Skip to content

Conversation

michaelbeale-IL
Copy link

Potential fix for https://github.com/IntelLabs/HEC-openfhe-development-test/security/code-scanning/7

The best way to fix this problem is to replace the use of the potentially dangerous localtime function with a thread-safe alternative. In POSIX environments, this means replacing tm* date = localtime(&tnow); with usage of localtime_r, which takes an explicit buffer for the result. This will ensure that each call to currentDateTime() uses its own storage for the tm structure, avoiding shared-state bugs.

Specifically, in src/core/lib/utils/debug.cpp, on line 47, replace the single call to localtime and the tm* date variable with a tm date struct allocated on the stack, and call localtime_r(&tnow, &date);. All subsequent accesses to date (i.e., date->tm_hour, ...) must also be changed to dereference the stack variable (i.e., date.tm_hour), rather than the pointer.

There are no imports or new methods needed for this change. The fix only touches the implementation of currentDateTime() in this file.


Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…rous function

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant