SMitchell165725 (Community Member) asked a question.
We are scanning a third party library (https://github.com/DanBloomberg/leptonica/blob/24ba80d42592b7764d4ff1405e4dd078218f0e87/src/pdfio2.c) and keep getting "Failure to Handle Missing Parameter (CWE ID 234" Im not a C developer but I can see what is different or wrong with the examples that have been highlighted (lines 1845,1853,2276,2301) can anyone shed some light on this as im a bit stuck 🙂
Affected lines:
1845:
snprintf(buff, sizeof(buff), "/BitsPerComponent %d", cid->bps);
1853:
snprintf(buff, sizeof(buff),
"/DecodeParms\n"
"<<\n"
" /Columns %d\n"
" /Predictor 14\n"
" /Colors %d\n"
" /BitsPerComponent %d\n"
">>\n", cid->w, cid->spp, cid->bps);
2276:
snprintf((char *)buf, 32, "%d", objout);
2301:
snprintf((char *)buf, 32, "%d", objout);
**************
Failure to handle missing parameter - leptonica/src/colormap.c 2045
snprintf(buf, sizeof(buf), "%02x", data[3 * i + 1]);
**************
.png){kind=logo}
Hi @SMitchell165725 (Community Member)​ , thank you for your question. I am sorry that we haven't got you a response yet. I'll reach out to other Community members and our Application Security Consultant team to potentially help. Stay tuned while they have a chance to check out your thread and respond. In the meantime, let us know if you have any additional questions or updates with a comment on this thread too!
Hi @SMitchell165725 (Community Member)​ ,
The source code provided appears to be using snprintf correctly. Please ensure the library has been compiled per our compilation guide:
https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/buYskUiDRTdtZy6kSkof2Q and contact Veracode Support if these flaws persist. You can create an issue from the Community by clicking on your avatar in the top right corner and clicking "Contact Support".
Thank you,
Boy Baukema