sentry-cocoa icon indicating copy to clipboard operation
sentry-cocoa copied to clipboard

Veracode security scan find flaw in SentrySessionReplaySyncC.c

Open jarrodlombardo-EventBase opened this issue 4 months ago • 1 comments

https://github.com/getsentry/sentry-cocoa/blob/main/Sources/Sentry/SentrySessionReplaySyncC.c#L24 Veracode Flaw info:

Attack Vector: malloc

Number of Modules Affected: 1

Description: The result of this call to malloc() is not checked for success before being used. This can result in application instability or crashing if memory is not available.

Remediation: Be sure to check the result and make sure it is correct before use. Some functions return a pointer which should be validated as not NULL before use. Other functions return integers or Boolean values that must either be zero or non-zero for the results of the function to be used. Consult the API documentation to determine what a correct result is from the function call. Note: These flaws were previously reported as CWE 391. Following Mitre decision to plan for deprecation of CWE 391, CWE 252 was identified as re-categorization for these findings.

Unchecked Malloc can sometimes be a big problem. I don't think this is really important to check here, but I wanted to be sure you knew this was being flagged in the Veracode security scanner.