Potential fix for code scanning alert no. 7: Use of potentially dangerous function #2
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/IntelLabs/HEC-openfhe-development-test/security/code-scanning/7
The best way to fix this problem is to replace the use of the potentially dangerous
localtime
function with a thread-safe alternative. In POSIX environments, this means replacingtm* date = localtime(&tnow);
with usage oflocaltime_r
, which takes an explicit buffer for the result. This will ensure that each call tocurrentDateTime()
uses its own storage for thetm
structure, avoiding shared-state bugs.Specifically, in
src/core/lib/utils/debug.cpp
, on line 47, replace the single call tolocaltime
and thetm* date
variable with atm date
struct allocated on the stack, and calllocaltime_r(&tnow, &date);
. All subsequent accesses todate
(i.e., date->tm_hour, ...) must also be changed to dereference the stack variable (i.e.,date.tm_hour
), rather than the pointer.There are no imports or new methods needed for this change. The fix only touches the implementation of
currentDateTime()
in this file.Suggested fixes powered by Copilot Autofix. Review carefully before merging.