A flaw reported by Flawfinder, but I don't think it makes sense

问题

The question is specific to a pattern that Flawfinder reports:

The snippet

    unsigned char child_report;
    ...
    auto readlen = read(pipefd[0], (void *) &child_report, sizeof(child_report));
    if(readlen == -1 || readlen != sizeof(child_report)) {
      _ret.failure = execute_result::PREIO ; // set some flags to report to the caller
      close(pipefd[0]);
      return _ret;
    }
    ...
    int sec_read = read(pipefd[0], (void *) &child_report, sizeof(child_report));
    child_report = 0; // we are not using the read data at all
                      // we just want to know if the read is successful or not
    if (sec_read != 0 && sec_read != -1) { // if success
      _ret.failure = execute_result::EXEC; // it means that the child is not able to exec
      close(pipefd[0]);                    // as we set the close-on-exec flag
      return _ret;                         // and we do write after exec in the child 
    }

I turned out that Codacy (therefore flawfinder) reports such issues on both read:

Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20).

I don't understand.

1. There is no loop.
2. In the second case we are not using the read data at all
3. This is not typical C string, and we don't rely on the ending '\0'

Is there any flaw that I'm not aware of in the code?

回答1:

I finally conclude this should be a false positive. I check Flawfinder's code and it seems that it is basically doing pattern matching.

https://github.com/david-a-wheeler/flawfinder/blob/293ca17d8212905c7788aca1df7837d4716bd456/flawfinder#L1057

来源：https://stackoverflow.com/questions/59293533/a-flaw-reported-by-flawfinder-but-i-dont-think-it-makes-sense