@github-advanced-security[bot] commented on this pull request.
> @@ -670,18 +736,35 @@
retry = 10;
while ((ret_size < sizeof(struct protocol)) && (retry >
0)) {
- ret_size = recv(pfd, resp + ret_size,
(sizeof(struct protocol)
- -
ret_size), 0);
+ ssize_t n = recv(pfd, (char *)resp + ret_size,
## Flawfinder / Function accepts input from outside program (CWE-20).
input/recv:Function accepts input from outside program (CWE-20).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3020)
> @@ -74,6 +74,11 @@
struct meta_layout *m = (struct meta_layout *)malloc(header_len);
size_t file_offset, tile_size;
+ if (m == NULL) {
+ snprintf(log_msg, PATH_MAX - 1, "Failed to allocate memory for
metatile header\n");
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3018)
> @@ -80,6 +80,11 @@
memcached_return_t rc;
char * buf_raw;
+ if (m == NULL) {
+ snprintf(log_msg, 1024, "Failed to allocate memory for metatile
header\n");
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3021)
> ((struct stat_info *)buf)->expired = 1;
- rc = memcached_cas(store->storage_ctx, meta_path, strlen(meta_path),
buf, len, 0, flags, cas);
+ // memcached_get() does not return a CAS value, so a compare-and-swap
cannot be used here
+ // (the previous code passed an uninitialised CAS token). Replace the
existing item instead.
+ rc = memcached_replace(store->storage_ctx, meta_path,
strlen(meta_path), buf, len, 0, flags);
## Flawfinder / Does not handle strings that are not \0-terminated; if given
one it may perform an over-read (it could cause a crash if unprotected)
(CWE-126).
buffer/strlen:Does not handle strings that are not \0-terminated; if given one
it may perform an over-read (it could cause a crash if unprotected) (CWE-126).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3023)
> @@ -134,6 +134,11 @@
int err;
char * buf_raw;
+ if (m == NULL) {
+ snprintf(log_msg, 1024, "Failed to allocate memory for metatile
header\n");
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3029)
>
ctx->cache.x = x;
ctx->cache.y = y;
ctx->cache.z = z;
- strcpy(ctx->cache.xmlname, xmlconfig);
+ snprintf(ctx->cache.xmlname, sizeof(ctx->cache.xmlname), "%s",
xmlconfig);
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3024)
--
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/mod_tile/pull/513#pullrequestreview-5481313977
You are receiving this because you are subscribed to this thread.
Message ID: <openstreetmap/mod_tile/pull/513/review/[email protected]>_______________________________________________
Tile-serving mailing list
[email protected]
https://lists.openstreetmap.org/listinfo/tile-serving
