The following issues were found

src/third_party/wiredtiger/test/suite/test_rollback_to_stable24.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_rollback_to_stable24.py
# Exercise a recno-counting bug in column store.
#

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_rollback_to_stable24.py
# Exercise a recno-counting bug in column store.
#

            

Reported by Pylint.

Redefining built-in 'format'
Error

Line: 74 Column: 9

                  def test_rollback_to_stable24(self):
        # Create a table without logging.
        uri = "table:rollback_to_stable24"
        format = 'key_format={},value_format=S'.format(self.key_format)
        self.session.create(uri, format + ', log=(enabled=false)')

        # Pin oldest timestamp to 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10))


            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_rollback_to_stable24.py
# Exercise a recno-counting bug in column store.
#

            

Reported by Pylint.

Class name "test_rollback_to_stable24" doesn't conform to PascalCase naming style
Error

Line: 60 Column: 1

              #
# Run this test on rows as well as columns to help make sure the test itself is valid (and
# stays so over time...)
class test_rollback_to_stable24(wttest.WiredTigerTestCase):
    session_config = 'isolation=snapshot'
    conn_config = 'in_memory=false'

    key_format_values = [
        ('column', dict(key_format='r')),

            

Reported by Pylint.

Missing class docstring
Error

Line: 60 Column: 1

              #
# Run this test on rows as well as columns to help make sure the test itself is valid (and
# stays so over time...)
class test_rollback_to_stable24(wttest.WiredTigerTestCase):
    session_config = 'isolation=snapshot'
    conn_config = 'in_memory=false'

    key_format_values = [
        ('column', dict(key_format='r')),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 71 Column: 5

              
    scenarios = make_scenarios(key_format_values)

    def test_rollback_to_stable24(self):
        # Create a table without logging.
        uri = "table:rollback_to_stable24"
        format = 'key_format={},value_format=S'.format(self.key_format)
        self.session.create(uri, format + ', log=(enabled=false)')


            

Reported by Pylint.

Variable name "s" doesn't conform to snake_case naming style
Error

Line: 88 Column: 9

                      value_c = "ccccc" * 100
        value_d = "ddddd" * 100

        s = self.conn.open_session()
        cursor = s.open_cursor(uri)

        # Write some keys at time 10.
        s.begin_transaction()
        cursor[1] = value_a

            

Reported by Pylint.

Variable name "v" doesn't conform to snake_case naming style
Error

Line: 110 Column: 9

                      evict_cursor = self.session.open_cursor(uri, None, "debug=(release_evict)")
        s.begin_transaction()
        # Search the key to evict it.
        v = evict_cursor[1]
        self.assertEqual(v, value_a)
        self.assertEqual(evict_cursor.reset(), 0)
        s.rollback_transaction()
        evict_cursor.close()


            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_rollback_to_stable08.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

from wiredtiger import stat
from wtdataset import SimpleDataSet
from wtscenario import make_scenarios
from test_rollback_to_stable01 import test_rollback_to_stable_base

# test_rollback_to_stable08.py

            

Reported by Pylint.

An attribute defined in wttest line 401 hides this method
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Undefined variable 'wttest'
Error

Line: 132 Column: 5

                          self.assertEqual(pages_visited, 0)

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Class name "test_rollback_to_stable08" doesn't conform to PascalCase naming style
Error

Line: 37 Column: 1

              # test_rollback_to_stable08.py
# Test that rollback to stable does not abort updates when the stable timestamp is
# set to the latest commit.
class test_rollback_to_stable08(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing class docstring
Error

Line: 37 Column: 1

              # test_rollback_to_stable08.py
# Test that rollback to stable does not abort updates when the stable timestamp is
# set to the latest commit.
class test_rollback_to_stable08(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 65 Column: 5

                          config += ',log=(enabled),in_memory=false'
        return config

    def test_rollback_to_stable(self):
        nrows = 10000

        # Create a table without logging.
        uri = "table:rollback_to_stable08"
        ds = SimpleDataSet(

            

Reported by Pylint.

Variable name "ds" doesn't conform to snake_case naming style
Error

Line: 70 Column: 9

              
        # Create a table without logging.
        uri = "table:rollback_to_stable08"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +

            

Reported by Pylint.

