148257 - flawfinder warnings in XUL C++ code

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

I run flawfinder (http://www.dwheeler.com/flawfinder) on Mozilla 1.0.1 branch.

flawfinder found 42 warnings in XUL code (3619-3644 and 4595-4610). Go through
that list and for each warning:

* If it is false positive, comment here why it is not an issue
* If it is a real issue, make patch for it here and let's get them checked in

In addition the checking the branch, also check the trunk.

I will attach a subset of the URL that only has the XUL warnings since the full
file is behind NS firewall and it is so big.

Comment 1

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Attachment: flawfinder warnings

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Attachment: I have cut out the obvious false positives and added some comments; please disregard the attachment above and use this one instead.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I verified all these myself. They're either sprintf with format "%d" and a
buffer of at least 50 characters (plenty), or they're sprintfs in DEBUG code.