search

getsentry / sentry-native

Sentry SDK for C, C++ and native applications.
MIT License
395 stars 166 forks source link

Ensure unsafe functions are properly guarded #1012

Open markushi opened 3 months ago

markushi commented 3 months ago

Description

We recently received a security report about unsafe usages. Whilst there's not always a safe alternative available (especially cross-platform) we can still have a check and ensure we have best-effort implementations for:

Detailed report:

Format String Vulnerabilities

libsentry-android.so
  snprintf: 00001c92
libsentry.so
  fprintf: 000d4d98
  snprintf: 00074252
  vfprintf: 000d102a
  vprintf: 0008c4da
  vsnprintf: 0007914a

Buffer Overflow Vulnerabilities

libsentry.so
  strncpy: 000d34ea
  memcpy: 000d40b0

Buffer Overflow Danger Functions

libsentry.so
  realpath: 0007cd4e
markushi commented 3 months ago

We should also consider integrating CodeQL into CI to highlight potential issues earlier.

JoshuaMoelans commented 2 weeks ago

Tracking progress on this Notion page (+ subpages)