smikes / cppunitlite Goto Github PK

cppunit fails to build, Error Message: "npm ERR! Failed at the [email protected] install script 'node-gyp rebuild'." Log File is Attached to this issue.

log.txt

Mac OS X Yosemite: I am building my c++ bindings as a bundle (mh_bundle). This seems to be the default for node-gyp. Now, I want to use cppunitlite npm module to test my c++ bindings, but I am having issues linking or dlopen my main bindings file. Do you have an example of how to link your test target to your main target?

From Brave: https://github.com/brave/browser-ios/blob/development/brave/node_modules/tracking-protection/node_modules/cppunitlite/src/SimpleString.cpp#L85

sprintf (buffer, "%lf", value);

Does not check for buffer overflows, If message's length > str's length, there's a buffer overflow.

This issue was reported to brave via hackerone, they marked my bug as informative and close it by saying.

The code that you highlighted is part of the npm module cppunitlite. The npm module is used in the tracking protection library in the iOS browser, but the code snippet that you highlighted is not used in the code.

You can report the issue here for a fix from the author: https://github.com/smikes/CppUnitLite/

Thanks, Dhiraj

The part where you're showing how to add cppunitlite in the include_dirs is slightly wrong, I think. It seems like the end should actually be ")'
So this:

'<!(node -e "require(\'cpppunitlite\')'

Should actually be:

'<!(node -e "require(\'cppunitlite\')")'

in Failure.cpp, it has:

char *stage = new char [strlen (part1)
					+ expected.size ()
					+ strlen (part3)
					+ actual.size ()
					+ 1];
///other code here..

	delete stage;  //This is incorrect.. it should be `delete[]` and not `delete`.

It uses delete instead of delete[] on stage which is an array. This is undefined behaviour and can lead to unexpected crashes.

In SimpleString.cpp, it has:

SimpleString SimpleString::operator= (const SimpleString& other)
{
	delete buffer;  //This is incorrect.. it should be `delete[]` and not `delete`.
	buffer = new char [other.size() + 1];
	strcpy(buffer, other.buffer);
	return *this;
}

It uses delete instead of delete[] for buffer which is an array. This is undefined behaviour and can lead to unexpected crashes.

CXX(target) Release/obj.target/CppUnitLite/node_modules/cppunitlite/src/Failure.o
../node_modules/cppunitlite/src/Failure.cpp:30:16: warning: conversion from string literal to 'char *' is deprecated
[-Wdeprecated-writable-strings]
char *part1 = "expected ";
^
../node_modules/cppunitlite/src/Failure.cpp:31:16: warning: conversion from string literal to 'char *' is deprecated
[-Wdeprecated-writable-strings]
char *part3 = " but was: ";
^
2 warnings generated.