Line too long (101/100)
Error

Line: 71 Column: 1

                      # Create a table without logging.
        uri = "table:rollback_to_stable08"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +
            ',stable_timestamp=' + self.timestamp_str(10))

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_rollback_to_stable06.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

from wiredtiger import stat
from wtdataset import SimpleDataSet
from wtscenario import make_scenarios
from test_rollback_to_stable01 import test_rollback_to_stable_base

# test_rollback_to_stable06.py

            

Reported by Pylint.

An attribute defined in wttest line 401 hides this method
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Undefined variable 'wttest'
Error

Line: 126 Column: 5

                          self.assertGreaterEqual(upd_aborted + hs_removed + keys_removed, nrows * 4)

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Class name "test_rollback_to_stable06" doesn't conform to PascalCase naming style
Error

Line: 37 Column: 1

              # test_rollback_to_stable06.py
# Test that rollback to stable removes all keys when the stable timestamp is earlier than
# all commit timestamps.
class test_rollback_to_stable06(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing class docstring
Error

Line: 37 Column: 1

              # test_rollback_to_stable06.py
# Test that rollback to stable removes all keys when the stable timestamp is earlier than
# all commit timestamps.
class test_rollback_to_stable06(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 65 Column: 5

                          config += ',log=(enabled),in_memory=false'
        return config

    def test_rollback_to_stable(self):
        nrows = 1000

        # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(

            

Reported by Pylint.

Variable name "ds" doesn't conform to snake_case naming style
Error

Line: 70 Column: 9

              
        # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +

            

Reported by Pylint.

Line too long (101/100)
Error

Line: 71 Column: 1

                      # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +
            ',stable_timestamp=' + self.timestamp_str(10))

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_hs22.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_hs22.py
# Test the case that out of order timestamp
# update is followed by a tombstone.

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_hs22.py
# Test the case that out of order timestamp
# update is followed by a tombstone.

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtscenario import make_scenarios

# test_hs22.py
# Test the case that out of order timestamp
# update is followed by a tombstone.

            

Reported by Pylint.

Class name "test_hs22" doesn't conform to PascalCase naming style
Error

Line: 35 Column: 1

              # test_hs22.py
# Test the case that out of order timestamp
# update is followed by a tombstone.
class test_hs22(wttest.WiredTigerTestCase):
    conn_config = 'cache_size=50MB'
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r', key1=1, key2=2)),

            

Reported by Pylint.

Missing class docstring
Error

Line: 35 Column: 1

              # test_hs22.py
# Test the case that out of order timestamp
# update is followed by a tombstone.
class test_hs22(wttest.WiredTigerTestCase):
    conn_config = 'cache_size=50MB'
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r', key1=1, key2=2)),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 46 Column: 5

              
    scenarios = make_scenarios(key_format_values)

    def test_onpage_out_of_order_timestamp_update(self):
        uri = 'table:test_hs22'
        self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
        cursor = self.session.open_cursor(uri)
        self.conn.set_timestamp(
            'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))

            

Reported by Pylint.

Line too long (103/100)
Error

Line: 51 Column: 1

                      self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
        cursor = self.session.open_cursor(uri)
        self.conn.set_timestamp(
            'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))

        key1 = self.key1
        key2 = self.key2

        value1 = 'a'

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 104 Column: 5

                      self.assertEqual(cursor[key1], value2)
        self.session.rollback_transaction()

    def test_out_of_order_timestamp_update_newer_than_tombstone(self):
        uri = 'table:test_hs22'
        self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
        cursor = self.session.open_cursor(uri)
        self.conn.set_timestamp(
            'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))

            

Reported by Pylint.

