Harden compiler flags, simplify CWE-134 script, fix bugs found by new warnings
configure.ac: - Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2 - Add -Wextra, -Wnull-dereference, -Wpointer-arith, -Wimplicit-function-declaration - Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2 - Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op, -Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow - Add linker hardening via AC_LINK_IFELSE: -Wl,-z,relro -Wl,-z,now - Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter, -Wno-missing-field-initializers, -Wno-sign-compare, -Wno-cast-function-type - Remove AM_CFLAGS/CFLAGS duplication line check-cwe134.sh: - Reduce from 5 checks to 2 (checks 1-3 are now redundant with -Wformat=2) - Check 1: verify known wrappers have G_GNUC_PRINTF attribute - Check 2: auto-detect unannotated variadic printf-like functions Bug fixes found by -Wduplicated-branches: - chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL - rosterwin.c: two instances of if/else with identical branches in roster count - omemo.c: redundant else-if branch in omemo_automatic_start Other fixes for new warnings: - console.c: pointer compared to integer 0 instead of NULL (2 instances) - vcard.c: NULL guard for filename before g_file_set_contents - files.c: refactor to early return, eliminating NULL logfile path - database.c: const-correctness for type, query, sort variables - form.c/xmpp.h: const-correctness for form_set_value parameter - muc.c/muc.h: remove meaningless top-level const on return type - common.c: const-correctness for URL string literal - xmpp/omemo.c: scope block for declarations after goto, move from decl before goto, replace goto with direct return - http_common.h: add G_GNUC_PRINTF attributes for http_print_transfer* - test_common.c: add currb NULL check to silence -Wnull-dereference
This commit is contained in:
255
check-cwe134.sh
255
check-cwe134.sh
@@ -1,16 +1,14 @@
|
||||
#!/bin/bash
|
||||
# check-cwe134.sh - Static analysis for CWE-134 format string vulnerabilities
|
||||
# check-cwe134.sh - Verify __attribute__((format)) on printf-like wrappers
|
||||
#
|
||||
# This script detects potentially unsafe usage of format string functions
|
||||
# where user-controlled data may be passed without "%s" wrapper.
|
||||
# CWE-134 format string vulnerabilities are caught at compile time by
|
||||
# -Wformat=2 (includes -Wformat-security + -Wformat-nonliteral), BUT only
|
||||
# for functions annotated with __attribute__((format(printf, N, M))) or
|
||||
# G_GNUC_PRINTF(N, M).
|
||||
#
|
||||
# Checks performed:
|
||||
# 1. Direct variable passed as format string: cons_show(var);
|
||||
# 2. Variable passed as format arg through multi-arg wrappers:
|
||||
# win_println(win, theme, ch, var); (no format specifiers in var position)
|
||||
# 3. GString->str passed as format argument without "%s"
|
||||
# 4. Presence of __attribute__((format)) on printf-like wrapper declarations
|
||||
# 5. Format string mismatch: more arguments than format specifiers
|
||||
# This script ensures every variadic function whose last fixed parameter
|
||||
# looks like a format string has the annotation. Without it, the compiler
|
||||
# silently ignores format misuse.
|
||||
#
|
||||
# Usage: ./check-cwe134.sh [directory]
|
||||
|
||||
@@ -18,167 +16,15 @@ set -e
|
||||
|
||||
DIR="${1:-src}"
|
||||
|
||||
echo "=== CWE-134 Format String Vulnerability Check ==="
|
||||
echo "=== CWE-134: format attribute audit ==="
|
||||
echo "Scanning: $DIR"
|
||||
echo ""
|
||||
|
||||
# Functions that accept format strings (direct: first arg is format)
|
||||
DIRECT_FORMAT_FUNCS="cons_show|cons_debug|cons_show_error|log_info|log_error|log_warning|log_debug"
