devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 9 Actions Packages Projects 1 Releases Wiki Activity
Files
92953099e1b397728616ec0fc04b7811bb95723c
cproof/check-cwe134.sh
jabber.developer2 92953099e1
All checks were successful
CI Code / Check spelling (pull_request) Successful in 21s
Details
CI Code / Check coding style (pull_request) Successful in 38s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 6m25s
Details
CI Code / Linux (debian) (pull_request) Successful in 9m11s
Details
CI Code / Code Coverage (pull_request) Successful in 9m13s
Details
CI Code / Linux (arch) (pull_request) Successful in 11m27s
Details
fix: CWE-134 format string vulnerability audit 
Security:
- Fix CWE-134 in iq.c: user-controlled string passed as format arg

Annotations:
- Add G_GNUC_PRINTF to variadic functions in ui.h and log.h

Compiler flags (configure.ac):
- Add -Wformat -Wformat-nonliteral -Wno-format-zero-length

Format mismatch fixes:
- chatwin.c: Jid* instead of char* for %s
- connection.c: %x -> %lx for long flags
- cmd_funcs.c: %d -> %zu for MB_CUR_MAX/MB_LEN_MAX (size_t)
- cmd_funcs.c: cast gpointer to (char*) for %s
- cmd_defs.c: %d -> %u for g_list_length() (guint)
- iq.c: from_jid->barejid -> from_jid->fulljid
- console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
  gpointer -> (char*) casts for %s

Bug fixes:
- api.c: broken log_warning() calls with extra format arg
- cmd_funcs.c: remove unused arg from cons_show()

