You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@kvrocks.apache.org by "PragmaTwice (via GitHub)" <gi...@apache.org> on 2023/11/11 14:52:43 UTC

[PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

PragmaTwice opened a new pull request, #1891:
URL: https://github.com/apache/kvrocks/pull/1891

   https://github.com/apache/kvrocks/blob/78f87c409348bbde6839ccf4d7bb2be207efbf5e/src/cli/daemon_util.h#L75
   
   The value of `msg_namelen` may cause potentially overflow since `notify_socket` is not the real truncated one. So we need to use `strlen(notify_socket)` instead of `strlen(su.sun_path)`.
   
   Besides, some other code has been cleaned up.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #1891:
URL: https://github.com/apache/kvrocks/pull/1891#issuecomment-1806837032

   SonarCloud Quality Gate failed.&nbsp; &nbsp; [![Quality Gate failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/failed-16px.png 'Quality Gate failed')](https://sonarcloud.io/dashboard?id=apache_kvrocks&pullRequest=1891)
   
   [![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=BUG)  
   [![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=VULNERABILITY)  
   [![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=apache_kvrocks&pullRequest=1891&resolved=false&types=SECURITY_HOTSPOT) [![E](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/E-16px.png 'E')](https://sonarcloud.io/project/security_hotspots?id=apache_kvrocks&pullRequest=1891&resolved=false&types=SECURITY_HOTSPOT) [1 Security Hotspot](https://sonarcloud.io/project/security_hotspots?id=apache_kvrocks&pullRequest=1891&resolved=false&types=SECURITY_HOTSPOT)  
   [![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_kvrocks&pullRequest=1891&resolved=false&types=CODE_SMELL)
   
   [![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=apache_kvrocks&pullRequest=1891) No Coverage information  
   [![1.7%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '1.7%')](https://sonarcloud.io/component_measures?id=apache_kvrocks&pullRequest=1891&metric=new_duplicated_lines_density&view=list) [1.7% Duplication](https://sonarcloud.io/component_measures?id=apache_kvrocks&pullRequest=1891&metric=new_duplicated_lines_density&view=list)
   
   
   
   ![idea](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/light_bulb-16px.png 'idea') Catch issues before they fail your Quality Gate with our IDE extension ![sonarlint](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/sonarlint-16px.png 'sonarlint') [SonarLint](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=sonarcloud-welcome)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

Posted by "git-hulk (via GitHub)" <gi...@apache.org>.
git-hulk commented on PR #1891:
URL: https://github.com/apache/kvrocks/pull/1891#issuecomment-1806842936

   @PragmaTwice Sonar Lint reports hotspot security due to using the stren function in daemon_util.h, but I guess it should be fine since the variable is always set the `\0`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

Posted by "git-hulk (via GitHub)" <gi...@apache.org>.
git-hulk commented on PR #1891:
URL: https://github.com/apache/kvrocks/pull/1891#issuecomment-1806848364

   > > @PragmaTwice Sonar Lint reports hotspot security due to using the stren function in daemon_util.h, but I guess it should be fine since the variable is always set the `\0`.
   > 
   > This `strlen` is not introduced by me lol.
   
   aha, yes i know. What I mean is to ignore this hotspot security report.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

Posted by "PragmaTwice (via GitHub)" <gi...@apache.org>.
PragmaTwice commented on PR #1891:
URL: https://github.com/apache/kvrocks/pull/1891#issuecomment-1806846846

   > @PragmaTwice Sonar Lint reports hotspot security due to using the stren function in daemon_util.h, but I guess it should be fine since the variable is always set the `\0`.
   
   This `strlen` is not introduced by me.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix potentially overflow msg_namelen value in SupervisedSystemd [kvrocks]

Posted by "PragmaTwice (via GitHub)" <gi...@apache.org>.
PragmaTwice merged PR #1891:
URL: https://github.com/apache/kvrocks/pull/1891


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@kvrocks.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org