|
||||
|
||||
# Functions where format string is not the first arg (multi-arg wrappers)
|
||||
# win_print(win, theme, char, FORMAT, ...)
|
||||
# win_println(win, theme, char, FORMAT, ...)
|
||||
# win_println_indent(win, pad, FORMAT, ...)
|
||||
# win_append(win, theme, FORMAT, ...)
|
||||
# win_appendln(win, theme, FORMAT, ...)
|
||||
# win_append_highlight(win, theme, FORMAT, ...)
|
||||
# win_appendln_highlight(win, theme, FORMAT, ...)
|
||||
# win_command_exec_error(win, cmd, FORMAT, ...)
|
||||
MULTI_ARG_FORMAT_FUNCS="win_print|win_println|win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight|win_command_exec_error"
|
||||
|
||||
ALL_FORMAT_FUNCS="$DIRECT_FORMAT_FUNCS|$MULTI_ARG_FORMAT_FUNCS"
|
||||
|
||||
ERRORS=0
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Check 1: Direct format functions called with single variable (no format string)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo "Check 1: Direct variable as format string..."
|
||||
echo ""
|
||||
|
||||
# Pattern: func(identifier) or func(identifier->member) or func(identifier[index])
|
||||
RESULTS=$(grep -rn --include="*.c" -P "($DIRECT_FORMAT_FUNCS)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*\w+\s*\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
|
||||
|
||||
# Filter out function definitions, declarations, and safe api_* wrappers
|
||||
RESULTS=$(echo "$RESULTS" | grep -v "const char\|void \|^[^:]*:[0-9]*:[a-z_]*(\|api_cons_show\|api_log_" || true)
|
||||
|
||||
if [ -n "$RESULTS" ]; then
|
||||
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (direct format):"
|
||||
echo ""
|
||||
echo "$RESULTS"
|
||||
echo ""
|
||||
ERRORS=$((ERRORS + $(echo "$RESULTS" | wc -l)))
|
||||
else
|
||||
echo "✅ No direct format string issues found."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Check 2: Multi-arg wrappers where format position has a variable (not a string literal)
|
||||
# ---------------------------------------------------------------------------
|
||||
echo ""
|
||||
echo "Check 2: Multi-arg wrappers with variable as format argument..."
|
||||
echo ""
|
||||
|
||||
# For win_print(win, theme, char, FORMAT, ...) and win_println(win, theme, char, FORMAT, ...):
|
||||
# FORMAT is the 4th argument
|
||||
MULTI4_RESULTS=$(grep -rn --include="*.c" -P "(win_print|win_println)\s*\(" "$DIR" 2>/dev/null | \
|
||||
grep -v "win_println_indent\|win_println_va" | \
|
||||
perl -ne '
|
||||
if (/((win_print|win_println)\s*\()/) {
|
||||
my $line = $_;
|
||||
my $call_start = index($line, $1) + length($1);
|
||||
my $rest = substr($line, $call_start);
|
||||
my $depth = 0; my $commas = 0; my $i = 0;
|
||||
for ($i = 0; $i < length($rest) && $commas < 3; $i++) {
|
||||
my $c = substr($rest, $i, 1);
|
||||
if ($c eq "(") { $depth++; }
|
||||
elsif ($c eq ")") { $depth--; last if $depth < 0; }
|
||||
elsif ($c eq "," && $depth == 0) { $commas++; }
|
||||
}
|
||||
if ($commas == 3) {
|
||||
my $fmt_arg = substr($rest, $i);
|
||||
$fmt_arg =~ s/^\s+//;
|
||||
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
|
||||
}
|
||||
}
|
||||
' || true)
|
||||
MULTI4_RESULTS=$(echo "$MULTI4_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
|
||||
|
||||
# For win_command_exec_error(win, cmd, FORMAT, ...):
|
||||
# FORMAT is the 3rd argument
|
||||
MULTI_CMD_RESULTS=$(grep -rn --include="*.c" -P "win_command_exec_error\s*\(" "$DIR" 2>/dev/null | \
|
||||
perl -ne '
|
||||
if (/(win_command_exec_error\s*\()/) {
|
||||
my $line = $_;
|
||||
my $call_start = index($line, $1) + length($1);
|
||||
my $rest = substr($line, $call_start);
|
||||
my $depth = 0; my $commas = 0; my $i = 0;
|
||||
for ($i = 0; $i < length($rest) && $commas < 2; $i++) {
|
||||
my $c = substr($rest, $i, 1);
|
||||
if ($c eq "(") { $depth++; }
|
||||
elsif ($c eq ")") { $depth--; last if $depth < 0; }
|
||||
elsif ($c eq "," && $depth == 0) { $commas++; }
|
||||
}
|
||||
if ($commas == 2) {
|
||||
my $fmt_arg = substr($rest, $i);
|
||||
$fmt_arg =~ s/^\s+//;
|
||||
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
|
||||
}
|
||||
}
|
||||
' || true)
|
||||
MULTI_CMD_RESULTS=$(echo "$MULTI_CMD_RESULTS" | grep -v "^$\|const char.*error\|void \|ProfWin\*.*const char\*.*const char\*.*\.\.\." || true)
