PVS-Studio: searching software weaknesses

Common Weakness Enumeration (CWE)

Correspondence between warnings of PVS-Studio and CWE

Demonstration

#define myConnConfig(c) \
(SSLConnRec *)ap_get_module_config(c->conn_config, &ssl_module)
....int ssl_callback_alpn_select(SSL *ssl,
const unsigned char **out, unsigned char *outlen,
const unsigned char *in, unsigned int inlen,
void *arg)
{
conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
SSLConnRec *sslconn = myConnConfig(c);
apr_array_header_t *client_protos;
const char *proposed;
size_t len;
int i;
/* If the connection object is not available,
* then there's nothing for us to do. */
if (c == NULL) {
return SSL_TLSEXT_ERR_OK;
}
....
}
SSLConnRec *sslconn = myConnConfig(c);
if (c == NULL) {
#define myConnConfig(c) \
(SSLConnRec *)ap_get_module_config(c->conn_config, &ssl_module)
int get_password(struct passwd_ctx *ctx)
{
char buf[MAX_STRING_LEN + 1];
....
memset(buf, '\0', sizeof(buf));
return 0;
err_too_long:
....
}
static int is_quoted_pair(const char *s)
{
int res = -1;
int c;
if (((s + 1) != NULL) && (*s == '\\')) {
c = (int) *(s + 1);
if (apr_isascii(c)) {
res = 1;
}
}
return (res);
}
if ((*(s + 1) != '\0') && (*s == '\\')) {

Conclusion

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Unicorn Developer

Unicorn Developer

The developer, the debugger, the unicorn. I know all about static analysis and how to find bugs and errors in C, C++, C#, and Java source code.