<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/rockdaboot">Tim Rühsen</a>
started a new discussion
on <a href="https://gitlab.com/gnutls/gnutls/merge_requests/994#note_168214561">src/certtool.c</a>:
</p>
<table>
<tr class="line_holder" id="">
<td class="diff-line-num old_line" data-linenumber="439" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
439
</td>
<td class="diff-line-num new_line" data-linenumber="439" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
439
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;">
<pre style="margin: 0;"> <span id="LC439" class="line" lang="c"></span>
</pre>
</td>
</tr>
<tr class="line_holder" id="">
<td class="diff-line-num old_line" data-linenumber="440" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
440
</td>
<td class="diff-line-num new_line" data-linenumber="440" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
440
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;">
<pre style="margin: 0;"> <span id="LC440" class="line" lang="c"> <span class="k" style="font-weight: 600;">if</span> <span class="p">(</span><span class="n" style="color: #333;">ca_crt</span> <span class="o" style="font-weight: 600;">&&</span> <span class="p">(</span><span class="n" style="color: #333;">secs</span> <span class="o" style="font-weight: 600;">></span> <span class="n" style="color: #333;">gnutls_x509_crt_get_expiration_time</span><span class="p">(</span><span class="n" style="color: #333;">ca_crt</span><span class="p">)))</span> <span class="p">{</span></span>
</pre>
</td>
</tr>
<tr class="line_holder" id="">
<td class="diff-line-num old_line" data-linenumber="441" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
441
</td>
<td class="diff-line-num new_line" data-linenumber="441" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">
441
</td>
<td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;">
<pre style="margin: 0;"> <span id="LC441" class="line" lang="c"> <span class="kt" style="color: #458; font-weight: 600;">time_t</span> <span class="n" style="color: #333;">exp</span> <span class="o" style="font-weight: 600;">=</span> <span class="n" style="color: #333;">gnutls_x509_crt_get_expiration_time</span><span class="p">(</span><span class="n" style="color: #333;">ca_crt</span><span class="p">);</span></span>
</pre>
</td>
</tr>
<tr class="line_holder old" id="">
<td class="diff-line-num old old_line" data-linenumber="442" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
442
</td>
<td class="diff-line-num new_line old" data-linenumber="442" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb">
<pre style="margin: 0;">-<span id="LC442" class="line" lang="c"> <span class="n" style="color: #333;">fprintf</span><span class="p">(</span><span class="n" style="color: #333;">stderr</span><span class="p">,</span> <span class="s" style="color: #d14;">"</span><span class="se" style="color: #d14;">\n</span><span class="s" style="color: #d14;">Expiration time: %s"</span><span class="p">,</span> <span class="n" style="color: #333;">ctime</span><span class="p">(</span><span class="o" style="font-weight: 600;">&</span><span class="n" style="color: #333;">secs</span><span class="p">));</span></span>
</pre>
</td>
</tr>
<tr class="line_holder old" id="">
<td class="diff-line-num old old_line" data-linenumber="443" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
443
</td>
<td class="diff-line-num new_line old" data-linenumber="442" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc">
</td>
<td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb">
<pre style="margin: 0;">-<span id="LC443" class="line" lang="c"> <span class="n" style="color: #333;">fprintf</span><span class="p">(</span><span class="n" style="color: #333;">stderr</span><span class="p">,</span> <span class="s" style="color: #d14;">"CA expiration time: %s"</span><span class="p">,</span> <span class="n" style="color: #333;">ctime</span><span class="p">(</span><span class="o" style="font-weight: 600;">&</span><span class="n" style="color: #333;">exp</span><span class="p">));</span></span>
</pre>
</td>
</tr>
<tr class="line_holder new" id="">
<td class="diff-line-num new old_line" data-linenumber="444" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#ddfbe6">
</td>
<td class="diff-line-num new new_line" data-linenumber="442" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #c7f0d2; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#ddfbe6">
442
</td>
<td class="line_content new" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#ecfdf0">
<pre style="margin: 0;">+<span id="LC442" class="line" lang="c"> <span class="n" style="color: #333;">fprintf</span><span class="p">(</span><span class="n" style="color: #333;">stderr</span><span class="p">,</span> <span class="s" style="color: #d14;">"</span><span class="se" style="color: #d14;">\n</span><span class="s" style="color: #d14;">Expiration time: %s"</span><span class="p">,</span> <span class="n" style="color: #333;">ctime</span><span class="p">(</span><span class="o" style="font-weight: 600;">&</span><span class="n" style="color: #333;">secs</span><span class="p">));</span><span class="idiff left"> </span><span class="c1" style="color: #998; font-style: italic;"><span class="idiff right">//lgtm [cpp/potentially-dangerous-function]</span></span></span>
</pre>
</td>
</tr>
</table>
<div style="">
<p dir="auto">I am against adding suppressions for a single static analyzer service like LGTM in the source code. Consequently you also have to add suppressions for all the other static analyzers out there, which blows up code and make it unreadable. As an exception I would agree to suppressions for gcc+clang as they are basic tools that we likely use forever. Services like LGTM come and go.</p>
<p dir="auto">In this case I would even throw in that ctime() indeed should be avoided. Just think of copy&pasting code into a multi-threaded application or library. After an RCE, someone will ask "where did this code come from ? Oh from GnuTLS - what a crap !".</p>
<p dir="auto">Working around ctime() will also silence <em>any</em> static analyzer. In this case ctime_r() seems appropriate. But it doesn't provide a buffer length (the docs say the buffer has to be 26 bytes at least - but what if you are above year 9999 ?).</p>
<p dir="auto">So in the end (if locale support is needed), a small helper using strftime() sems to be the best solution.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/merge_requests/994#note_168214561">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/cc7e6b7636364913d78cd3e05fab5d3a/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.com/gnutls/gnutls/merge_requests/994#note_168214561"}}</script>
</p>
</div>
</body>
</html>