|
||||
|
||||
# For 3-arg format functions: win_println_indent(win, pad, FORMAT, ...)
|
||||
# win_append(win, theme, FORMAT, ...) etc.
|
||||
MULTI3_RESULTS=$(grep -rn --include="*.c" -P "(win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight)\s*\([^,]+,[^,]+,\s*(?!\")\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*[^\]]+\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
|
||||
MULTI3_RESULTS=$(echo "$MULTI3_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
|
||||
|
||||
MULTI_RESULTS=""
|
||||
if [ -n "$MULTI4_RESULTS" ]; then
|
||||
MULTI_RESULTS="$MULTI4_RESULTS"
|
||||
fi
|
||||
if [ -n "$MULTI3_RESULTS" ]; then
|
||||
if [ -n "$MULTI_RESULTS" ]; then
|
||||
MULTI_RESULTS="$MULTI_RESULTS
|
||||
$MULTI3_RESULTS"
|
||||
else
|
||||
MULTI_RESULTS="$MULTI3_RESULTS"
|
||||
fi
|
||||
fi
|
||||
if [ -n "$MULTI_CMD_RESULTS" ]; then
|
||||
if [ -n "$MULTI_RESULTS" ]; then
|
||||
MULTI_RESULTS="$MULTI_RESULTS
|
||||
$MULTI_CMD_RESULTS"
|
||||
else
|
||||
MULTI_RESULTS="$MULTI_CMD_RESULTS"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$MULTI_RESULTS" ]; then
|
||||
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (multi-arg wrappers):"
|
||||
echo ""
|
||||
echo "$MULTI_RESULTS"
|
||||
echo ""
|
||||
ERRORS=$((ERRORS + $(echo "$MULTI_RESULTS" | wc -l)))
|
||||
else
|
||||
echo "✅ No multi-arg format string issues found."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Check 3: GString->str passed directly as format argument
|
||||
# ---------------------------------------------------------------------------
|
||||
echo ""
|
||||
echo "Check 3: GString->str passed to format functions..."
|
||||
|
||||
GSTRING_RESULTS=$(grep -rn --include="*.c" -P "($ALL_FORMAT_FUNCS)\s*\([^)]*->str\s*\)" "$DIR" 2>/dev/null | grep -v '"%s"' || true)
|
||||
|
||||
if [ -n "$GSTRING_RESULTS" ]; then
|
||||
echo "⚠️ GString->str passed without \"%s\" (review manually):"
|
||||
echo ""
|
||||
echo "$GSTRING_RESULTS"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Check 4: Verify __attribute__((format)) on printf-like wrappers
|
||||
# ---------------------------------------------------------------------------
|
||||
echo ""
|
||||
echo "Check 4: Verifying __attribute__((format)) annotations..."
|
||||
echo ""
|
||||
|
||||
ATTR_ERRORS=0
|
||||
|
||||
# Functions that MUST have format attributes (declared in headers)
|
||||
# --------------------------------------------------------------------- #
|
||||
# Known printf-like wrappers that MUST have the attribute #
|
||||
# --------------------------------------------------------------------- #
|
||||
REQUIRED_ATTRIBUTED=(
|
||||
"cons_show"
|
||||
"cons_debug"
|
||||
@@ -199,39 +45,74 @@ REQUIRED_ATTRIBUTED=(
|
||||
"win_command_exec_error"
|
||||
)
|
||||
|
||||
echo "Check 1: Known wrappers must have G_GNUC_PRINTF / __attribute__((format))"
|
||||
echo ""
|
||||
|
||||
for func in "${REQUIRED_ATTRIBUTED[@]}"; do
|
||||
# Check if the function declaration in headers has a preceding format attribute
|
||||
HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null | grep -E -c "format\(printf|G_GNUC_PRINTF" || true)
|
||||
HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null \
|
||||
| grep -Ec "format\(printf|G_GNUC_PRINTF" || true)
|
||||
if [ "$HAS_ATTR" -eq 0 ]; then
|
||||
echo "❌ Missing __attribute__((format(printf, ...))) for: $func"
|
||||
ATTR_ERRORS=$((ATTR_ERRORS + 1))
|
||||
echo " ❌ $func — missing format attribute"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$ATTR_ERRORS" -eq 0 ]; then
|
||||
echo "✅ All printf-like wrappers have format attributes."
