Skip to content

fix: numerous vulnerabilities in native code#940

Merged
traeok merged 38 commits intomainfrom
fix/vulns
Apr 23, 2026
Merged

fix: numerous vulnerabilities in native code#940
traeok merged 38 commits intomainfrom
fix/vulns

Conversation

@traeok
Copy link
Copy Markdown
Member

@traeok traeok commented Apr 15, 2026 •
edited
Loading

What It Does

Resolves numerous vulnerabilities in the code (both C++ and Metal C) to improve codebase stability.

How to Test

  • npm run z:rebuild && npm run z:test should succeed w/o errors
  • Use VSCE as normal - all features should remain functional 😋

Review Checklist
I certify that I have:

traeok added 17 commits April 14, 2026 11:27
@traeok
fix(zds): Bounded copy for dsname, volser
89bd269 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zutm): bounded copy for parms
a212b84 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zut): fail in zut_bpxwdyn_common if parm larger than max len
3ad2748 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zdsm): rename macro to avoid collisions in C++
c504b4c 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zut): off-by-one buffer overflow possibility
f613749 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zam24): Remove redundant BR R14 instruction
a4ffefa 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
refactor(zds): Make etag copy more robust
bb4a6b9 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(uss): unchecked indexing for CSV parse
2bff6ea 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zds): avoid possible csifiltk overflow
d3c3110 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zds): Truncate error message for 31-bit alloc
0dc3898 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zds): avoid indexing UB in zds_is_valid_member_name
a8d6ee0 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zcn): 1-byte buffer overflow
3334360 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zcnm31): command text overflow for MGCRE
0f908e1 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
refactor: ZDIAG_SET_MSG helper to avoid overflow
e283577 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zusf): avoid argv option injection
19f0213 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zjson): Depth cap of 64 for recursive branches
e0f34fe 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zlogger): buffer overflow possibilities
0aa1ee0 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@github-project-automation github-project-automation Bot moved this to New Issues in Zowe CLI Squad Apr 15, 2026
@zowe-robot zowe-robot moved this from New Issues to In Progress in Zowe CLI Squad Apr 15, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 15, 2026 •
edited
Loading

Client artifacts:

github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 15, 2026
View reviewed changes
Comment thread native/c/zjbm.c Fixed
Comment thread native/c/zjbm.c Fixed
Comment thread native/c/zjbm.c Fixed
dkelosky
dkelosky reviewed Apr 15, 2026
View reviewed changes
Comment thread native/c/ztype.h
dkelosky
dkelosky reviewed Apr 15, 2026
View reviewed changes
Comment thread native/c/ztype.h Outdated
dkelosky
dkelosky reviewed Apr 15, 2026
View reviewed changes
Comment thread native/c/zlogger_metal.c Outdated
traeok added 2 commits April 15, 2026 11:29
@traeok
fix(zcnm31): clamp length variables
dc9637b 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
refactor(ztype): remove do/while trick from ZDIAG_SET_MSG
3e36c4f 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 15, 2026
View reviewed changes
Comment thread native/c/zjbm.c Fixed
Comment thread native/c/zjbm.c Fixed
zFernand0
zFernand0 reviewed Apr 19, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@zFernand0 zFernand0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes MSTM! 😋

I'm still missing a few files, and there are some things that I'm unsure about, so I'd like to do some testing before approving.
And perhaps discuss offline some of them as well 🙏

Comment thread native/c/zcnm31.c Outdated
Comment thread native/c/zcnm31.c
Comment thread native/c/zcnm31.c Outdated
Comment thread native/c/zds.cpp Outdated
Comment thread native/c/ztype.h
Comment thread native/c/zjbm.h Outdated
Comment thread native/c/zut.cpp
Comment thread native/c/zut.cpp
Comment thread native/c/zutm.c Outdated
Comment thread native/c/zusf.cpp
dkelosky
dkelosky reviewed Apr 20, 2026
View reviewed changes
Comment thread native/c/zdstype.h
dkelosky
dkelosky reviewed Apr 20, 2026
View reviewed changes
Comment thread native/c/zjb.cpp Outdated
traeok added 3 commits April 20, 2026 07:25
@traeok
fix: update link, use dynamic formatting
f9d9f23 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
Merge branch 'main' into fix/vulns
c4800b6
@traeok
fix(zjbm): Change int param to pointer
3b09544 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok traeok requested review from dkelosky and zFernand0 April 20, 2026 14:20
traeok added 2 commits April 20, 2026 11:14
@traeok
chore: add comments on truncation cases
1874c30 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
Merge branch 'main' into fix/vulns
384fed6
@traeok traeok changed the title fix: numerous vulnerabilities in code fix: numerous vulnerabilities in native code Apr 21, 2026
zFernand0
zFernand0 approved these changes Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@zFernand0 zFernand0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 😋

Again, some dumb comments/questions for my own understanding, but generally this looks good to me and prevents a ton of UB going forward 🙏

Comment thread native/c/zutm.c Outdated
Comment thread native/c/zjbm.c
Comment thread native/c/zjson.hpp
Comment thread native/c/zlogger_metal.c
Comment thread native/c/zlogger_metal.c
Comment thread native/c/zam24.s
traeok added 4 commits April 23, 2026 09:33
@traeok
refactor(zutm): dynamic precision for parms
370143b 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
Merge branch 'main' into fix/vulns
3d0c8d5 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
Merge branch 'main' into fix/vulns
4fe2182
@traeok
Merge branch 'main' into fix/vulns
812d0be 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
t1m0thyj
t1m0thyj reviewed Apr 23, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@t1m0thyj t1m0thyj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @traeok, just one comment 😋

Comment thread native/c/zdstype.h
traeok added 2 commits April 23, 2026 17:03
@traeok
Merge remote-tracking branch 'origin/main' into fix/vulns
d213558 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok
fix(zds): add precision to diag msg
816e896 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@traeok traeok requested a review from t1m0thyj April 23, 2026 21:17
@traeok
fix(zds): add 7-byte padding to kept struct dword aligned
24a71aa 
Signed-off-by: Trae Yelovich <trae.yelovich@broadcom.com>
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 23, 2026

Quality Gate Passed Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.0% Duplication on New Code

See analysis details on SonarQube Cloud

@traeok traeok merged commit bade6f9 into main Apr 23, 2026
13 checks passed
@traeok traeok deleted the fix/vulns branch April 23, 2026 21:55
@github-project-automation github-project-automation Bot moved this from Review/QA to Closed in Zowe CLI Squad Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zFernand0 zFernand0 zFernand0 approved these changes

@t1m0thyj t1m0thyj t1m0thyj approved these changes

@anaxceron anaxceron anaxceron approved these changes

@MarkAckert MarkAckert Awaiting requested review from MarkAckert

@awharn awharn Awaiting requested review from awharn

@pujal0909 pujal0909 Awaiting requested review from pujal0909

@jace-roell jace-roell Awaiting requested review from jace-roell

@dkelosky dkelosky Awaiting requested review from dkelosky

+1 more reviewer

@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@traeok traeok

Labels

size/XL

Projects

Zowe CLI Squad
Status: Closed

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@traeok @dkelosky @t1m0thyj @zFernand0 @github-advanced-security @anaxceron @zowe-robot