Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Coverity Scan identifies several issues #22

Open
nemequ opened this issue Oct 11, 2015 · 3 comments
Open

Coverity Scan identifies several issues #22

nemequ opened this issue Oct 11, 2015 · 3 comments

Comments

@nemequ
Copy link
Contributor

nemequ commented Oct 11, 2015

I'm running Squash through Coverity Scan, and it identifies several potential issues in ms-compress (at least some of which seem legitimate).

The results aren't public, and it's kind of difficult to just list what it finds since the logic of how it reaches that conclusion is often important, but I can try to summarize if you want. The other options would be to sign of for an account and run the scan yourself, or I could invite you to view the report from Squash.

@coderforlife
Copy link
Owner

Interesting, but it will take some time before I can get around to doing
anything related to this - at least a few weeks.

I do know that there are several "dangerous" parts in the code, that I have
been able to mostly reason out as being impossible, but not trivially so. I
predict some of these are showing up. However, my logic could always be
flawed...

On Sat, Oct 10, 2015 at 6:15 PM, Evan Nemerson [email protected]
wrote:

I'm running Squash through Coverity Scan https://scan.coverity.com/,
and it identifies several potential issues in ms-compress (at least some of
which seem legitimate).

The results aren't public, and it's kind of difficult to just list what it
finds since the logic of how it reaches that conclusion is often important,
but I can try to summarize if you want. The other options would be to sign
of for an account and run the scan yourself, or I could invite you to view
the report from Squash.


Reply to this email directly or view it on GitHub
#22.

@nemequ
Copy link
Contributor Author

nemequ commented Oct 11, 2015

FWIW I'm planning on starting to fuzz all the Squash plugins soon, so if there are issues you'll probably have test cases, too.

@nemequ
Copy link
Contributor Author

nemequ commented Oct 13, 2015

I just took another look through the results for ms-compress. They are all about either unitialized values or trusting tainted data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants