[GitHub] [cordova-ios] oxr463 opened a new issue #679: Binary make use of malloc Function

[GitBox <gi...@apache.org>]

oxr463 opened a new issue #679: Binary make use of malloc Function
URL: https://github.com/apache/cordova-ios/issues/679
 
 
   # Bug Report
   
   Cordova iOS Applications scanned with [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) report use of unsafe `malloc` function, (See also: https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/372).
   
   ## Problem
   
   See: [CWE-789: Uncontrolled Memory Allocation](https://cwe.mitre.org/data/definitions/789.html)
   
   ### What is expected to happen?
   
   Memory should be allocated via `calloc`.
   
   ### What does actually happen?
   
   Memory is allocated via unsafe `malloc`.
   
   ## Information
   <!-- Include all relevant information that might help understand and reproduce the problem -->
   
   See below.
   
   ### Command or Code
   <!-- What command or code is needed to reproduce the problem? -->
   
   Searching the repository leads me to the following line of code:
   
   ```
   Byte* buffer = (Byte*)malloc((unsigned long)[assetRepresentation size]);
   ```
   
   Source: https://github.com/apache/cordova-ios/blob/46da4bc34495ec7bfe13c1ec1b4074dd2e82641a/CordovaLib/Classes/Public/CDVURLProtocol.m#L65
   
   ### Environment, Platform, Device
   <!-- In what environment, on what platform or on which device are you experiencing the issue? -->
   
   iOS
   
   ### Version information
   <!-- 
   What are relevant versions you are using?
   For example:
   Cordova: Cordova CLI, Cordova Platforms, Cordova Plugins 
   Other Frameworks: Ionic Framework and CLI version
   Operating System, Android Studio, Xcode etc.
   -->
   
   Cordova
   
   ## Checklist
   <!-- Please check the boxes by putting an x in the [ ] like so: [x] -->
   
   - [x] I searched for existing GitHub issues
   - [x] I updated all Cordova tooling to most recent version
   - [x] I included all the necessary information above
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org