Line too long (103/100)
Error

Line: 109 Column: 1

                      self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
        cursor = self.session.open_cursor(uri)
        self.conn.set_timestamp(
            'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))

        key1 = self.key1
        key2 = self.key2

        value1 = 'a'

            

Reported by Pylint.

src/third_party/wiredtiger/test/format/salvage.c
10 issues
system - This causes a new program to execute and is difficult to use safely
Security

Line: 96 Column: 16 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

                  /*
     * Save a copy of the corrupted file so we can replay the salvage step as necessary.
     */
    if ((ret = system(copycmd)) != 0)
        testutil_die(ret, "salvage corrupt copy step failed");

    return (1);
}


            

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 135 Column: 16 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

                  len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

    /* Salvage, then verify. */
    wts_open(g.home, &conn, &session, true);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 43 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  wt_off_t offset;
    size_t len, nw;
    int fd, ret;
    char copycmd[2 * 1024], path[1024];
    const char *smash;

    /*
     * If it's a single Btree file (not LSM), open the file, and corrupt roughly 2% of the file at a
     * random spot, including the beginning of the file and overlapping the end.

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 54 Column: 15 CWE codes: 362

                   * source is a table, we're looking for "wt.wt".
     */
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s", g.home, WT_NAME));
    if ((fd = open(path, O_RDWR)) != -1) {
        testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
          "cp %s/%s %s/SALVAGE.copy/%s.corrupted", g.home, WT_NAME, g.home, WT_NAME));
        goto found;
    }
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s.wt", g.home, WT_NAME));

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 60 Column: 15 CWE codes: 362

                      goto found;
    }
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s.wt", g.home, WT_NAME));
    if ((fd = open(path, O_RDWR)) != -1) {
        testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
          "cp %s/%s.wt %s/SALVAGE.copy/%s.wt.corrupted", g.home, WT_NAME, g.home, WT_NAME));
        goto found;
    }
    return (0);

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 74 Column: 15 CWE codes: 362

                  offset = mmrand(NULL, 0, (u_int)sb.st_size);
    len = (size_t)(20 + (sb.st_size / 100) * 2);
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/SALVAGE.corrupt", g.home));
    if ((fp = fopen(path, "w")) == NULL)
        testutil_die(errno, "salvage-corrupt: open: %s", path);
    (void)fprintf(fp, "salvage-corrupt: offset %" PRIuMAX ", length %" WT_SIZET_FMT "\n",
      (uintmax_t)offset, len);
    fclose_and_clear(&fp);


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 85 Column: 29 CWE codes: 126

              
    smash = "!!! memory corrupted by format to test salvage ";
    for (; len > 0; len -= nw) {
        nw = (size_t)(len > strlen(smash) ? strlen(smash) : len);
        if (write(fd, smash, nw) == -1)
            testutil_die(errno, "salvage-corrupt: write");
    }

    if (close(fd) == -1)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 85 Column: 45 CWE codes: 126

              
    smash = "!!! memory corrupted by format to test salvage ";
    for (; len > 0; len -= nw) {
        nw = (size_t)(len > strlen(smash) ? strlen(smash) : len);
        if (write(fd, smash, nw) == -1)
            testutil_die(errno, "salvage-corrupt: write");
    }

    if (close(fd) == -1)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 132 Column: 11 CWE codes: 126

                  track("salvage", 0ULL, NULL);

    /* Save a copy of the interesting files so we can replay the salvage step as necessary. */
    len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 132 Column: 28 CWE codes: 126

                  track("salvage", 0ULL, NULL);

    /* Save a copy of the interesting files so we can replay the salvage step as necessary. */
    len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

            

Reported by FlawFinder.

src/third_party/asio-master/asio/include/asio/basic_socket.hpp
10 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 113 Column: 25 CWE codes: 362

                  : basic_io_object<ASIO_SVC_T>(io_context)
  {
    asio::error_code ec;
    this->get_service().open(this->get_implementation(), protocol, ec);
    asio::detail::throw_error(ec, "open");
  }

  /// Construct a basic_socket, opening it and binding it to the given local
  /// endpoint.

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 138 Column: 25 CWE codes: 362

                {
    asio::error_code ec;
    const protocol_type protocol = endpoint.protocol();
    this->get_service().open(this->get_implementation(), protocol, ec);
    asio::detail::throw_error(ec, "open");
    this->get_service().bind(this->get_implementation(), endpoint, ec);
    asio::detail::throw_error(ec, "bind");
  }


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 326 Column: 8 CWE codes: 362

