Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 533558 - dev-python/pyscard-1.6.12: severe QA warnings for C code
Summary: dev-python/pyscard-1.6.12: severe QA warnings for C code
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Crypto team [DISABLED]
URL: https://sourceforge.net/p/pyscard/bug...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-25 23:32 UTC by Michał Górny
Modified: 2014-12-31 22:07 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Build log .gz (dev-python:pyscard-1.6.12:20141225-232932.log.gz,7.76 KB, application/gzip)
2014-12-25 23:32 UTC, Michał Górny
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-12-25 23:32:24 UTC
Created attachment 392408 [details]
Build log .gz

* smartcard/scard/memlog.h:50:26: warning: attempt to free a non-heap object ‘temp3’ [-Wfree-nonheap-object]
 * smartcard/scard/memlog.h:50:26: warning: attempt to free a non-heap object ‘temp3’ [-Wfree-nonheap-object]
 * smartcard/scard/memlog.h:50:26: warning: attempt to free a non-heap object ‘temp4’ [-Wfree-nonheap-object]
 * smartcard/scard/memlog.h:50:26: warning: attempt to free a non-heap object ‘temp4’ [-Wfree-nonheap-object]

etc.
Comment 1 Alon Bar-Lev (RETIRED) gentoo-dev 2014-12-25 23:37:08 UTC
 * Please do not file a Gentoo bug and instead report the above QA
 * issues directly to the upstream developers of this software.
 * Homepage: http://pyscard.sourceforge.net/ http://pypi.python.org/pypi/pyscard

?
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-12-25 23:43:51 UTC
Sure, if you don't care about the package. pyscard + pssi suggested for treecleaning.
Comment 3 Alon Bar-Lev (RETIRED) gentoo-dev 2014-12-25 23:47:32 UTC
(In reply to Michał Górny from comment #2)
> Sure, if you don't care about the package. pyscard + pssi suggested for
> treecleaning.

The # of packages that are classified as "crypto" is huge. Mostly added per developers that maintained by their own, then given up, or someone that actually used a package and then left.

These cases are maintained by me only when there is a report with a solution or a solution is trivial, as I cannot actually test all, not to mention that I do not use these.

I am fine with tree cleaning this one, or leave it per upstream low quality state...
Comment 4 Pacho Ramos gentoo-dev 2014-12-26 11:03:04 UTC
@mgorny, is this problem major enough for treecleaning the package? (to try to explain it a bit more in lastrites message and prevent people from blaming on me trying to kill "working" packages ;))

@alonbl, feel free to CC us (treecleaners) on any bug assigned to crypto that you consider could deserve the removal of the package and we will take care of the rest of the process :)
Comment 5 Alon Bar-Lev (RETIRED) gentoo-dev 2014-12-26 17:14:01 UTC
(In reply to Pacho Ramos from comment #4)
> @mgorny, is this problem major enough for treecleaning the package? (to try
> to explain it a bit more in lastrites message and prevent people from
> blaming on me trying to kill "working" packages ;))

I do not think it is major enough.
Comment 6 Alon Bar-Lev (RETIRED) gentoo-dev 2014-12-30 22:08:19 UTC
we checked this, the code is swig generated, and there is a conditional to avoid releasing non heap addresses, this is false positive.
Comment 7 Pacho Ramos gentoo-dev 2014-12-31 21:36:38 UTC
Isn't there anything portage could use to detect this kind of false positives?
Comment 8 Alon Bar-Lev (RETIRED) gentoo-dev 2014-12-31 21:43:08 UTC
(In reply to Pacho Ramos from comment #7)
> Isn't there anything portage could use to detect this kind of false
> positives?

hmmm... I do not know about portage detection...

but the code looks like:

{
    char buffer[100];
    variable var = &buffer;
    var->allocated = false;

    <snip>

    if (var->allocated) {
        free(var);
    }
}

as this is generated code (swig), I guess they wanted to avoid extra logic and apply same epilogue to all cases.
Comment 9 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-12-31 22:06:58 UTC
If something indeed cares enough to find out that this never evaluates to true, it's more likely to throw another warning about condition that always evaluates to true :).
Comment 10 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-12-31 22:07:11 UTC
Sorry, I meant false :).