Closed frederic-mahe closed 5 years ago
@torognes could you please give a look at the above list? It contains general advice, and I don't think there is anything specific that could be applied to swarm's code. Please close the issue when you are done.
I've gone through the list and considered each issue and looked at the code. As far as I can see none of the issues are real problems in Swarm as the potential problems are taken care of in the code (array sizes, length of strings and memory areas). I have made a small change by replacing a sprintf
call with a snprintf
call, even though I can't see how it should break.
This is a low-priority issue.
while looking at the static code analysis functionalities offered by gitlab, I learned about flawfinder. It is a simple tool mostly focusing on C/C++ functions that are known to be vulnerable, but it can help us spot potential problems in our code, especially for sections dealing with user input (files and command arguments). The vulnerabilities are listed by decreasing importance (nothing major here):