|
|
92953099e1
|
fix: CWE-134 format string vulnerability audit
CI Code / Check spelling (pull_request) Successful in 21s
CI Code / Check coding style (pull_request) Successful in 38s
CI Code / Linux (ubuntu) (pull_request) Successful in 6m25s
CI Code / Linux (debian) (pull_request) Successful in 9m11s
CI Code / Code Coverage (pull_request) Successful in 9m13s
CI Code / Linux (arch) (pull_request) Successful in 11m27s
Security:
- Fix CWE-134 in iq.c: user-controlled string passed as format arg
Annotations:
- Add G_GNUC_PRINTF to variadic functions in ui.h and log.h
Compiler flags (configure.ac):
- Add -Wformat -Wformat-nonliteral -Wno-format-zero-length
Format mismatch fixes:
- chatwin.c: Jid* instead of char* for %s
- connection.c: %x -> %lx for long flags
- cmd_funcs.c: %d -> %zu for MB_CUR_MAX/MB_LEN_MAX (size_t)
- cmd_funcs.c: cast gpointer to (char*) for %s
- cmd_defs.c: %d -> %u for g_list_length() (guint)
- iq.c: from_jid->barejid -> from_jid->fulljid
- console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
gpointer -> (char*) casts for %s
Bug fixes:
- api.c: broken log_warning() calls with extra format arg
- cmd_funcs.c: remove unused arg from cons_show()
Tooling:
- Expand check-cwe134.sh detection patterns
|
2026-03-03 16:29:25 +03:00 |
|
|
|
467222d0ca
|
fix(ui,db): harden NULL handling, fix CWE-134, optimize iterations
CI Code / Code Coverage (push) Failing after 10m34s
CI Code / Check spelling (push) Failing after 10m47s
CI Code / Check coding style (push) Failing after 11m4s
CI Code / Linux (ubuntu) (push) Failing after 11m19s
CI Code / Linux (debian) (push) Failing after 11m28s
CI Code / Linux (arch) (push) Failing after 11m38s
security(CWE-134): fix format string injections + add CI check
fix(ui): subwindow lifecycle, newwin/newpad guards, fallback timestamps
fix(db): sqlite cleanup on failures, sqlite3_close_v2
fix(xmpp): queued_messages loop, barejid leak
perf(core): g_hash_table_iter_init instead of g_hash_table_get_keys
refactor(ui): CLAMP macro in _check_subwin_width
test: XEP-0012 and XEP-0045 functional tests
Author: jabber.developer2
Closes #58, #85
|
2026-02-06 19:27:40 +01:00 |
|
