@github-advanced-security[bot] commented on this pull request.
> @@ -80,6 +80,11 @@
memcached_return_t rc;
char * buf_raw;
+ if (m == NULL) {
+ snprintf(log_msg, 1024, "Failed to allocate memory for metatile
header\n");
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3021)
> ((struct stat_info *)buf)->expired = 1;
- rc = memcached_cas(store->storage_ctx, meta_path, strlen(meta_path),
buf, len, 0, flags, cas);
+ // memcached_get() does not return a CAS value, so a compare-and-swap
cannot be used here
+ // (the previous code passed an uninitialised CAS token). Replace the
existing item instead.
+ rc = memcached_replace(store->storage_ctx, meta_path,
strlen(meta_path), buf, len, 0, flags);
## Flawfinder / Does not handle strings that are not \0-terminated; if given
one it may perform an over-read (it could cause a crash if unprotected)
(CWE-126).
buffer/strlen:Does not handle strings that are not \0-terminated; if given one
it may perform an over-read (it could cause a crash if unprotected) (CWE-126).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3023)
> @@ -134,6 +134,11 @@
int err;
char * buf_raw;
+ if (m == NULL) {
+ snprintf(log_msg, 1024, "Failed to allocate memory for metatile
header\n");
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3029)
>
ctx->cache.x = x;
ctx->cache.y = y;
ctx->cache.z = z;
- strcpy(ctx->cache.xmlname, xmlconfig);
+ snprintf(ctx->cache.xmlname, sizeof(ctx->cache.xmlname), "%s",
xmlconfig);
## Flawfinder / If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
format/snprintf:If format strings can be influenced by an attacker, they can be
exploited, and note that sprintf variations do not always \0-terminate
(CWE-134).
[Show more
details](https://github.com/openstreetmap/mod_tile/security/code-scanning/3024)
--
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/mod_tile/pull/504#pullrequestreview-5612232105
You are receiving this because you are subscribed to this thread.
Message ID: <openstreetmap/mod_tile/pull/504/review/[email protected]>_______________________________________________
Tile-serving mailing list
[email protected]
https://lists.openstreetmap.org/listinfo/tile-serving