Tooling:
- Expand check-cwe134.sh detection patterns
2026-03-03 16:29:25 +03:00

239 lines
8.9 KiB
Bash
Executable File
Raw Blame History

#!/bin/bash
# check-cwe134.sh - Static analysis for CWE-134 format string vulnerabilities
#
# This script detects potentially unsafe usage of format string functions
# where user-controlled data may be passed without "%s" wrapper.
#
# Checks performed:
# 1. Direct variable passed as format string: cons_show(var);
# 2. Variable passed as format arg through multi-arg wrappers:
# win_println(win, theme, ch, var); (no format specifiers in var position)
# 3. GString->str passed as format argument without "%s"
# 4. Presence of __attribute__((format)) on printf-like wrapper declarations
# 5. Format string mismatch: more arguments than format specifiers
#
# Usage: ./check-cwe134.sh [directory]
set -e
DIR="${1:-src}"
echo "=== CWE-134 Format String Vulnerability Check ==="
echo "Scanning: $DIR"
echo ""
# Functions that accept format strings (direct: first arg is format)
DIRECT_FORMAT_FUNCS="cons_show|cons_debug|cons_show_error|log_info|log_error|log_warning|log_debug"
# Functions where format string is not the first arg (multi-arg wrappers)
# win_print(win, theme, char, FORMAT, ...)
# win_println(win, theme, char, FORMAT, ...)
# win_println_indent(win, pad, FORMAT, ...)
# win_append(win, theme, FORMAT, ...)
# win_appendln(win, theme, FORMAT, ...)
# win_append_highlight(win, theme, FORMAT, ...)
# win_appendln_highlight(win, theme, FORMAT, ...)
# win_command_exec_error(win, cmd, FORMAT, ...)
MULTI_ARG_FORMAT_FUNCS="win_print|win_println|win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight|win_command_exec_error"
ALL_FORMAT_FUNCS="$DIRECT_FORMAT_FUNCS|$MULTI_ARG_FORMAT_FUNCS"
ERRORS=0
# ---------------------------------------------------------------------------
# Check 1: Direct format functions called with single variable (no format string)
# ---------------------------------------------------------------------------
echo "Check 1: Direct variable as format string..."
echo ""
# Pattern: func(identifier) or func(identifier->member) or func(identifier[index])
RESULTS=$(grep -rn --include="*.c" -P "($DIRECT_FORMAT_FUNCS)\s*\(\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*\w+\s*\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
# Filter out function definitions, declarations, and safe api_* wrappers
RESULTS=$(echo "$RESULTS" | grep -v "const char\|void \|^[^:]*:[0-9]*:[a-z_]*(\|api_cons_show\|api_log_" || true)
if [ -n "$RESULTS" ]; then
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (direct format):"
echo ""
echo "$RESULTS"
echo ""
ERRORS=$((ERRORS + $(echo "$RESULTS" | wc -l)))
else
echo "✅ No direct format string issues found."
fi
# ---------------------------------------------------------------------------
# Check 2: Multi-arg wrappers where format position has a variable (not a string literal)
# ---------------------------------------------------------------------------
echo ""
echo "Check 2: Multi-arg wrappers with variable as format argument..."
echo ""
# For win_print(win, theme, char, FORMAT, ...) and win_println(win, theme, char, FORMAT, ...):
# FORMAT is the 4th argument
MULTI4_RESULTS=$(grep -rn --include="*.c" -P "(win_print|win_println)\s*\(" "$DIR" 2>/dev/null | \
grep -v "win_println_indent\|win_println_va" | \
perl -ne '
if (/((win_print|win_println)\s*\()/) {
my $line = $_;
my $call_start = index($line, $1) + length($1);
my $rest = substr($line, $call_start);
my $depth = 0; my $commas = 0; my $i = 0;
for ($i = 0; $i < length($rest) && $commas < 3; $i++) {
my $c = substr($rest, $i, 1);
if ($c eq "(") { $depth++; }
elsif ($c eq ")") { $depth--; last if $depth < 0; }
elsif ($c eq "," && $depth == 0) { $commas++; }
}
if ($commas == 3) {
my $fmt_arg = substr($rest, $i);
$fmt_arg =~ s/^\s+//;
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
}
}
' || true)
MULTI4_RESULTS=$(echo "$MULTI4_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
# For win_command_exec_error(win, cmd, FORMAT, ...):
# FORMAT is the 3rd argument
MULTI_CMD_RESULTS=$(grep -rn --include="*.c" -P "win_command_exec_error\s*\(" "$DIR" 2>/dev/null | \
perl -ne '
if (/(win_command_exec_error\s*\()/) {
my $line = $_;
