Re: [sqlite] Coding standard

On 12/12/19, Richard Hipp wrote: > On 12/12/19, Arthur Blondel wrote: > Authur sent me a spreadsheet with 432 warnings (not 32000 as > originally mentioned). Apparently the first list the OP sent was filtered to show only "security" warnings. Arthur sent me the complete list of 31859 warnings

Re: [sqlite] Coding standard

—Jens > On Dec 12, 2019, at 11:23 AM, Warren Young wrote: > > I wouldn’t dismiss this warning I wouldn’t dismiss a warning about the full scenario. (In fact I wasn’t aware that assignment to a field might overwrite pad bytes; that’s good to know.) But warning about every call to memset is

Re: [sqlite] Coding standard

On Thu, Dec 12, 2019, 11:04 PM Valentin Davydov wrote: > On Thu, Dec 12, 2019 at 11:19:44AM -0500, Richard Hipp wrote: > > > > #define sqlite3Strlen30NN(C) (strlen(C)&0x3fff) > > > > The tool does not provide any details beyond "Use of strlen". > > So why not just #define

Re: [sqlite] Coding standard

On Thu, Dec 12, 2019 at 11:19:44AM -0500, Richard Hipp wrote: > > #define sqlite3Strlen30NN(C) (strlen(C)&0x3fff) > > The tool does not provide any details beyond "Use of strlen". So why not just #define sqlite3Strlen30NN(C) (strnlen(C,0x3fff)) ? From the point of view of program

Re: [sqlite] Coding standard

On 12/12/19, Warren Young wrote: > >> AND only if the struct is then copied to a separate trust domain. > > You mean like in copying from kernel space to user space? Or old-style RPC? > Or mmap() based IPC APIs? Or…? > > I wouldn’t dismiss this warning. Copying from kernel-space to user-space

Re: [sqlite] Coding standard

On Dec 12, 2019, at 12:12 PM, Jens Alfke wrote: > > On Dec 12, 2019, at 10:36 AM, Simon Slavin wrote: >> >> For instance CodeSonar reports every use of memset() because you /can/ leak >> uninitialised bits of memory using memset() > > ...by writing to a field of a struct AFTER zeroing the

Re: [sqlite] Coding standard

> On Dec 12, 2019, at 10:36 AM, Simon Slavin wrote: > > For instance CodeSonar reports every use of memset() because you /can/ leak > uninitialised bits of memory using memset() (CERT C Section 3.6 DCL39-C). > But it has no way to check whether what you're doing with memset() does >

Re: [sqlite] Coding standard

Thanks for the details. Now we know what you're doing. CodeSonar checks code for many possible faults. This includes many things which are not related to the CERT C Coding Standard guidelines. So not everything on the report is a violation of the standard. You're really asking something

Re: [sqlite] Coding standard

On 12/12/19, Arthur Blondel wrote: > I'm using amalgamation version 3.30.1. and check with CodeSonar I've never heard of CodeSonar before. It appears to be some kind of static analysis tool that reads the source code and tries to infer potential problems. These tools are usually pretty weak,

Re: [sqlite] Coding standard

Thu, Dec 12, 2019 at 12:19 PM > Subject: Re: [sqlite] Coding standard > To: SQLite mailing list > > > I'm using amalgamation version 3.30.1. and check with CodeSonar > Attached the Security issues. > > > On Wed, Dec 11, 2019 at 4:57 PM Richard Hipp wrote: > >> O

Re: [sqlite] Coding standard

On 12/12/19, Arthur Blondel wrote: > I'm using amalgamation version 3.30.1. and check with CodeSonar > Attached the Security issues. This mailing list strips attachments. Please send via private email. -- D. Richard Hipp d...@sqlite.org ___

Re: [sqlite] Coding standard

I'm using amalgamation version 3.30.1. and check with CodeSonar Attached the Security issues. On Wed, Dec 11, 2019 at 4:57 PM Richard Hipp wrote: > On 12/11/19, Arthur Blondel wrote: > > Hello, > > Running the CERT coding standard > > on

Re: [sqlite] Coding standard

On 11 Dec 2019, at 2:53pm, Arthur Blondel wrote: > Running the CERT coding standard > on the sqlite code I > get up to 32000 warnings, most of them are security issues. The standard itself is good. But software which looks for violations

Re: [sqlite] Coding standard

On 12/11/19, Arthur Blondel wrote: > Hello, > Running the CERT coding standard > on the sqlite code I > get up to 32000 warnings, most of them are security issues. These are all likely to be false-positives. But if you will send me the