                 * socket.open(asio::ip::tcp::v4());
   * @endcode
   */
  void open(const protocol_type& protocol = protocol_type())
  {
    asio::error_code ec;
    this->get_service().open(this->get_implementation(), protocol, ec);
    asio::detail::throw_error(ec, "open");
  }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 329 Column: 25 CWE codes: 362

                void open(const protocol_type& protocol = protocol_type())
  {
    asio::error_code ec;
    this->get_service().open(this->get_implementation(), protocol, ec);
    asio::detail::throw_error(ec, "open");
  }

  /// Open the socket using the specified protocol.
  /**

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 352 Column: 21 CWE codes: 362

                 * }
   * @endcode
   */
  ASIO_SYNC_OP_VOID open(const protocol_type& protocol,
      asio::error_code& ec)
  {
    this->get_service().open(this->get_implementation(), protocol, ec);
    ASIO_SYNC_OP_VOID_RETURN(ec);
  }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 355 Column: 25 CWE codes: 362

                ASIO_SYNC_OP_VOID open(const protocol_type& protocol,
      asio::error_code& ec)
  {
    this->get_service().open(this->get_implementation(), protocol, ec);
    ASIO_SYNC_OP_VOID_RETURN(ec);
  }

  /// Assign an existing native socket to the socket.
  /*

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 759 Column: 27 CWE codes: 362

                  asio::error_code ec;
    if (!is_open())
    {
      this->get_service().open(this->get_implementation(),
          peer_endpoint.protocol(), ec);
      asio::detail::throw_error(ec, "connect");
    }
    this->get_service().connect(this->get_implementation(), peer_endpoint, -1, ec);
    asio::detail::throw_error(ec, "connect");

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 800 Column: 27 CWE codes: 362

                {
    if (!is_open())
    {
      this->get_service().open(this->get_implementation(),
            peer_endpoint.protocol(), ec);
      if (ec)
      {
        ASIO_SYNC_OP_VOID_RETURN(ec);
      }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 850 Column: 27 CWE codes: 362

                {
    if (!is_open())
    {
      this->get_service().open(this->get_implementation(),
            peer_endpoint.protocol(), ec);
      if (ec)
      {
        ASIO_SYNC_OP_VOID_RETURN(ec);
      }

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 923 Column: 27 CWE codes: 362

                  {
      asio::error_code ec;
      const protocol_type protocol = peer_endpoint.protocol();
      this->get_service().open(this->get_implementation(), protocol, ec);
      if (ec)
      {
        async_completion<ConnectHandler,
          void (asio::error_code)> init(handler);


            

Reported by FlawFinder.

src/third_party/abseil-cpp-master/abseil-cpp/absl/types/compare.h
10 issues
equal - Function does not check the second iterator for over-read conditions
Security

Line: 74 Column: 16 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              
enum class eq : value_type {
  equal = 0,
  equivalent = equal,
  nonequal = 1,
  nonequivalent = nonequal,
};

enum class ord : value_type { less = -1, greater = 1 };

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 123 Column: 38 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              
template <typename T>
struct strong_equality_base {
  ABSL_COMPARE_INLINE_BASECLASS_DECL(equal);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(nonequal);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(equivalent);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(nonequivalent);
};


            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 147 Column: 38 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              template <typename T>
struct strong_ordering_base {
  ABSL_COMPARE_INLINE_BASECLASS_DECL(less);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(equal);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(equivalent);
  ABSL_COMPARE_INLINE_BASECLASS_DECL(greater);
};

}  // namespace compare_internal

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 205 Column: 54 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                friend struct compare_internal::strong_equality_base<strong_equality>;

 public:
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_equality, equal);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_equality, nonequal);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_equality, equivalent);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_equality, nonequivalent);

  // Conversion

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 244 Column: 43 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

               private:
  compare_internal::value_type value_;
};
ABSL_COMPARE_INLINE_INIT(strong_equality, equal, compare_internal::eq::equal);
ABSL_COMPARE_INLINE_INIT(strong_equality, nonequal,
                         compare_internal::eq::nonequal);
ABSL_COMPARE_INLINE_INIT(strong_equality, equivalent,
                         compare_internal::eq::equivalent);
ABSL_COMPARE_INLINE_INIT(strong_equality, nonequivalent,

