Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Veracode security scan find flaw in SentrySessionReplaySyncC.c #4428

Open
jarrodlombardo-EventBase opened this issue Oct 10, 2024 · 1 comment

Comments

@jarrodlombardo-EventBase

https://github.com/getsentry/sentry-cocoa/blob/main/Sources/Sentry/SentrySessionReplaySyncC.c#L24
Veracode Flaw info:

Attack Vector: malloc

Number of Modules Affected: 1

Description: The result of this call to malloc() is not checked for success before being used. This can result in application instability or crashing if memory is not available.

Remediation: Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call. Note: These flaws were previously reported as CWE 391. Following Mitre decision to plan for deprecation of CWE 391, CWE 252 was identified as re-categorization for these findings.

Unchecked Malloc can sometimes be a big problem. I don't think this is really important to check here, but I wanted to be sure you knew this was being flagged in the Veracode security scanner.

@brustolin
Copy link
Contributor

Thanks for reaching out @jarrodlombardo-EventBase

I think this is an easy fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Status: Needs Discussion
Development

No branches or pull requests

2 participants