Skip to content

Out of bounds read in oss-detect-cryptography #290

Closed
microsoft/DevSkim
#349
@scovetta

Description

Using oss-detect-cryptography gives an error (warning w/ stack trace) when analyzing certain files, like below.

root@412946d6c067:/usr/src/app# oss-detect-cryptography pkg:npm/left-pad@1.3.0

   ____   _____ _____    _____           _            _
  / __ \ / ____/ ____|  / ____|         | |          | |
 | |  | | (___| (___   | |  __  __ _  __| | __ _  ___| |_
 | |  | |\___ \\___ \  | | |_ |/ _` |/ _` |/ _` |/ _ \ __|
 | |__| |____) |___) | | |__| | (_| | (_| | (_| |  __/ |_
  \____/|_____/_____/   \_____|\__,_|\__,_|\__, |\___|\__|
                                            __/ |
                                           |___/
OSS Gadget - oss-detect-cryptography 0.1.307+9be4e1e55f - github.com/Microsoft/OSSGadget
WARN  - Error analyzing /tmp/gyeeinxi.udf/npm-left-pad@1.3.0/npm-left-pad@1.3/package/package.json: One or more errors occurred. (Index and length must refer to a location within the string. (Parameter 'length'))
WARN  -    at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
   at System.Threading.Tasks.Task.Wait(TimeSpan timeout)
   at Microsoft.CST.OpenSource.DetectCryptographyTool.AnalyzeDirectory(String directory) in /home/vsts/work/1/s/src/oss-detect-cryptography/DetectCryptographyTool.cs:line 549
Summary Results:
Cryptographic Implementations:
  No implementations found.

Cryptographic Library References:
  No library references found.

Other Cryptographic Characteristics:
  No additional characteristics found

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions