lib/raster: fixed security vulnerabilities and weaknesses

[jadenabrams100]

This PR fixes three vulnerabilities/weaknesses found with older scans of Coverity.

Issue 1208372 in error.c concerns an unbounded read of an environment variable into memory. An attacker could overwrite the environment variable that is accessed by G__home() and exploit it to overflow the buf array.

Issue 1501330 in mapset_msc.c concerns writing into an array that is not null terminated. If the path variable was not null terminated, the write could fill the whole array with data without a null terminator, causing trouble down the line.

Issue 1207344 in raster/r.gwflow/main.c concerns a constant variable guarding dead code. This is not exactly a security vulnerability, but is a code quality issue I was able to easily fix.

[nilason]

I added some suggestion. In general it is advisable to constrain buffer sizes defined by constants like GPATH_MAX to include null terminator (i.e. not to increase it with 1).

[jadenabrams100]

I am not certain why the MacOS job failed.

[echoix]

I am not certain why the MacOS job failed.

Just to make sure I made a rerun of the job, and still failed early.

The earliest possible error that I was only able to spot was the linker not being able to link libgrass, but didn’t find another more descriptive error in the compilation.

[echoix]

I'm surprised that another Clang-based job didn't fail. I only see that Travis builds with gcc and clang, but on Ubuntu focal. I thought we had more clang jobs than that.

[nilason]

I am not certain why the MacOS job failed.

In the CI log you can find the reason:

mapset_msc.c:189:5: error: array index 4096 is past the end of the array (that has type 'char[4096]') [-Werror,-Warray-bounds]
    path[GPATH_MAX] = '\0';
    ^    ~~~~~~~~~
mapset_msc.c:186:5: note: array 'path' declared here
    char path[GPATH_MAX] = {'\0'};
    ^
1 error generated.

which is the same issue as the CodeQL reports.

[nilason]

I'm surprised that another Clang-based job didn't fail. I only see that Travis builds with gcc and clang, but on Ubuntu focal. I thought we had more clang jobs than that.

The macOS CI is built with -Wall -Wextra -Wpedantic -Werror, which makes the difference. The gcc CI's have the same build flags, but gcc has different set of warnings activated with those compared to clang.

[echoix]

Is this ready now that CI passes?

[jadenabrams100]

Is this ready now that CI passes?

Yes, it is ready now.