search

nothings / stb

stb single-file public domain libraries for C/C++
https://twitter.com/nothings
Other
26.84k stars 7.72k forks source link

Set up CodeQL scans and fixed several numeric overflows #1306

Open artem-smotrakov opened 2 years ago

artem-smotrakov commented 2 years ago

I'd like to suggest setting CodeQL scans for stb. CodeQL is a static-analysis engine that can help with detecting security and other issues. It can be easily run in a GitHub workflow. The suggested config runs scans on PRs and the main branch. Findings are going to be posted as comments in pull requests.

CodeQL reported several findings, mostly multiplication overflows and one suspicious check for pointer overflow. I've tried to fix them but this definitely needs a review because I have not writtten C code for a long time :)

I also noticed that make -C tests all fails because the tests still use stb_perlin.h. I've updated the tests, otherwise CodeQL jobs would fail.

nothings commented 2 years ago

the perlin noise patent expired, so stb_perlin is coming back, so that's why nothing else involving it was changed

artem-smotrakov commented 2 years ago

the perlin noise patent expired, so stb_perlin is coming back, so that's why nothing else involving it was changed

Then, I think, test_perlin.c can be just temporarily removed fromMakefile.

artem-smotrakov commented 2 years ago

I've restored test_perlin.c and commented out stb_perlin.h.