ihsinme

difficulty in understanding priorities.

1

simple fix, makes the code pretty.

Consistently check return value from fseek()/lseek(), such as by using a wrapper

12

I have tracked 13 places where you are not using this wrapper. https://github.com/openwall/john/blob/6dca7c39c56fbf7463de2ef6690ec557b2b51d6e/src/zip2john.c#L160 I think it is quite simple and safer than a direct call to `fseek`

Work with the file without restriction of rights

1

I may be wrong, but I see in your code working with a file without setting permissions. this can lead to a security problem. both by the vector of confidentiality...

Good afternoon. I noticed in your code the functions using tmpnam. the problem with this function is that it only determines the availability of the filename at the time it...

https://github.com/Netflix/dynomite/blob/b56cf6a0e51a3c1941359da44af9e432c64b2f90/src/dynomite.c#L151 Good afternoon. I noticed that your code uses umask (0) with calls to open files without setting permissions. then your program will work with files with wide enough permissions...

I may be wrong, but I see in your code working with a file without setting permissions. this can lead to a security problem. both by the vector of confidentiality...

CPP: Add query for CWE-297: Improper Validation of Certificate with Host Mismatch

25

this query finds certificate situations without name validation. I tried to take into account all cases of name processing, so there are old methods. CVE-2010-1155 CVE-2013-7449 CVE-2016-10937 I had some...

CPP: Add query for CWE-758: Reliance on Implementation-Defined Behavior when using malloc with zero size

16

this query looks for undefined behaviors associated with a malloc call with size zero. in this case, we can get a non-zero answer and we will no longer be able...

CPP: Add query for CWE-805: Buffer Access with Incorrect Length Value using some functions

15

This query is looking for a simple error condition in the argument. It seemed to me that in working with this problem, the functions of working with ssl were undeservedly...

correction of a knowingly false condition.

1

this if is not achievable because if the condition is true, then it is implemented above with the exit from the function. I suggest a simple fix.