186757 2018-06-18 04:13:59 -0700 Properly check the sscanf return value 2018-06-25 03:23:03 -0700 1 1 1 Unclassified WebKit WebKitGTK WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 tpopela tpopela bugs-noreply calvaris cgarcia darin oldest_to_newest 1433938 0 tpopela 2018-06-18 04:13:59 -0700 Found by Coverity scan: 5. webkitgtk-2.20.3/Source/WebCore/page/linux/ResourceUsageThreadLinux.cpp:61: check_return: Calling "sscanf" without checking return value (as is done elsewhere 10 out of 12 times). 6. webkitgtk-2.20.3/Source/JavaScriptCore/jsc.cpp:2099: example_checked: Example 1: "sscanf(timeoutString, "%lf", &s_desiredTimeout)" has its value checked in "sscanf(timeoutString, "%lf", &s_desiredTimeout) != 1". 7. webkitgtk-2.20.3/Source/WTF/wtf/NumberOfCores.cpp:55: example_checked: Example 2: "sscanf(coresEnv, "%u", &numberOfCores)" has its value checked in "sscanf(coresEnv, "%u", &numberOfCores) == 1". 8. webkitgtk-2.20.3/Source/WTF/wtf/linux/MemoryFootprintLinux.cpp:86: example_checked: Example 3: "sscanf(buffer, "Private_Dirty: %lu", &privateDirtyInKB)" has its value checked in "sscanf(buffer, "Private_Dirty: %lu", &privateDirtyInKB) == 1". 9. webkitgtk-2.20.3/Source/JavaScriptCore/runtime/Options.cpp:250: example_assign: Example 4: Assigning: "scanResult" = return value from "sscanf(p, " %u:%u", &this->m_lowLimit, &this->m_highLimit)". 10. webkitgtk-2.20.3/Source/JavaScriptCore/runtime/Options.cpp:252: example_checked: Example 4 (cont.): "scanResult" has its value checked in "scanResult". 11. webkitgtk-2.20.3/Source/JavaScriptCore/runtime/Options.cpp:107: example_checked: Example 5: "sscanf(string, "%lf", value)" has its value checked in "sscanf(string, "%lf", value) == 1". # 59| unsigned long long ioWait, irq, softIrq, steal, guest, guestnice; # 60| ioWait = irq = softIrq = steal = guest = guestnice = 0; # 61|-> sscanf(buffer, "cpu %16llu %16llu %16llu %16llu %16llu %16llu %16llu %16llu %16llu %16llu", # 62| &userTime, &niceTime, &systemTime, &idleTime, &ioWait, &irq, &softIrq, &steal, &guest, &guestnice); # 63| 1433943 1 342924 tpopela 2018-06-18 04:15:51 -0700 Created attachment 342924 Patch 1433969 2 342924 tpopela 2018-06-18 06:43:33 -0700 Comment on attachment 342924 Patch Clearing flags on attachment: 342924 Committed r232929: <https://trac.webkit.org/changeset/232929> 1433970 3 tpopela 2018-06-18 06:43:39 -0700 All reviewed patches have been landed. Closing bug. 1435871 4 342924 darin 2018-06-23 10:09:45 -0700 Comment on attachment 342924 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=342924&action=review > Source/WebCore/page/linux/ResourceUsageThreadLinux.cpp:64 > + if (retVal < 10 || retVal == EOF) { I think this should just be: if (retVal != 10) 1435977 5 tpopela 2018-06-24 21:26:28 -0700 (In reply to Darin Adler