CMFSUPPORT-3863. COVERITY TEST. DO NOT MERGE - #58
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if ((file = fopen(fpath, "w"))) | ||
| { | ||
| fprintf(file,"%s",str); | ||
| fprintf(file,"%s%s",str); |
Check warning
Code scanning / CodeQL
Too few arguments to formatting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
To fix this class of issue, ensure every format specifier in fprintf has a corresponding argument, or simplify the format to match the provided arguments.
Best fix here (without changing behavior): in source/AdvSecurityDml/cosa_adv_security_internal.c, inside advsec_write_to_file, replace:
fprintf(file,"%s%s",str);
with:fprintf(file, "%s", str);
This preserves the apparent intent (write str to file) while removing undefined behavior. No new imports, methods, or definitions are needed.
| @@ -316,7 +316,7 @@ | ||
|
|
||
| if ((file = fopen(fpath, "w"))) | ||
| { | ||
| fprintf(file,"%s%s",str); | ||
| fprintf(file, "%s", str); | ||
| fclose(file); | ||
| return 1; | ||
| } |
There was a problem hiding this comment.
Pull request overview
This PR modifies the internal helper used to write strings to a file in the Advanced Security DML component.
Changes:
- Updates the
fprintfformat string used byadvsec_write_to_file().
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| fprintf(file,"%s%s",str); | ||
| fclose(file); | ||
| return 1; |
There was a problem hiding this comment.
fprintf(file, "%s%s", str); is undefined behavior because the format string expects two %s arguments but only one is provided. This can crash or leak stack data. Use a single %s (or add the intended second string argument, e.g., a newline/terminator) and consider checking fprintf’s return value if write failures matter here.
| fprintf(file,"%s%s",str); | |
| fclose(file); | |
| return 1; | |
| int written = fprintf(file, "%s", str); | |
| fclose(file); | |
| return (written >= 0) ? 1 : 0; |
| if ((file = fopen(fpath, "w"))) | ||
| { | ||
| fprintf(file,"%s",str); | ||
| fprintf(file,"%s%s",str); |
Check warning
Code scanning / Coverity
Missing argument to printf format specifier Warning
No description provided.