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 244 Column: 72 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

               private:
  compare_internal::value_type value_;
};
ABSL_COMPARE_INLINE_INIT(strong_equality, equal, compare_internal::eq::equal);
ABSL_COMPARE_INLINE_INIT(strong_equality, nonequal,
                         compare_internal::eq::nonequal);
ABSL_COMPARE_INLINE_INIT(strong_equality, equivalent,
                         compare_internal::eq::equivalent);
ABSL_COMPARE_INLINE_INIT(strong_equality, nonequivalent,

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 447 Column: 54 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

              
 public:
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_ordering, less);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_ordering, equal);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_ordering, equivalent);
  ABSL_COMPARE_INLINE_SUBCLASS_DECL(strong_ordering, greater);

  // Conversions
  constexpr operator weak_equality() const noexcept {  // NOLINT

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 457 Column: 43 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                                     : weak_equality::nonequivalent;
  }
  constexpr operator strong_equality() const noexcept {  // NOLINT
    return value_ == 0 ? strong_equality::equal : strong_equality::nonequal;
  }
  constexpr operator partial_ordering() const noexcept {  // NOLINT
    return value_ == 0 ? partial_ordering::equivalent
                       : (value_ < 0 ? partial_ordering::less
                                     : partial_ordering::greater);

            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 531 Column: 43 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                compare_internal::value_type value_;
};
ABSL_COMPARE_INLINE_INIT(strong_ordering, less, compare_internal::ord::less);
ABSL_COMPARE_INLINE_INIT(strong_ordering, equal, compare_internal::eq::equal);
ABSL_COMPARE_INLINE_INIT(strong_ordering, equivalent,
                         compare_internal::eq::equivalent);
ABSL_COMPARE_INLINE_INIT(strong_ordering, greater,
                         compare_internal::ord::greater);


            

Reported by FlawFinder.

equal - Function does not check the second iterator for over-read conditions
Security

Line: 531 Column: 72 CWE codes: 126
Suggestion: This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it

                compare_internal::value_type value_;
};
ABSL_COMPARE_INLINE_INIT(strong_ordering, less, compare_internal::ord::less);
ABSL_COMPARE_INLINE_INIT(strong_ordering, equal, compare_internal::eq::equal);
ABSL_COMPARE_INLINE_INIT(strong_ordering, equivalent,
                         compare_internal::eq::equivalent);
ABSL_COMPARE_INLINE_INIT(strong_ordering, greater,
                         compare_internal::ord::greater);


            

Reported by FlawFinder.

src/third_party/abseil-cpp-master/abseil-cpp/absl/synchronization/mutex.cc
10 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 348 Column: 5 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

                  e->invariant = nullptr;
    e->arg = nullptr;
    e->log = false;
    strcpy(e->name, name);  // NOLINT(runtime/printf)
    e->next = synch_event[h];
    AtomicSetBits(addr, bits, lockbit);
    synch_event[h] = e;
  } else {
    e->refcount++;      // for return value

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 315 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                bool log;             // logging turned on

  // Constant after initialization
  char name[1];         // actually longer---NUL-terminated string
} * synch_event[kNSynchEvent] ABSL_GUARDED_BY(synch_event_mu);

// Ensure that the object at "addr" has a SynchEvent struct associated with it,
// set "bits" in the word there (waiting until lockbit is clear before doing
// so), and return a refcounted reference that will remain valid until

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 430 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  int n = absl::GetStackTrace(pcs, ABSL_ARRAYSIZE(pcs), 1);
    // A buffer with enough space for the ASCII for all the PCs, even on a
    // 64-bit machine.
    char buffer[ABSL_ARRAYSIZE(pcs) * 24];
    int pos = snprintf(buffer, sizeof (buffer), " @");
    for (int i = 0; i != n; i++) {
      pos += snprintf(&buffer[pos], sizeof (buffer) - pos, " %p", pcs[i]);
    }
    ABSL_RAW_LOG(INFO, "%s%p %s %s", event_properties[ev].msg, obj,

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1273 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static char *StackString(void **pcs, int n, char *buf, int maxlen,
                         bool symbolize) {
  static const int kSymLen = 200;
  char sym[kSymLen];
  int len = 0;
  for (int i = 0; i != n; i++) {
    if (symbolize) {
      if (!symbolizer(pcs[i], sym, kSymLen)) {
        sym[0] = '\0';

