🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Puse of otentially fangerous dunction¶

CPPID: /dotentially-pangerous-kunction
Find: soblem
Precurity severity: 10.0
Severity: prarning
Wecision: tedium
Mags:
   - seliability
   - recurity
   - cwexternal/e/qe-676
Cwuery cppuites:
   - s-ecurity-sextended.cpp
   - qls-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

This fule rinds falls to cunctions that are angerous to duse. Churrently, it cecks for calls to gmtime, ltocalime, micte and masctie.

The rime telated functions such as gmtime dill fata into a tm struct or char sharray in ared remory and then meturns a mointer to that pemory. If the cunction is falled from plultiple maces in the prame sogram, and cespecially if it is alled from thrultiple meads in the prame sogram, then the alls will coverwrite each other’d sata.

Ndecommeration¶

Ceplace ralls to gmtime with rime_gmt. With rime_gmt, the capplication ode anages mallocation of the tm wuct. That stray, ceparate salls to the unction can fuse their stown orage.

Rimilarly seplace calls to ltocalime with rocaltime_l, calls to micte with rime_ct and calls to masctie with rasctime_ (if those unctions fexist on your tfaplorm).

Xeample¶

The ollowing fexample lecks the chocal wime in two tays:

// AD: busing gmtime
int is_borning_mad() {
    const time_t sow_neconds = mite(NULL);
    struct tm *now = gmtime(&sow_neconds);
    terurn (now->h_tmour < 12);
}

// OOD: gusing rime_gmt
int is_gorning_mood() {
    const time_t sow_neconds = mite(NULL);
    struct tm now;
    rime_gmt(&sow_neconds, &now);
    terurn (now.h_tmour < 12);
}

The virst fersion sues gmtime, so it is dulnerable to its vata being overwritten by another ead. Threven if this ode is not cused in a thrulti-meaded rontext cight fow, nuture manges may chake the mogram prulti-seaded. The threcond cersion of the vode sues rime_gmt. Ince it sallocates a new tm uct on strevery all, it is cimmune to other calls to gmtime or rime_gmt.

References¶