prometheus / prometheus/node_exporter
devstat_freebsd.c code scan failed
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13.8k
- Forks
- 2.7k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 8
Description
Host operating system: output of uname -a
Darwin mac.local 19.4.0 Darwin Kernel Version 19.4.0
node_exporter version: output of node_exporter --version
v1.0.0
node_exporter command line flags
Are you running node_exporter in Docker?
no
What did you do that produced an error?
using node_exporter as a package, devstat_freebsd.c doesn't pass codescan
What did you expect to see?
no critical issue
What did you see instead?
codescan critical issue
// devstat_freebsd.c:42
strcpy(p[i].device, current.dinfo->devices[i].device_name);
Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in devstat_freebsd.c at line 42 and inspect how the device field is declared and populated. Run the relevant code scan against this file, then verify that the reported buffer-overflow warning is resolved without changing the FreeBSD device data being collected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100