Skip to content

Conversation

@remus-iesan-natterbox
Copy link

@remus-iesan-natterbox remus-iesan-natterbox commented Sep 9, 2025

This pull request addresses Snyk-reported vulnerabilities with a score of 500 or higher across the libs3 codebase.

Key changes:

  1. Memory Management Fixes:
  • Added missing free() calls in several functions to ensure proper release of dynamically allocated memory in bucket.c and bucket_metadata.c.
  1. Safe String Copying:
  • Replaced unsafe strcpy usages with strncpy and ensured null-termination in general.c and service_access_logging.c, preventing possible buffer overflows.
  1. Robust Null Checks:
  • Added a null check after malloc in request.c to prevent dereferencing a null pointer in error scenarios.
  1. General Code Quality Improvements:
  • Improved resource management and input validation throughout affected files.

Files modified:

  • src/bucket.c
  • src/bucket_metadata.c
  • src/general.c
  • src/request.c
  • src/service_access_logging.c

@natterbox-integration
Copy link

natterbox-integration commented Sep 9, 2025

🎉 Snyk checks have passed. No issues have been found so far.

code/snyk check is complete. No issues have been found. (View Details)

Copy link
Collaborator

@codemedic codemedic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please provide more context, in commit messages and code comments.

I can see that you have added comments to the PR but that is easily forgotten about once the PR is closed.

timeoutMs // timeoutMs
};

free(gaData);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gaData is the callbackData which is passed into the perform-request logic.

Without any description of what is being fixed here I cannot suggest an alternative either.

@codemedic
Copy link
Collaborator

Please rebase and change the PR based on redmatter-master branch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants