Skip to content

Potential fix for code scanning alert no. 24: Use of potentially dangerous function#327

Merged
cwlacewe merged 3 commits intodevelopfrom
alert-autofix-24
Apr 7, 2026
Merged

Potential fix for code scanning alert no. 24: Use of potentially dangerous function#327
cwlacewe merged 3 commits intodevelopfrom
alert-autofix-24

Conversation

@cwlacewe
Copy link
Copy Markdown
Contributor

@cwlacewe cwlacewe commented Apr 7, 2026

Potential fix for https://github.com/IntelLabs/vdms/security/code-scanning/24

To fix the issue, replace the use of std::localtime with the thread-safe version localtime_r, which requires explicit allocation of a struct tm on the stack and then passing its pointer to receive the result. We need to edit line 269 of src/Server.cc, allocate a local struct tm variable, and use localtime_r to populate it. The code that uses now_tm remains unchanged, except we reference our stack variable instead of the potentially shared static buffer.

Typically, C++ standard library does not provide a direct wrapper for localtime_r, but POSIX (localtime_r) is broadly available on Linux and macOS, which matches the includes and style here. We'll need to include <time.h> for the function signature in case it has not been included. The change is localized to the region around line 269; no other changes are needed in file or method.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

cwlacewe and others added 2 commits April 7, 2026 08:28
…erous function

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…erous function

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

Target CPP Coverage: 68.113%
Source CPP Coverage: 68.1076%

Target Python Coverage: 97.94%
Source Python Coverage: 97.94%

@cwlacewe cwlacewe marked this pull request as ready for review April 7, 2026 17:13
@cwlacewe cwlacewe requested a review from sys-vdms April 7, 2026 17:20
@cwlacewe cwlacewe merged commit d36d4e8 into develop Apr 7, 2026
@cwlacewe cwlacewe deleted the alert-autofix-24 branch April 7, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants