fix: update libevent pattern for android (#5441) #5446
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add pattern to detect libevent version in Android libraries where the version string format differs from standard Linux binaries. - Add FILENAME_PATTERNS to match libevent library files - Add VERSION_PATTERN with word boundary to match formats like "libevent-2.1.8-stable" while avoiding false positives - Add test case for Android libevent format
jackulau
force-pushed
the
5441_libevent
branch
2 times, most recently
from
6b7696a to
b8a6c8b
Compare
Update VERSION_PATTERN to handle null byte separators in Android libevent binaries. - Change pattern to match null byte (\x00) separators - Handle optional "Inserted events:" between version and "Active events:" - Add test cases for Android libevent formats Tested on Android API 28, 29, 30, 34 Partial fix for ossf#5441 Signed-off-by: Jack <[email protected]>
jackulau
force-pushed
the
5441_libevent
branch
from
b8a6c8b to
8e810ac
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add pattern to detect libevent version in Android libraries where the version string format differs from standard Linux binaries.
Summary
Addresses #5441 - Android libevent library not detected by CVE-bin-tool.
FILENAME_PATTERNSto match libevent library filesVERSION_PATTERNto detect version in Android binaries where the version string is standaloneDetails
The existing patterns required the string
libevent using:to be adjacent to the version, which is not the case in Android binaries. In Android'slibevent.so, the version string2.1.8-stableappears standalone between other diagnostic strings.The new pattern:
r"([0-9]+\.[0-9]+\.[0-9]+)-stable\r?\nActive events:"Matches:
Test plan