons.Tool.cc)
Error

Line: 64 Column: 5

                  to an Environment.
    """
    import SCons.Tool
    import SCons.Tool.cc
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    for suffix in CXXSuffixes:
        static_obj.add_action(suffix, SCons.Defaults.CXXAction)
        shared_obj.add_action(suffix, SCons.Defaults.ShCXXAction)

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 93 Column: 1

              
    env['CXXFILESUFFIX'] = '.cc'

def exists(env):
    return env.Detect(env.get('CXX', compilers))

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

site_scons/mongo/toolchain.py
8 issues
Unable to import 'SCons'
Error

Line: 5 Column: 1

              
import subprocess

import SCons

# Helper functions for generic toolchain things go here


def get_toolchain_ver(env, tool):

            

Reported by Pylint.

Access to a protected member _subproc of a client class
Error

Line: 16 Column: 16

                  verstr = "version unknown"
    proc = None
    if env.ToolchainIs('clang', 'gcc'):
        proc = SCons.Action._subproc(env, env.subst("${%s} --version" % tool),
                                     stdout=subprocess.PIPE, stderr='devnull', stdin='devnull',
                                     universal_newlines=True, error='raise', shell=True)
        verstr = proc.stdout.readline()

    elif env.ToolchainIs('msvc') and env.TargetOSIs('windows'):

            

Reported by Pylint.

Function call with shell=True parameter identified, possible security issue.
Security injection

Line: 18
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b604_any_other_function_with_shell_equals_true.html

                  if env.ToolchainIs('clang', 'gcc'):
        proc = SCons.Action._subproc(env, env.subst("${%s} --version" % tool),
                                     stdout=subprocess.PIPE, stderr='devnull', stdin='devnull',
                                     universal_newlines=True, error='raise', shell=True)
        verstr = proc.stdout.readline()

    elif env.ToolchainIs('msvc') and env.TargetOSIs('windows'):
        proc = SCons.Action._subproc(env, env.subst("${%s}" % tool), stdout='devnull',
                                     stderr=subprocess.PIPE, stdin='devnull',

            

Reported by Bandit.

Access to a protected member _subproc of a client class
Error

Line: 22 Column: 16

                      verstr = proc.stdout.readline()

    elif env.ToolchainIs('msvc') and env.TargetOSIs('windows'):
        proc = SCons.Action._subproc(env, env.subst("${%s}" % tool), stdout='devnull',
                                     stderr=subprocess.PIPE, stdin='devnull',
                                     universal_newlines=True, error='raise', shell=True)
        verstr = proc.stderr.readline()

    # If we started a process, we should drain its stdout/stderr and wait for

            

Reported by Pylint.

Function call with shell=True parameter identified, possible security issue.
Security injection

Line: 24
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b604_any_other_function_with_shell_equals_true.html

                  elif env.ToolchainIs('msvc') and env.TargetOSIs('windows'):
        proc = SCons.Action._subproc(env, env.subst("${%s}" % tool), stdout='devnull',
                                     stderr=subprocess.PIPE, stdin='devnull',
                                     universal_newlines=True, error='raise', shell=True)
        verstr = proc.stderr.readline()

    # If we started a process, we should drain its stdout/stderr and wait for
    # it to end.
    if proc:

            

Reported by Bandit.

Missing module docstring
Error

Line: 1 Column: 1

              # -*- mode: python; -*-

import subprocess

import SCons

# Helper functions for generic toolchain things go here



            

Reported by Pylint.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 3
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              # -*- mode: python; -*-

import subprocess

import SCons

# Helper functions for generic toolchain things go here



            

Reported by Bandit.

Missing function or method docstring
Error

Line: 10 Column: 1

              # Helper functions for generic toolchain things go here


def get_toolchain_ver(env, tool):
    # By default we don't know the version of each tool, and only report what
    # command gets executed (gcc vs /opt/mongodbtoolchain/bin/gcc).
    verstr = "version unknown"
    proc = None
    if env.ToolchainIs('clang', 'gcc'):

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_backup15.py
8 issues
Attribute 'home' defined outside __init__
Error

Line: 89 Column: 9

              
    def test_backup15(self):
        os.mkdir(self.bkp_home)
        self.home = self.bkp_home
        self.session.create(self.uri, "key_format=S,value_format=S")

        self.setup_directories(self.home_incr, self.home_full)

        self.pr('*** Add data, checkpoint, take backups and validate ***')

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Missing class docstring
Error

Line: 33 Column: 1

              
# test_backup15.py
# Test cursor backup with a block-based incremental cursor.
class test_backup15(backup_base):
    bkp_home = "WT_BLOCK"
    bkup_id=0
    conn_config='cache_size=1G,log=(enabled,file_max=100K)'
    logmax="100K"
    max_iteration=5

            

Reported by Pylint.

Class name "test_backup15" doesn't conform to PascalCase naming style
Error

Line: 33 Column: 1

              
# test_backup15.py
# Test cursor backup with a block-based incremental cursor.
class test_backup15(backup_base):
    bkp_home = "WT_BLOCK"
    bkup_id=0
    conn_config='cache_size=1G,log=(enabled,file_max=100K)'
    logmax="100K"
    max_iteration=5

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 60 Column: 5

                  #
    # Add data to the given uri.
    #
    def add_complex_data(self, uri):
        c = self.session.open_cursor(uri, None, None)
        # The first time we want to add in a lot of data. Then after that we want to
        # rapidly change a single key to create a hotspot in one block.
        if self.savefirst < 2:
            nops = self.nops

            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 61 Column: 9

                  # Add data to the given uri.
    #
    def add_complex_data(self, uri):
        c = self.session.open_cursor(uri, None, None)
        # The first time we want to add in a lot of data. Then after that we want to
        # rapidly change a single key to create a hotspot in one block.
        if self.savefirst < 2:
            nops = self.nops
        else:

            

Reported by Pylint.

Comparison 'self.initial_backup == False' should be 'self.initial_backup is False' if checking for the singleton value False, or 'not self.initial_backup' if testing for falsiness
Error

Line: 84 Column: 12

                      # Increase the multiplier so that later calls insert unique items.
        self.mult += 1
        # Increase the counter so that later backups have unique ids.
        if self.initial_backup == False:
            self.bkup_id += 1

    def test_backup15(self):
        os.mkdir(self.bkp_home)
        self.home = self.bkp_home

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 87 Column: 5

                      if self.initial_backup == False:
            self.bkup_id += 1

    def test_backup15(self):
        os.mkdir(self.bkp_home)
        self.home = self.bkp_home
        self.session.create(self.uri, "key_format=S,value_format=S")

        self.setup_directories(self.home_incr, self.home_full)

            

Reported by Pylint.