Fix CodeQL security issues #7985
Conversation
|
✅ With the latest revision this PR passed the C/C++ code formatter. |
damyanp
left a comment
damyanp
left a comment
There was a problem hiding this comment.
Some comments below, but also I think that the description should explain what the CodeQL issues are and how they've been addressed - particularly for the two files that have been deleted.
| for (unsigned int c = 0; c < SE.GetCols(); c++) { | ||
| unsigned int Comp = SE.GetStartCol() + c; |
There was a problem hiding this comment.
nit: for better or worse, I think LLVM code tends to prefer unsigned to unsigned int. I'm not sure if that's an explicit coding standards thing or not though.
|
|
||
| CMask::CMask(BYTE StartComp, BYTE NumComp) { | ||
| DXASSERT(StartComp < DXBC::kAllCompMask && NumComp <= DXBC::kAllCompMask && | ||
| (StartComp + NumComp - 1) < DXBC::kAllCompMask, |
There was a problem hiding this comment.
I think this assert expression isn't correct:
DXASSERT(StartComp < DXBC::kAllCompMask && NumComp <= DXBC::kAllCompMask &&
(StartComp + NumComp - 1) < DXBC::kAllCompMask,I think it should be this instead: (StartComp + NumComp) <= DXBC::kWidth
DXASSERT(StartComp < DXBC::kWidth && NumComp <= DXBC::kWidth &&
(StartComp + NumComp) <= DXBC::kWidth,DXBC::kAllCompMask is 0x0F, which isn't the number of components available, but the mask with all components enabled.
With this corrected, I think @damyanp's comment below for having an assert like (StartComp + NumComp) < 256 is unnecessary.
joaosaffran
changed the title
6 participants
This path fixes 7 issues raised by codeql:
dxcapi.use.h- [SM01925] Uncontrolled process operation: Add comment, so the scan can ignore this issue.ProgramTest.cpp- [SM01932] User-controlled data may not be null terminated: Add comment, so the scan can ignore this issue.DxbcConverter.cpp- [SM01928] Comparison of narrow type with wide type in loop condition: Change affected variable to beunsignedinstead ofBYTE.ExecutionTest.cpp- [SM01733] Too few arguments to formatting function: Remove an argument that didn't seem to be used.DxbcUtil.cpp- [SM01928] Comparison of narrow type with wide type in loop condition: Cast the result of+operator back to BYTE, since it was implicit being cast to an int.DSAclean.py- [SM03905] Inefficient regular expression: Script doesn't seem to be used anymore, so it is being removed.CaptureCmd- [SM02167] Weak hashes : Script doesn't seem to be used anymore, so it is being removed.