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1303 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              // Buffers required to report a deadlock.
// We do not allocate them on stack to avoid large stack frame.
struct DeadlockReportBuffers {
  char buf[6100];
  GraphId path[kMaxDeadlockPathLen];
};

struct ScopedDeadlockReportBuffers {
  ScopedDeadlockReportBuffers() {

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 340 Column: 16 CWE codes: 126

                  if (name == nullptr) {
      name = "";
    }
    size_t l = strlen(name);
    e = reinterpret_cast<SynchEvent *>(
        base_internal::LowLevelAlloc::Alloc(sizeof(*e) + l));
    e->refcount = 2;    // one for return value, one for linked list
    e->masked_addr = base_internal::HidePtr(addr);
    e->invariant = nullptr;

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1286 Column: 12 CWE codes: 126

                  } else {
      snprintf(buf + len, maxlen - len, " %p", pcs[i]);
    }
    len += strlen(&buf[len]);
  }
  return buf;
}

static char *CurrentStackString(char *buf, int maxlen, bool symbolize) {

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1374 Column: 35 CWE codes: 126

                      void* pr = deadlock_graph->Ptr(all_locks->locks[j].id);
        if (pr != nullptr) {
          snprintf(b->buf + len, sizeof (b->buf) - len, " %p", pr);
          len += static_cast<int>(strlen(&b->buf[len]));
        }
      }
      ABSL_RAW_LOG(ERROR,
                   "Acquiring absl::Mutex %p while holding %s; a cycle in the "
                   "historical lock ordering graph has been observed",

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1392 Column: 44 CWE codes: 126

                      int depth = deadlock_graph->GetStackTrace(id, &stack);
        snprintf(b->buf, sizeof(b->buf),
                 "mutex@%p stack: ", static_cast<void *>(path_mu));
        StackString(stack, depth, b->buf + strlen(b->buf),
                    static_cast<int>(sizeof(b->buf) - strlen(b->buf)),
                    symbolize);
        ABSL_RAW_LOG(ERROR, "%s", b->buf);
      }
      if (synch_deadlock_detection.load(std::memory_order_acquire) ==

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1393 Column: 55 CWE codes: 126

                      snprintf(b->buf, sizeof(b->buf),
                 "mutex@%p stack: ", static_cast<void *>(path_mu));
        StackString(stack, depth, b->buf + strlen(b->buf),
                    static_cast<int>(sizeof(b->buf) - strlen(b->buf)),
                    symbolize);
        ABSL_RAW_LOG(ERROR, "%s", b->buf);
      }
      if (synch_deadlock_detection.load(std::memory_order_acquire) ==
          OnDeadlockCycle::kAbort) {

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/gxx.py
10 issues
Attempted relative import beyond top-level package
Error

Line: 43 Column: 1

              import SCons.Tool
import SCons.Util

from . import gcc
from . import cxx

compilers = ['g++']



            

Reported by Pylint.

Attempted relative import beyond top-level package
Error

Line: 44 Column: 1

              import SCons.Util

from . import gcc
from . import cxx

compilers = ['g++']


def generate(env):

            

Reported by Pylint.

Unused import os.path
Error

Line: 36 Column: 1

              
__revision__ = "src/engine/SCons/Tool/gxx.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os.path
import re
import subprocess

import SCons.Tool
import SCons.Util

            

Reported by Pylint.

Unused import re
Error

Line: 37 Column: 1

              __revision__ = "src/engine/SCons/Tool/gxx.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os.path
import re
import subprocess

import SCons.Tool
import SCons.Util


            

Reported by Pylint.

Unused import subprocess
Error

Line: 38 Column: 1

              
import os.path
import re
import subprocess

import SCons.Tool
import SCons.Util

from . import gcc

            

Reported by Pylint.

Unused variable 'static_obj'
Error

Line: 51 Column: 5

              
def generate(env):
    """Add Builders and construction variables for g++ to an Environment."""
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    if 'CXX' not in env:
        env['CXX'] = env.Detect(compilers) or compilers[0]

    cxx.generate(env)

            

Reported by Pylint.

