13 Commits

Author SHA1 Message Date
Ariadne Conill
eab5f5da93 cli: chase pkgconf_client_init changes
Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
2025-12-24 15:35:09 -08:00
Ariadne Conill
c7069a080b cli: {bomtool,spdxtool}: chase pkgconf_client_init change 2025-12-23 16:35:11 -08:00
Ariadne Conill
741ee356b9 cli: declare logging FILE pointers as static
Found using sparse.

Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
2025-12-20 00:00:41 -08:00
Ariadne Conill
6b68231882 bomtool: add PackageDownloadLocation for packages with source tags 2025-10-22 13:55:07 -07:00
Ariadne Conill
9aaff5148c bomtool: only use query dependencies for deriving the SBOM document name 2024-08-06 15:12:27 -07:00
Taylor R Campbell
212c85863a Avoid undefined behaviour with the ctype(3) functions.
fix https://github.com/pkgconf/pkgconf/issues/291

As defined in the C standard:

        In all cases the argument is an int, the value of which shall
        be representable as an unsigned char or shall equal the value
        of the macro EOF.  If the argument has any other value, the
        behavior is undefined.

This is because they're designed to work with the int values returned
by getc or fgetc; they need extra work to handle a char value.

If EOF is -1 (as it almost always is), with 8-bit bytes, the allowed
inputs to the ctype(3) functions are:

        {-1, 0, 1, 2, 3, ..., 255}.

However, on platforms where char is signed, such as x86 with the
usual ABI, code like

        char *ptr = ...;
        ... isspace(*ptr) ...

may pass in values in the range:

        {-128, -127, -126, ..., -2, -1, 0, 1, ..., 127}.

This has two problems:

1. Inputs in the set {-128, -127, -126, ..., -2} are forbidden.

2. The non-EOF byte 0xff is conflated with the value EOF = -1, so
   even though the input is not forbidden, it may give the wrong
   answer.

Casting char to unsigned int first before passing the result to
ctype(3) doesn't help: inputs like -128 are unchanged by this cast,
because (on a two's-complement machine with 32-bit int and unsigned
int), converting the signed char with integer value -128 to unsigned
int gives integer value 2^32 - 128 = 0xffffff80, which is out of
range, and which is converted in int back to -128, which is also out
of range.

It is necessary to cast char inputs to unsigned char first; you can
then cast to unsigned int if you like but there's no need because the
functions will always convert the argument to int by definition.  So
the above fragment needs to be:

        char *ptr = ...;
        ... isspace((unsigned char)*ptr) ...

This patch changes unsigned int casts to unsigned char casts, and
adds unsigned char casts where they are missing.
2023-05-02 11:43:56 -07:00
Ariadne Conill
bddf1641f8 bomtool: fix ASan issues 2022-08-16 20:41:10 +00:00
Ariadne Conill
2c89541101 bomtool: return EXIT_FAILURE if solver fails to solve 2022-08-16 18:50:35 +00:00
Ariadne Conill
c918b6e225 bomtool: enable PKGCONF_PKG_PKGF_SEARCH_PRIVATE to collect dev dependencies 2022-08-13 06:44:40 +00:00
Ariadne Conill
12f3a30980 bomtool: write dependency relationships in both directions 2022-08-13 06:44:19 +00:00
Ariadne Conill
01c1d9f4cc bomtool: remove empty creation date field 2022-08-12 13:07:58 +00:00
Ariadne Conill
9e8052b699 bomtool: add enough to generate a basic SBOM 2022-08-12 12:57:53 +00:00
Ariadne Conill
79327b8967 add bomtool skeleton 2022-08-12 12:07:56 +00:00