from comment #4) > I think this should just be: > > if (retVal != 10) That's true Darin! I will change it. 1436028 6 tpopela 2018-06-25 03:23:03 -0700 Committed r233142: <https://trac.webkit.org/changeset/233142> 342924 2018-06-18 04:15:51 -0700 2018-06-18 06:43:33 -0700 Patch bug-186757-20180618131550.patch text/plain 1885 tpopela U3VidmVyc2lvbiBSZXZpc2lvbjogMjMyOTIyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjJlZWM1YTgzZDE3OWE0 M2E4MTExNmRhNzk4YTEyNzZkNGQ5MWExMy4uYmI5ZTczYTY1MTE0NDk0YTZjMDBmYTA5MTAxMzU1 ZDM5NzMzMWRiZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE4LTA2LTE4ICBUb21h cyBQb3BlbGEgIDx0cG9wZWxhQHJlZGhhdC5jb20+CisKKyAgICAgICAgUHJvcGVybHkgY2hlY2sg dGhlIHNzY2FuZiByZXR1cm4gdmFsdWEKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE4Njc1NworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIENoZWNrIGlmIHdlIG1hdGNoZWQgYW55dGhpbmcgYW5kIGlmIHdlIG1h dGNoZWQgdGhlIGV4cGVjdGVkIGFtb3VudCBvZgorICAgICAgICBkYXRhLgorCisgICAgICAgICog cGFnZS9saW51eC9SZXNvdXJjZVVzYWdlVGhyZWFkTGludXguY3BwOgorICAgICAgICAoV2ViQ29y ZTo6Y3B1UGVyaW9kKToKKwogMjAxOC0wNi0xOCAgVG9tYXMgUG9wZWxhICA8dHBvcGVsYUByZWRo YXQuY29tPgogCiAgICAgICAgIFtHVEtdIFdyb25nIHZhcmlhYmxlIHVzZWQgaW4gUmVuZGVyVGhl bWVHdGsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvbGludXgvUmVzb3VyY2VVc2Fn ZVRocmVhZExpbnV4LmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvbGludXgvUmVzb3VyY2VVc2Fn ZVRocmVhZExpbnV4LmNwcAppbmRleCBkOWU0MTc5MDcyZGZjNjE0YjE4ZWM2ODE2NjhkNmZlMDkw YzA3OWQwLi5iMWY1MWUxNGY2ZmZiZjNkNGFiODI5YTZkMzMxMzFmYjFkNzE1NWMxIDEwMDY0NAot LS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL2xpbnV4L1Jlc291cmNlVXNhZ2VUaHJlYWRMaW51eC5j cHAKKysrIGIvU291cmNlL1dlYkNvcmUvcGFnZS9saW51eC9SZXNvdXJjZVVzYWdlVGhyZWFkTGlu dXguY3BwCkBAIC01OCw4ICs1OCwxNCBAQCBzdGF0aWMgZmxvYXQgY3B1UGVyaW9kKCkKICAgICB1 bnNpZ25lZCBsb25nIGxvbmcgdXNlclRpbWUsIG5pY2VUaW1lLCBzeXN0ZW1UaW1lLCBpZGxlVGlt ZTsKICAgICB1bnNpZ25lZCBsb25nIGxvbmcgaW9XYWl0LCBpcnEsIHNvZnRJcnEsIHN0ZWFsLCBn dWVzdCwgZ3Vlc3RuaWNlOwogICAgIGlvV2FpdCA9IGlycSA9IHNvZnRJcnEgPSBzdGVhbCA9IGd1 ZXN0ID0gZ3Vlc3RuaWNlID0gMDsKLSAgICBzc2NhbmYoYnVmZmVyLCAiY3B1ICAlMTZsbHUgJTE2 bGx1ICUxNmxsdSAlMTZsbHUgJTE2bGx1ICUxNmxsdSAlMTZsbHUgJTE2bGx1ICUxNmxsdSAlMTZs bHUiLAorICAgIGludCByZXRWYWwgPSBzc2NhbmYoYnVmZmVyLCAiY3B1ICAlMTZsbHUgJTE2bGx1 ICUxNmxsdSAlMTZsbHUgJTE2bGx1ICUxNmxsdSAlMTZsbHUgJTE2bGx1ICUxNmxsdSAlMTZsbHUi LAogICAgICAgICAmdXNlclRpbWUsICZuaWNlVGltZSwgJnN5c3RlbVRpbWUsICZpZGxlVGltZSwg JmlvV2FpdCwgJmlycSwgJnNvZnRJcnEsICZzdGVhbCwgJmd1ZXN0LCAmZ3Vlc3RuaWNlKTsKKyAg ICAvLyBXZSBleHBlY3QgMTAgdmFsdWVzIHRvIGJlIG1hdGNoZWQgYnkgc3NjYW5mCisgICAgaWYg KHJldFZhbCA8IDEwIHx8IHJldFZhbCA9PSBFT0YpIHsKKyAgICAgICAgZmNsb3NlKGZpbGUpOwor ICAgICAgICByZXR1cm4gMDsKKyAgICB9CisKIAogICAgIC8vIEtlZXAgcGFyc2luZyBpZiB3ZSBz dGlsbCBkb24ndCBrbm93IGNwdUNvdW50LgogICAgIHN0YXRpYyB1bnNpZ25lZCBjcHVDb3VudCA9 IDA7Cg==