Hello GNU libmicrohttpd team,
My name is Vladimir Yavorsky, and I am a software engineer. While building
your libmicrohttpd packages, I encountered warnings about ignored read()
and fgets() results.
The following code is present in source versions 1.0.1, 1.0.2, 1.0.5,
1.0.6, 1.0.7, 1.0.8, 1.0.9 and 1.0.10:
- src/microhttpd/mhd_itc.h: the eventfd implementation of
MHD_itc_clear_() discards the read() result with a cast to void.
- src/tools/perf_replies.c: the Enter-to-stop path discards the fgets()
result.
The warnings were reproduced with unmodified 1.0.10 and GCC 13.3.0, using
these commands from the source directory:
CFLAGS='-O2 -g -D_FORTIFY_SOURCE=2 -Wunused-result' \
./configure --disable-https --disable-doc --disable-examples \
--disable-static --enable-shared
make -j2
Is ignoring these results intentional? Would you consider retrying read()
on EINTR (interruption by a signal), and distinguishing EOF (end of input)
from an input error in perf_replies, while calling MHD_stop_daemon()
correctly?
This report concerns build warnings. An HTTP server crash or remote
exploitation has not been established. Since these code paths are also
present in earlier versions, this should not be described as a new
regression in 1.0.10.
Thank you.
Best regards,
Vladimir Yavorsky
Software Engineer
