IndexError: string index out of range
Finds vulnerabilities in C/C++ source code
Brought to you by:
dwheeler
Menu
▾
▴
#5 IndexError: string index out of range
Hello;
I passed flawfinder over the Salome Project ( FEA -CAD opensource project and I got this:
kakumen# flawfinder -Q -i ./src3.2.6 > flaws.txt
Traceback (most recent call last):
File "/usr/local/bin/flawfinder", line 1863, in <module>
flawfind()
File "/usr/local/bin/flawfinder", line 1857, in flawfind
if process_files():
File "/usr/local/bin/flawfinder", line 1713, in process_files
process_file_args(files, patch_infos)
File "/usr/local/bin/flawfinder", line 1522, in process_file_args
maybe_process_file(f, patch_infos)
File "/usr/local/bin/flawfinder", line 1473, in maybe_process_file
maybe_process_file(os.path.join(f, file), patch_infos)
File "/usr/local/bin/flawfinder", line 1473, in maybe_process_file
maybe_process_file(os.path.join(f, file), patch_infos)
File "/usr/local/bin/flawfinder", line 1473, in maybe_process_file
maybe_process_file(os.path.join(f, file), patch_infos)
File "/usr/local/bin/flawfinder", line 1473, in maybe_process_file
maybe_process_file(os.path.join(f, file), patch_infos)
File "/usr/local/bin/flawfinder", line 1493, in maybe_process_file
process_c_file(f, patch_infos)
File "/usr/local/bin/flawfinder", line 1303, in process_c_file
c = text[i]
IndexError: string index out of range
Logged In: NO
It seems, that sometimes after calling i = m.end(0) (line 1301) i gets set to file length. Then accessing text[i] causes this exception.
I've just encountered this problem, and IMHO it's rather simple to fix. After i = m.end(0) add (at line 1302) following:
if i == len(text):
continue
(indentation is important)
and flawfinder will begin to work perfectly.
BS.
Patch
Logged In: YES
user_id=678384
Originator: YES
Hello;
I can confirm the suggested change fixed the bug. Thanks!
File Added: patch-flawfinder
Bug confirmed indeed:
Here is a minimal c+ file that shows the problem for testing, note that all whitespace matter:
the file ends with a line with only four spaces
=======================
void some()
{/*some*/}
=======================
well this is a dupe of :
http://sourceforge.net/tracker/index.php?func=detail&aid=1676972&group_id=186989&atid=919501
and
https://sourceforge.net/tracker/?func=detail&aid=1668876&group_id=186989&atid=919499
that has the same issue and same patch and same type of test file
Bug still occurs, I guess this hadn't been fixed yet! (8 years on...). No development anymore? Release to GitHub and we can fork it, fix it!
You can fork now on SourceForge, go to the "code" page.
That said, fair point, I need to get moving on this.
Okay, I've patched it in the development version. I plan to release a new version relatively soon that fixes it. Independent testing is very welcome!
All fixed.
Kudos for fixing!