search

sjvermeu / cvechecker

Command-line utility to scan the system and report on potential vulnerabilities, based on public CVE data
GNU General Public License v3.0
258 stars 68 forks source link

pullcves pull don't import anything (v3.7 and master) #24

Closed zanettea closed 7 years ago

zanettea commented 7 years ago

The following scanf call fails on any valid input and database is not filled without reporting any error

sscanf(bufferptr, "[^:]%s", field, &pos)

Moreover gcc (4.8) complains:

gcc -DHAVE_CONFIG_H -I. -I.. -D_USE_SQLITE3 -g -O2 -MT cvecheck.o -MD -MP -MF $depbase.Tpo -c -o cvecheck.o cvecheck.c &&\ mv -f $depbase.Tpo $depbase.Po cvecheck.c: In function ‘load_cve’: cvecheck.c:1362:28: warning: too many arguments for format [-Wformat-extra-args] while (sscanf(bufferptr, "[^:]%s", field, &pos) == 1) {

sjvermeu commented 7 years ago

Yes, the "too many arguments" I got as well with -Wall -Werror, that one should be fixed. I'm going to look into the database filling issue...

sjvermeu commented 7 years ago

Took me far too long to fix it :-( Current master should be ok. I'll do some more testing this week (I assumed that the pullcves correctly reported that all entries were already in the database when I initially validated).

sjvermeu commented 7 years ago

Should be fixed in the 3.8 release.