I reviewed lmdb 0.9.23-0ubuntu1 as checked into eoan. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
lmdb is a software library that provides a high-performance embedded
transactional database in the form a key-value store.
- No CVE History
- Build-Depends
- debhelper
- doxygen
- No pre/post inst/rm scripts
- No init scripts
- No systemd units
- No dbus services
- No setuid binaries
- binaries in PATH
- /usr/bin/mdb_copy
- /usr/bin/mdb_dump
- /usr/bin/mdb_load
- /usr/bin/mdb_stat
- No sudo fragments
- No udev rules
- A couple of tests available in the source code:
- mtest.c: tests for main DB. It's the only test executed during build
(./mtest && ./mdb_stat testdb)
- mtest2.c: tests for subDB
- mtest3.c: tests for sorted duplicated DBs
- mtest4.c: tests for sorted duplicated DBs with fixed-size keys
- mtest5.c: tests for sorted duplicated DBs using cursor_put
- mtest6.c: tests for DB splits and merges
- No cron jobs
- Build logs:
- Lots of warnings during build, mostly related to doxygen macro definitions
- The warnings are attached.
- No Processes spawned
- Memory management
- Lots of dynamic memory allocation and memory copying. In general they look
safe, they are checking for NULL, strings are also NUL terminated and they
are freeing memory after use.
- Lots of File IO
- some paths come from argv but buffer is allocated dynamically based on
user's input.
- Logging
- Binaries in path are logging only to stderr
- No Environment variable usage
- No Use of privileged functions
- No Use of cryptography / random number sources
- srand used in test code
- No Use of temp files
- No Use of networking
- No Use of WebKit
- No Use of PolicyKit
- No significant cppcheck results
- Coverity results
- Some NULL pointer derefence
- Some pthread lock not being unlocked
- Use after free
- Resource leak
- Out-of-bounds access
- I will be forwarding this to upstream to get more feedback if any of them
is a high priority issue.
- Talked to upstream and they confirmed all are false positives.
The code is well maintained and upstream is responsive.
Security team ACK for promoting lmdb to main.
** Attachment added: "build warnings"
https://bugs.launchpad.net/ubuntu/+source/lmdb/+bug/1833745/+attachment/5275933/+files/log.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1833745
Title:
[MIR] required new dependency of appstream
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lmdb/+bug/1833745/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