my $call_start = index($line, $1) + length($1);
my $rest = substr($line, $call_start);
my $depth = 0; my $commas = 0; my $i = 0;
for ($i = 0; $i < length($rest) && $commas < 2; $i++) {
my $c = substr($rest, $i, 1);
if ($c eq "(") { $depth++; }
elsif ($c eq ")") { $depth--; last if $depth < 0; }
elsif ($c eq "," && $depth == 0) { $commas++; }
}
if ($commas == 2) {
my $fmt_arg = substr($rest, $i);
$fmt_arg =~ s/^\s+//;
if ($fmt_arg =~ /^[a-zA-Z_]/) { print $line; }
}
}
' || true)
MULTI_CMD_RESULTS=$(echo "$MULTI_CMD_RESULTS" | grep -v "^$\|const char.*error\|void \|ProfWin\*.*const char\*.*const char\*.*\.\.\." || true)
# For 3-arg format functions: win_println_indent(win, pad, FORMAT, ...)
# win_append(win, theme, FORMAT, ...) etc.
MULTI3_RESULTS=$(grep -rn --include="*.c" -P "(win_println_indent|win_append|win_appendln|win_append_highlight|win_appendln_highlight)\s*\([^,]+,[^,]+,\s*(?!\")\s*[a-zA-Z_][a-zA-Z0-9_]*(\s*->\s*\w+|\s*\[\s*[^\]]+\])?\s*\)\s*;" "$DIR" 2>/dev/null || true)
MULTI3_RESULTS=$(echo "$MULTI3_RESULTS" | grep -v "^$\|const char.*message\|void " || true)
MULTI_RESULTS=""
if [ -n "$MULTI4_RESULTS" ]; then
MULTI_RESULTS="$MULTI4_RESULTS"
fi
if [ -n "$MULTI3_RESULTS" ]; then
if [ -n "$MULTI_RESULTS" ]; then
MULTI_RESULTS="$MULTI_RESULTS
$MULTI3_RESULTS"
else
MULTI_RESULTS="$MULTI3_RESULTS"
fi
fi
if [ -n "$MULTI_CMD_RESULTS" ]; then
if [ -n "$MULTI_RESULTS" ]; then
MULTI_RESULTS="$MULTI_RESULTS
$MULTI_CMD_RESULTS"
else
MULTI_RESULTS="$MULTI_CMD_RESULTS"
fi
fi
if [ -n "$MULTI_RESULTS" ]; then
echo "❌ POTENTIAL CWE-134 VULNERABILITIES FOUND (multi-arg wrappers):"
echo ""
echo "$MULTI_RESULTS"
echo ""
ERRORS=$((ERRORS + $(echo "$MULTI_RESULTS" | wc -l)))
else
echo "✅ No multi-arg format string issues found."
fi
# ---------------------------------------------------------------------------
# Check 3: GString->str passed directly as format argument
# ---------------------------------------------------------------------------
echo ""
echo "Check 3: GString->str passed to format functions..."
GSTRING_RESULTS=$(grep -rn --include="*.c" -P "($ALL_FORMAT_FUNCS)\s*\([^)]*->str\s*\)" "$DIR" 2>/dev/null | grep -v '"%s"' || true)
if [ -n "$GSTRING_RESULTS" ]; then
echo "⚠️ GString->str passed without \"%s\" (review manually):"
echo ""
echo "$GSTRING_RESULTS"
echo ""
fi
# ---------------------------------------------------------------------------
# Check 4: Verify __attribute__((format)) on printf-like wrappers
# ---------------------------------------------------------------------------
echo ""
echo "Check 4: Verifying __attribute__((format)) annotations..."
echo ""
ATTR_ERRORS=0
# Functions that MUST have format attributes (declared in headers)
REQUIRED_ATTRIBUTED=(
"cons_show"
"cons_debug"
"cons_show_error"
"cons_show_padded"
"log_debug"
"log_info"
"log_warning"
"log_error"
"win_print"
"win_println"
"win_println_indent"
"win_println_va"
"win_append"
"win_appendln"
"win_append_highlight"
"win_appendln_highlight"
"win_command_exec_error"
)
for func in "${REQUIRED_ATTRIBUTED[@]}"; do
# Check if the function declaration in headers has a preceding format attribute
HAS_ATTR=$(grep -B1 --include="*.h" -rn "void ${func}\s*(" "$DIR" 2>/dev/null | grep -E -c "format\(printf|G_GNUC_PRINTF" || true)
if [ "$HAS_ATTR" -eq 0 ]; then
echo "❌ Missing __attribute__((format(printf, ...))) for: $func"
ATTR_ERRORS=$((ATTR_ERRORS + 1))
fi
done
if [ "$ATTR_ERRORS" -eq 0 ]; then
echo "✅ All printf-like wrappers have format attributes."
else
echo ""
echo "⚠️ $ATTR_ERRORS function(s) missing format attributes."
echo " Add __attribute__((format(printf, N, M))) before the declaration."
ERRORS=$((ERRORS + ATTR_ERRORS))
fi
# ---------------------------------------------------------------------------
# Summary
# ---------------------------------------------------------------------------
echo ""
echo "=== Summary ==="
echo "Critical issues: $ERRORS"
if [ "$ERRORS" -gt 0 ]; then
echo ""
echo "Fix by adding \"%s\" format specifier:"
echo " BAD: cons_show(variable);"
echo " GOOD: cons_show(\"%s\", variable);"
echo ""
echo " BAD: win_println(win, theme, ch, variable);"
echo " GOOD: win_println(win, theme, ch, \"%s\", variable);"
exit 1
fi
exit 0
Reference in New Issue View Git Blame Copy Permalink