diff --git a/flawfinder b/flawfinder index 2ac92db..029ed23 100755 --- a/flawfinder +++ b/flawfinder @@ -1277,10 +1277,18 @@ c_ruleset = { "Use InitializeCriticalSectionAndSpinCount instead", "misc", "", {}), - "EnterCriticalSection": - (normal, 3, "On some versions of Windows, exceptions can be thrown in low-memory situations", - "Use InitializeCriticalSectionAndSpinCount instead", - "misc", "", {}), + # We have *removed* the check for EnterCriticalSection. + # The page from the "book Writing Secure Code" describes + # EnterCriticalSection as something that will not throw errors on XP, + # .NET Server, and later. Windows XP EOL in April 8, 2014, + # .Net Server EOL 14 July 2015, so users of those systems will have + # larger security issues anyway. + # My thanks to rgetz for reporting this. For details, see: + # https://github.com/david-a-wheeler/flawfinder/issues/19 + # "EnterCriticalSection": + # (normal, 3, "On some versions of Windows, exceptions can be thrown in low-memory situations", + # "Use InitializeCriticalSectionAndSpinCount instead", + # "misc", "", {}), "LoadLibrary|LoadLibraryEx": (normal, 3, "Ensure that the full path to the library is specified, or current directory may be used (CWE-829, CWE-20)", diff --git a/test/correct-results-008.txt b/test/correct-results-008.txt index 2932943..980f114 100644 --- a/test/correct-results-008.txt +++ b/test/correct-results-008.txt @@ -1,6 +1,6 @@ Flawfinder version 2.0.11, (C) 2001-2019 David A. Wheeler. Showing hits not in test-saved-hitlist-008.txt -Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 +Number of rules (primarily dangerous function names) in C/C++ ruleset: 222 ANALYSIS SUMMARY: diff --git a/test/correct-results.html b/test/correct-results.html index 3af0f8b..92c753c 100644 --- a/test/correct-results.html +++ b/test/correct-results.html @@ -11,7 +11,7 @@ Here are the security scan results from Flawfinder version 2.0.11, (C) 2001-2019 David A. Wheeler. -Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 +Number of rules (primarily dangerous function names) in C/C++ ruleset: 222

Examining test.c
Examining test2.c
diff --git a/test/correct-results.txt b/test/correct-results.txt index 9b89dc6..dc6df28 100644 --- a/test/correct-results.txt +++ b/test/correct-results.txt @@ -1,5 +1,5 @@ Flawfinder version 2.0.11, (C) 2001-2019 David A. Wheeler. -Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 +Number of rules (primarily dangerous function names) in C/C++ ruleset: 222 Examining test.c Examining test2.c