-
Notifications
You must be signed in to change notification settings - Fork 24
Open
Description
That API function is problematic in multiple ways:
- exit terminates the whole process, from a library, … well you don't do that, pass your error codes and let the application decide!
cgi_init_headers()is called, if you want or not- no actual error handling, which could lead to all kinds of null pointer dereferences, use after free, and so on :-/
- all depending on global variable
cgi_display_errors(initialized with 1 aka true)- if
cgi_display_errorsis set, the process will be terminated (see above) - if
cgi_display_errorsis not set,libcgi_error()returns short and there's actually no error handling at all (see above)
- if
- the function is exposed to the API, so a consumer could call it: WHY? o.O
NOTE: just avoiding libcgi_error() does not solve that missing error handling!