Skip to content

MB-5526 - [CAT II] gosec G601: Implicit memory aliasing of items from a range statement

Moderate
chtakahashi published GHSA-5hhr-g82q-r6vq Nov 30, 2022

Package

No package listed

Affected versions

1.0

Patched versions

None

Description

Impact
Implicit memory aliasing of items from a range statement can lead to unexpected side effects

References
Fortify URL

Guide from Wiki

Notes
Team Roci encountered this and mitigated it-https://github.com/transcom/mymove/pull/5169/files#diff-acf3a0592a00e200016525619c81f57717cf22412850174f2db7f3a98bf74e12R41

And A-Team encountered a bug caused by G601 MB-5343: fetch-mto-updates shows same destination duty station addressACCEPTED

Note: this PR for the above bug mitigates 7 of the occurrences: https://github.com/transcom/mymove/pull/5267/files

Also see thread from here https://ustcdp3.slack.com/archives/CP4UNF7H6/p1605226485132500?thread_ts=1604601214.094000&cid=CP4UNF7H6

fix requested by Jarod “ I think the risk of subsequent changes introducing a race condition justifies a fix action.”

References

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs