devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 9 Actions Packages Projects 1 Releases Wiki Activity

fix: CWE-134 format string vulnerability audit
All checks were successful
CI Code / Check spelling (pull_request) Successful in 21s
Details
CI Code / Check coding style (pull_request) Successful in 38s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 6m25s
Details
CI Code / Linux (debian) (pull_request) Successful in 9m11s
Details
CI Code / Code Coverage (pull_request) Successful in 9m13s
Details
CI Code / Linux (arch) (pull_request) Successful in 11m27s
Details

Browse Source 
Security:
- Fix CWE-134 in iq.c: user-controlled string passed as format arg

Annotations:
- Add G_GNUC_PRINTF to variadic functions in ui.h and log.h

Compiler flags (configure.ac):
- Add -Wformat -Wformat-nonliteral -Wno-format-zero-length

Format mismatch fixes:
- chatwin.c: Jid* instead of char* for %s
- connection.c: %x -> %lx for long flags
- cmd_funcs.c: %d -> %zu for MB_CUR_MAX/MB_LEN_MAX (size_t)
- cmd_funcs.c: cast gpointer to (char*) for %s
- cmd_defs.c: %d -> %u for g_list_length() (guint)
- iq.c: from_jid->barejid -> from_jid->fulljid
- console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
  gpointer -> (char*) casts for %s

Bug fixes:
- api.c: broken log_warning() calls with extra format arg
- cmd_funcs.c: remove unused arg from cons_show()

Tooling:
- Expand check-cwe134.sh detection patterns
This commit is contained in:
jabber.developer2
2026-03-03 14:53:18 +03:00
parent 31538580fb
commit 92953099e1
16 changed files with 258 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/ui/ui.h
View File

@@ -244,7 +244,9 @@ char* inp_readline(void);
void inp_nonblocking(gboolean reset);
// Console window
G_GNUC_PRINTF(1, 2)
void cons_show(const char* const msg, ...);
G_GNUC_PRINTF(2, 3)
void cons_show_padded(int pad, const char* const msg, ...);
void cons_about(void);
void cons_help(void);
@@ -263,7 +265,9 @@ void cons_show_pgp_prefs(void);
void cons_show_omemo_prefs(void);
void cons_show_ox_prefs(void);
void cons_show_account(ProfAccount* account);
G_GNUC_PRINTF(1, 2)
void cons_debug(const char* const msg, ...);
G_GNUC_PRINTF(1, 2)
void cons_show_error(const char* const cmd, ...);
void cons_show_contacts(GSList* list);
void cons_show_roster(GSList* list);
@@ -393,16 +397,24 @@ void win_show_subwin(ProfWin* window);
void win_refresh_without_subwin(ProfWin* window);
void win_refresh_with_subwin(ProfWin* window);
G_GNUC_PRINTF(4, 5)
void win_print(ProfWin* window, theme_item_t theme_item, const char* show_char, const char* const message, ...);
G_GNUC_PRINTF(4, 5)
void win_println(ProfWin* window, theme_item_t theme_item, const char* show_char, const char* const message, ...);
G_GNUC_PRINTF(3, 4)
void win_println_indent(ProfWin* window, int pad, const char* const message, ...);
G_GNUC_PRINTF(4, 0)
void win_println_va(ProfWin* window, theme_item_t theme_item, const char* show_char, const char* const message, va_list arg);
G_GNUC_PRINTF(3, 4)
void win_append(ProfWin* window, theme_item_t theme_item, const char* const message, ...);
G_GNUC_PRINTF(3, 4)
void win_appendln(ProfWin* window, theme_item_t theme_item, const char* const message, ...);
G_GNUC_PRINTF(3, 4)
void win_append_highlight(ProfWin* window, theme_item_t theme_item, const char* const message, ...);
G_GNUC_PRINTF(3, 4)
void win_appendln_highlight(ProfWin* window, theme_item_t theme_item, const char* const message, ...);
gchar* win_get_title(ProfWin* window);
@@ -416,6 +428,7 @@ void win_clear(ProfWin* window);
char* win_get_tab_identifier(ProfWin* window);
gchar* win_to_string(ProfWin* window);
void win_command_list_error(ProfWin* window, const char* const error);
G_GNUC_PRINTF(3, 4)
void win_command_exec_error(ProfWin* window, const char* const command, const char* const error, ...);
void win_handle_command_list(ProfWin* window, GSList* cmds);
void win_handle_command_exec_status(ProfWin* window, const char* const type, const char* const value);