Started hunting for warnings to fix based on their severity, flawfinder -S -m 5 gives me an TOCTTOU alert for chmod'ing of the sockets: openvas-libraries/libopenvas/bpf_share.c:368 ./openvas-libnasl/nasl/nasl_server.c:92 Done abit of research and it seems like fchmod on sockets ends up in undefined behaviour.. http://www.opengroup.org/onlinepubs/009695399/functions/fchmod.html
http://72.14.205.104/search?q=cache:eIrjutZ5XAgJ:www.cs.helsinki.fi/linux/linux-kernel/Year-1999/1999-03/0942.html+Under+Linux+2.1.130,+fchmod+and&hl=en&ct=clnk&cd=1 http://linux.derkeiler.com/Mailing-Lists/Kernel/2004-11/0188.html Confirmed this with a small program that attempts to fchmod a socket descriptor.. Nothing works.. Should we disregard the warning from flawfinder? Any ideas for a workaround? Regards Laban On Feb 11, 2008 11:36 AM, Jan-Oliver Wagner <[EMAIL PROTECTED]> wrote: > Hanno, > > On Freitag, 8. Februar 2008, Hanno Böck wrote: > > Seems that since last time I checked, one compile/gentoo qa warning more > came > > into openvas-libraries: > > > > * QA Notice: Package has poor programming practices which may compile > > * fine but exhibit random runtime failures. > > * pcap.c:331: warning: dereferencing type-punned pointer will break > > strict-aliasing rules > > > > > > * QA Notice: Package has poor programming practices which may compile > > * fine but exhibit random runtime failures. > > * hg_dns_axfr.c:85: warning: implicit declaration of function > '_getshort' > > thanks for the report. > > One of the very next steps is to cut down the compile warnings and other > porential flaws. The first step was to find some numbers: > http://www.openvas.org/code-quality.html > > Best > > Jan > > -- > Dr. Jan-Oliver Wagner Intevation GmbH, Osnabrück > Amtsgericht Osnabrück, HR B 18998 http://www.intevation.de/ > Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner > _______________________________________________ > Openvas-devel mailing list > [email protected] > http://lists.wald.intevation.org/mailman/listinfo/openvas-devel >
_______________________________________________ Openvas-devel mailing list [email protected] http://lists.wald.intevation.org/mailman/listinfo/openvas-devel
