jabber.developer2
bb6d29a060
configure.ac: - Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2 - Add -Wextra, -Wnull-dereference, -Wpointer-arith, -Wimplicit-function-declaration - Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2 - Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op, -Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow - Add linker hardening via AC_LINK_IFELSE: -Wl,-z,relro -Wl,-z,now - Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter, -Wno-missing-field-initializers, -Wno-sign-compare, -Wno-cast-function-type - Remove AM_CFLAGS/CFLAGS duplication line check-cwe134.sh: - Reduce from 5 checks to 2 (checks 1-3 are now redundant with -Wformat=2) - Check 1: verify known wrappers have G_GNUC_PRINTF attribute - Check 2: auto-detect unannotated variadic printf-like functions Bug fixes found by -Wduplicated-branches: - chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL - rosterwin.c: two instances of if/else with identical branches in roster count - omemo.c: redundant else-if branch in omemo_automatic_start Other fixes for new warnings: - console.c: pointer compared to integer 0 instead of NULL (2 instances) - vcard.c: NULL guard for filename before g_file_set_contents - files.c: refactor to early return, eliminating NULL logfile path - database.c: const-correctness for type, query, sort variables - form.c/xmpp.h: const-correctness for form_set_value parameter - muc.c/muc.h: remove meaningless top-level const on return type - common.c: const-correctness for URL string literal - xmpp/omemo.c: scope block for declarations after goto, move from decl before goto, replace goto with direct return - http_common.h: add G_GNUC_PRINTF attributes for http_print_transfer* - test_common.c: add currb NULL check to silence -Wnull-dereference
120 lines
3.6 KiB
Bash
Executable File
120 lines
3.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# check-cwe134.sh - Verify __attribute__((format)) on printf-like wrappers
|
|
#
|
|
# CWE-134 format string vulnerabilities are caught at compile time by
|
|
# -Wformat=2 (includes -Wformat-security + -Wformat-nonliteral), BUT only
|
|
# for functions annotated with __attribute__((format(printf, N, M))) or
|
|
# G_GNUC_PRINTF(N, M).
|
|
#
|
|
# This script ensures every variadic function whose last fixed parameter
|
|
# looks like a format string has the annotation. Without it, the compiler
|
|
# silently ignores format misuse.
|
|
#
|
|
# Usage: ./check-cwe134.sh [directory]
|
|
|
|
set -e
|
|
|
|
DIR="${1:-src}"
|
|
|
|
echo "=== CWE-134: format attribute audit ==="
|
|
echo "Scanning: $DIR"
|
|
echo ""
|
|
|
|
ERRORS=0
|
|
|
|
# --------------------------------------------------------------------- #
|
|
# Known printf-like wrappers that MUST have the attribute #
|
|
# --------------------------------------------------------------------- #
|
|
REQUIRED_ATTRIBUTED=(
|
|
"cons_show"
|
|
"cons_debug"
|
|
"cons_show_error"
|
|
"cons_show_padded"
|
|
"log_debug"
|
|
"log_info"
|
|
"log_warning"
|
|
"log_error"
|
|
"win_print"
|
|
"win_println"
|
|
"win_println_indent"
|
|
"win_println_va"
|
|
"win_append"
|
|
"win_appendln"
|
|
"win_append_highlight"
|
|
"win_appendln_highlight"
|
|
"win_command_exec_error"
|
|
)
|
|
|
|
echo "Check 1: Known wrappers must have G_GNUC_PRINTF / __attribute__((format))"
|
|
echo ""
|
|
|
|
for func in "${REQUIRED_ATTRIBUTED[@]}"; do
|
|
HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null \
|
|
| grep -Ec "format\(printf|G_GNUC_PRINTF" || true)
|
|
if [ "$HAS_ATTR" -eq 0 ]; then
|
|
echo " ❌ $func — missing format attribute"
|
|
ERRORS=$((ERRORS + 1))
|
|
fi
|
|
done
|
|
|
|
if [ "$ERRORS" -eq 0 ]; then
|
|
echo " ✅ All known wrappers annotated."
|
|
fi
|
|
|
|
# --------------------------------------------------------------------- #
|
|
# Auto-detect new variadic functions that look like printf wrappers #
|
|
# but are NOT in the known list and NOT annotated. #
|
|
# Heuristic: declaration has (... const char* ..., ...) and no attribute #
|
|
# --------------------------------------------------------------------- #
|
|
echo ""
|
|
echo "Check 2: Detect unannotated printf-like variadic declarations in headers"
|
|
echo ""
|
|
|
|
KNOWN_RE=$(IFS="|"; echo "${REQUIRED_ATTRIBUTED[*]}")
|
|
|
|
# Find variadic declarations with a const char* parameter followed by ...)
|
|
# that do NOT have a format attribute on the preceding line
|
|
NEW_ISSUES=$(grep -B1 -rn --include="*.h" \
|
|
'const char\s*\*.*,\s*\.\.\.)' "$DIR" 2>/dev/null \
|
|
| awk '
|
|
/format\(printf|G_GNUC_PRINTF/ { skip=1; next }
|
|
/const char.*,.*\.\.\.\)/ {
|
|
if (skip) { skip=0; next }
|
|
print
|
|
}
|
|
{ skip=0 }
|
|
' \
|
|
| grep -E "void\s+\w+\s*\(" \
|
|
| grep -Ev "($KNOWN_RE)" \
|
|
|| true)
|
|
|
|
if [ -n "$NEW_ISSUES" ]; then
|
|
echo " ⚠️ Possibly unannotated new printf-like functions:"
|
|
echo ""
|
|
echo "$NEW_ISSUES"
|
|
echo ""
|
|
NEW_COUNT=$(echo "$NEW_ISSUES" | wc -l)
|
|
ERRORS=$((ERRORS + NEW_COUNT))
|
|
else
|
|
echo " ✅ No unannotated variadic printf-like functions found."
|
|
fi
|
|
|
|
# --------------------------------------------------------------------- #
|
|
# Summary #
|
|
# --------------------------------------------------------------------- #
|
|
echo ""
|
|
echo "=== Summary ==="
|
|
echo "Issues: $ERRORS"
|
|
echo ""
|
|
|
|
if [ "$ERRORS" -gt 0 ]; then
|
|
echo "Fix: add the attribute before the declaration in the .h file:"
|
|
echo " G_GNUC_PRINTF(N, M) // N = format arg, M = first vararg"
|
|
echo " void my_func(ProfWin* w, const char* fmt, ...);"
|
|
echo ""
|
|
echo "The compiler flag -Wformat=2 will then catch all misuse automatically."
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|