Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4 (fetch.c L588)

2013-08-23 Thread Philip Oakley
From: "Philip Oakley" Sent: Monday, August 19, 2013 10:46 PM From: "Koch, Rick (Subcontractor)" Ran CPPCheck 1.5.6 on Windows-XP. Hi Rick, Thank you for the clarification. Normal practice on the list is to use Reply All, so everyone can participate in the discussion. It looks like most o

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Erik Faye-Lund
On Wed, Aug 21, 2013 at 1:01 AM, Andreas Schwab wrote: > Erik Faye-Lund writes: > >> I don't see how it's undefined. It's using the memory that 'pos' >> *points to* that is undefined, no? The difference between 'pos' and >> 'str' should still be the same, it's not like realloc somehow >> magicall

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Junio C Hamano
Andreas Schwab writes: > Erik Faye-Lund writes: > >> I don't see how it's undefined. It's using the memory that 'pos' >> *points to* that is undefined, no? The difference between 'pos' and >> 'str' should still be the same, it's not like realloc somehow >> magically updates 'pos'... > > It does.

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Andreas Schwab
Erik Faye-Lund writes: > I don't see how it's undefined. It's using the memory that 'pos' > *points to* that is undefined, no? The difference between 'pos' and > 'str' should still be the same, it's not like realloc somehow > magically updates 'pos'... It does. Think of segmented architectures,

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Erik Faye-Lund
On Tue, Aug 20, 2013 at 10:34 PM, René Scharfe wrote: > Am 20.08.2013 20:44, schrieb Andreas Schwab: > >> Erik Faye-Lund writes: >> >>> diff --git a/compat/win32/syslog.c b/compat/win32/syslog.c >>> index d015e43..0641f4e 100644 >>> --- a/compat/win32/syslog.c >>> +++ b/compat/win32/syslog.c >>>

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Erik Faye-Lund
On Tue, Aug 20, 2013 at 8:44 PM, Andreas Schwab wrote: > Erik Faye-Lund writes: > >> diff --git a/compat/win32/syslog.c b/compat/win32/syslog.c >> index d015e43..0641f4e 100644 >> --- a/compat/win32/syslog.c >> +++ b/compat/win32/syslog.c >> @@ -43,11 +43,14 @@ void syslog(int priority, const cha

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread René Scharfe
Am 20.08.2013 20:44, schrieb Andreas Schwab: Erik Faye-Lund writes: diff --git a/compat/win32/syslog.c b/compat/win32/syslog.c index d015e43..0641f4e 100644 --- a/compat/win32/syslog.c +++ b/compat/win32/syslog.c @@ -43,11 +43,14 @@ void syslog(int priority, const char *fmt, ...) va_end(ap)

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Andreas Schwab
Erik Faye-Lund writes: > diff --git a/compat/win32/syslog.c b/compat/win32/syslog.c > index d015e43..0641f4e 100644 > --- a/compat/win32/syslog.c > +++ b/compat/win32/syslog.c > @@ -43,11 +43,14 @@ void syslog(int priority, const char *fmt, ...) > va_end(ap); > > while ((pos = strstr(str, "%1

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-20 Thread Jeff King
On Tue, Aug 20, 2013 at 01:15:02AM +0200, Erik Faye-Lund wrote: > This one seems real, although it's quite theoretical. It should only happen > in cases where the log-message contains "%1", the initial malloc passed and > reallocing two more bytes failed. > > However, what's much more of a disast

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Erik Faye-Lund
This one seems real, although it's quite theoretical. It should only happen in cases where the log-message contains "%1", the initial malloc passed and reallocing two more bytes failed. However, what's much more of a disaster: "pos" is used after the call to realloc might have moved the memory! I

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Philip Oakley
- Original Message - From: "Philip Oakley" From: "Koch, Rick (Subcontractor)" Sent: Monday, August 19, 2013 6:09 PM I'm directing to this e-mail, as it seems to be the approved forum for posting Git bugs. We ran CPPCheck against Git v.1.8.3.4 and found 24 high risk bugs. Please see the

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Philip Oakley
t: Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4 From: "Koch, Rick (Subcontractor)" Sent: Monday, August 19, 2013 6:09 PM I'm directing to this e-mail, as it seems to be the approved forum for posting Git bugs. We ran CPPCheck against Git v.1.8.3.4 and found 24 high risk bugs.

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Stefan Beller
On 08/19/2013 07:09 PM, Koch, Rick (Subcontractor) wrote: > I'm directing to this e-mail, as it seems to be the approved forum for > posting Git bugs. We ran CPPCheck against Git v.1.8.3.4 and found 24 high > risk bugs. Please see the attachment xlsx. > > Is there a method to post to the Git c

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Johan Herland
On Mon, Aug 19, 2013 at 10:46 PM, Junio C Hamano wrote: > Jeff King writes: >> On Mon, Aug 19, 2013 at 09:03:21PM +0100, Philip Oakley wrote: >> So out of the 4 entries I investigated, none of them looks like an >> actual problem. But I'm not even sure I am looking at the right place; >> these do

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Junio C Hamano
Jeff King writes: > On Mon, Aug 19, 2013 at 09:03:21PM +0100, Philip Oakley wrote: > >> In case other readers don't have a .xlsx reader here is Rick's list >> in plain text (may be white space damaged). >> >> I expect some will be false positives, and some will just be being >> too cautious. >>

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Jeff King
On Mon, Aug 19, 2013 at 09:03:21PM +0100, Philip Oakley wrote: > In case other readers don't have a .xlsx reader here is Rick's list > in plain text (may be white space damaged). > > I expect some will be false positives, and some will just be being > too cautious. > > [...] > > description reso

Re: CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Philip Oakley
From: "Koch, Rick (Subcontractor)" Sent: Monday, August 19, 2013 6:09 PM I'm directing to this e-mail, as it seems to be the approved forum for posting Git bugs. We ran CPPCheck against Git v.1.8.3.4 and found 24 high risk bugs. Please see the attachment xlsx. Is there a method to post to the

CPPCheck found 24 high risk bugs in Git v.1.8.3.4

2013-08-19 Thread Koch, Rick (Subcontractor)
I'm directing to this e-mail, as it seems to be the approved forum for posting Git bugs. We ran CPPCheck against Git v.1.8.3.4 and found 24 high risk bugs.  Please see the attachment xlsx. Is there a method to post to the Git community to allow the community to review and debunk as faults posi