|
||||
else
|
||||
echo ""
|
||||
echo "⚠️ $ATTR_ERRORS function(s) missing format attributes."
|
||||
echo " Add __attribute__((format(printf, N, M))) before the declaration."
|
||||
ERRORS=$((ERRORS + ATTR_ERRORS))
|
||||
if [ "$ERRORS" -eq 0 ]; then
|
||||
echo " ✅ All known wrappers annotated."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Summary
|
||||
# ---------------------------------------------------------------------------
|
||||
# --------------------------------------------------------------------- #
|
||||
# Auto-detect new variadic functions that look like printf wrappers #
|
||||
# but are NOT in the known list and NOT annotated. #
|
||||
# Heuristic: declaration has (... const char* ..., ...) and no attribute #
|
||||
# --------------------------------------------------------------------- #
|
||||
echo ""
|
||||
echo "Check 2: Detect unannotated printf-like variadic declarations in headers"
|
||||
echo ""
|
||||
|
||||
KNOWN_RE=$(IFS="|"; echo "${REQUIRED_ATTRIBUTED[*]}")
|
||||
|
||||
# Find variadic declarations with a const char* parameter followed by ...)
|
||||
# that do NOT have a format attribute on the preceding line
|
||||
NEW_ISSUES=$(grep -B1 -rn --include="*.h" \
|
||||
'const char\s*\*.*,\s*\.\.\.)' "$DIR" 2>/dev/null \
|
||||
| awk '
|
||||
/format\(printf|G_GNUC_PRINTF/ { skip=1; next }
|
||||
/const char.*,.*\.\.\.\)/ {
|
||||
if (skip) { skip=0; next }
|
||||
print
|
||||
}
|
||||
{ skip=0 }
|
||||
' \
|
||||
| grep -E "void\s+\w+\s*\(" \
|
||||
| grep -Ev "($KNOWN_RE)" \
|
||||
|| true)
|
||||
|
||||
if [ -n "$NEW_ISSUES" ]; then
|
||||
echo " ⚠️ Possibly unannotated new printf-like functions:"
|
||||
echo ""
|
||||
echo "$NEW_ISSUES"
|
||||
echo ""
|
||||
NEW_COUNT=$(echo "$NEW_ISSUES" | wc -l)
|
||||
ERRORS=$((ERRORS + NEW_COUNT))
|
||||
else
|
||||
echo " ✅ No unannotated variadic printf-like functions found."
|
||||
fi
|
||||
|
||||
# --------------------------------------------------------------------- #
|
||||
# Summary #
|
||||
# --------------------------------------------------------------------- #
|
||||
echo ""
|
||||
echo "=== Summary ==="
|
||||
echo "Critical issues: $ERRORS"
|
||||
echo "Issues: $ERRORS"
|
||||
echo ""
|
||||
|
||||
if [ "$ERRORS" -gt 0 ]; then
|
||||
echo "Fix: add the attribute before the declaration in the .h file:"
|
||||
echo " G_GNUC_PRINTF(N, M) // N = format arg, M = first vararg"
|
||||
echo " void my_func(ProfWin* w, const char* fmt, ...);"
|
||||
echo ""
|
||||
echo "Fix by adding \"%s\" format specifier:"
|
||||
echo " BAD: cons_show(variable);"
|
||||
echo " GOOD: cons_show(\"%s\", variable);"
|
||||
echo ""
|
||||
echo " BAD: win_println(win, theme, ch, variable);"
|
||||
echo " GOOD: win_println(win, theme, ch, \"%s\", variable);"
|
||||
echo "The compiler flag -Wformat=2 will then catch all misuse automatically."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
Reference in New Issue
Block a user