Unused variable 'shared_obj'
Error

Line: 51 Column: 17

              
def generate(env):
    """Add Builders and construction variables for g++ to an Environment."""
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    if 'CXX' not in env:
        env['CXX'] = env.Detect(compilers) or compilers[0]

    cxx.generate(env)

            

Reported by Pylint.

Line too long (114/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/gxx.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os.path
import re
import subprocess


            

Reported by Pylint.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 38
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              
import os.path
import re
import subprocess

import SCons.Tool
import SCons.Util

from . import gcc

            

Reported by Bandit.

Missing function or method docstring
Error

Line: 73 Column: 1

                      env['CXXVERSION'] = version


def exists(env):
    # is executable, and is a GNU compiler (or accepts '--version' at least)
    return gcc.detect_version(env, env.Detect(env.get('CXX', compilers)))

# Local Variables:
# tab-width:4

            

Reported by Pylint.

src/third_party/abseil-cpp-master/abseil-cpp/absl/strings/str_cat_benchmark.cc
10 issues
strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 39 Column: 5 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

                char foo[100];
  for (auto _ : state) {
    // NOLINTNEXTLINE(runtime/printf)
    strcpy(foo, absl::StrCat(kStringOne, i, kStringTwo, i * 65536ULL).c_str());
    int sum = 0;
    for (char* f = &foo[0]; *f != 0; ++f) {
      sum += *f;
    }
    benchmark::DoNotOptimize(sum);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 39 Column: 23 CWE codes: 120

                char foo[100];
  for (auto _ : state) {
    // NOLINTNEXTLINE(runtime/printf)
    strcpy(foo, absl::StrCat(kStringOne, i, kStringTwo, i * 65536ULL).c_str());
    int sum = 0;
    for (char* f = &foo[0]; *f != 0; ++f) {
      sum += *f;
    }
    benchmark::DoNotOptimize(sum);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 64 Column: 66 CWE codes: 120

                int i = 0;
  for (auto _ : state) {
    std::string result =
        std::string(kStringOne) + " " + kStringTwo + ":" + absl::StrCat(i);
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_StrCat_By_Strings);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 78 Column: 21 CWE codes: 120

                  result += " ";
    result += kStringTwo;
    result += ":";
    result += absl::StrCat(i);
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_StrCat_By_StringOpPlus);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 88 Column: 32 CWE codes: 120

              void BM_StrCat_By_StrCat(benchmark::State& state) {
  int i = 0;
  for (auto _ : state) {
    std::string result = absl::StrCat(kStringOne, " ", kStringTwo, ":", i);
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_StrCat_By_StrCat);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 99 Column: 15 CWE codes: 120

                int i = 0;
  for (auto _ : state) {
    std::string result =
        absl::StrCat(kStringOne, " ", absl::Hex(int64_t{i} + 0x10000000));
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_HexCat_By_StrCat);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 121 Column: 32 CWE codes: 120

                int i = 0;
  float foo = 0.0f;
  for (auto _ : state) {
    std::string result = absl::StrCat(foo += 1.001f, " != ", int64_t{i});
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_FloatToString_By_StrCat);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 133 Column: 15 CWE codes: 120

                double foo = 0.0;
  for (auto _ : state) {
    std::string result =
        absl::StrCat(absl::SixDigits(foo += 1.001), " != ", int64_t{i});
    benchmark::DoNotOptimize(result);
    i = IncrementAlternatingSign(i);
  }
}
BENCHMARK(BM_DoubleToString_By_SixDigits);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 36 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
void BM_Sum_By_StrCat(benchmark::State& state) {
  int i = 0;
  char foo[100];
  for (auto _ : state) {
    // NOLINTNEXTLINE(runtime/printf)
    strcpy(foo, absl::StrCat(kStringOne, i, kStringTwo, i * 65536ULL).c_str());
    int sum = 0;
    for (char* f = &foo[0]; *f != 0; ++f) {

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 52 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
void BM_StrCat_By_snprintf(benchmark::State& state) {
  int i = 0;
  char on_stack[1000];
  for (auto _ : state) {
    snprintf(on_stack, sizeof(on_stack), "%s %s:%d", kStringOne, kStringTwo, i);
    i = IncrementAlternatingSign(i);
  }
}

            

Reported by FlawFinder.