CMFSUPPORT-3890 : COVERITY TEST. DO NOT MERGE - #11
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| char* cursor = content_data; | ||
| char* eof = content_data + content_len; | ||
|
|
||
| printf("Test coverity flow %s"); |
Check warning
Code scanning / CodeQL
Too few arguments to formatting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
In general, to fix “too few arguments to formatting function” issues, either (a) remove or adjust the format specifiers so they match the actual number and types of arguments passed, or (b) add the missing arguments of the correct types to the call. The goal is for each % specifier in the format string to have a corresponding argument.
For this specific call in source/jst_post.c at line 701:
printf("Test coverity flow %s");the simplest and safest fix without changing existing functionality is to remove the unused %s placeholder, because there is no obvious string we should be printing there and the message appears to just be a static debug string. Changing it to:
printf("Test coverity flow\n");or
printf("Test coverity flow");eliminates the format-argument mismatch while preserving the intended debug output. No new imports or helper methods are needed, and the behavior remains a simple console message. If you prefer to keep the %s for some reason, you would instead need to add a corresponding string argument, such as printf("Test coverity flow %s", "");, but that is unnecessarily confusing compared to removing the specifier.
The change is localized to the parse_mpfd function in source/jst_post.c, around line 701, and requires only editing that single printf line.
| @@ -698,7 +698,7 @@ | ||
| { | ||
| char* cursor = content_data; | ||
| char* eof = content_data + content_len; | ||
| printf("Test coverity flow %s"); | ||
| printf("Test coverity flow\n"); | ||
| while(cursor < eof) | ||
| { | ||
| while(cursor < eof - boundary_len) |
There was a problem hiding this comment.
Pull request overview
This PR appears to introduce intentional issues to exercise Coverity/static-analysis reporting and adjust compiler flags to avoid build breaks during that test.
Changes:
- Added a debug
printfcall in multipart form-data parsing. - Modified build flags to enable
-Werrorwhile exempting-Werror=format.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| source/jst_post.c | Adds a printf in parse_mpfd() (multipart parsing path). |
| source/Makefile.am | Adjusts warning/error flags, including disabling -Werror for format warnings. |
Comments suppressed due to low confidence (1)
source/Makefile.am:25
- Adding
-Wno-error=format(and settingAM_CPPFLAGSto it) weakens compile-time format-string checking repo-wide, which can hide real bugs and potential format-string vulnerabilities. Prefer fixing the underlying format issues (e.g., the newprintf) and keeping format warnings as errors rather than globally disabling them.
AM_CFLAGS += -Werror -Wno-error=format
AM_LDFLAGS = -lccsp_common
AM_CPPFLAGS = -Wno-error=format
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| char* cursor = content_data; | ||
| char* eof = content_data + content_len; | ||
|
|
||
| printf("Test coverity flow %s"); |
There was a problem hiding this comment.
printf("Test coverity flow %s"); uses a %s format specifier without providing an argument, which is undefined behavior and can crash or leak memory. Also, writing to stdout from request parsing can corrupt CGI/HTTP responses; remove this debug print or replace it with the project logging facility with a correct format string and arguments.
| printf("Test coverity flow %s"); | |
| CosaPhpExtLog("Test coverity flow\n"); |
| char* cursor = content_data; | ||
| char* eof = content_data + content_len; | ||
|
|
||
| printf("Test coverity flow %s"); |
There was a problem hiding this comment.
Coverity Issue - Printf arg count mismatch
the format string requires additional arguments
Medium Impact, CWE-685
PW.TOO_FEW_PRINTF_ARGS
| char* cursor = content_data; | ||
| char* eof = content_data + content_len; | ||
|
|
||
| printf("Test coverity flow %s"); |
There was a problem hiding this comment.
Coverity Issue - Missing argument to printf format specifier
No argument for format specifier "%s".
Medium Impact, CWE-685
PRINTF_ARGS
|
Close test PR |
DO NOT MERGE