After three years of development, the GNU cflow 1.7 utility has been released, designed to create a clear graph of function calls in C programs, which can be used to simplify the understanding of application logic. The graph is constructed solely based on the analysis of source code, without the need to execute the program. It supports the generation of both direct and reverse execution flow graphs, as well as generating lists of cross-references for code files.
This release is notable for implementing support for the 'dot' output format ('—format=dot') to generate results in DOT language for subsequent visualization in the Graphviz package. It has added the ability to specify multiple starting functions by duplicating the '—main' options, with a separate graph generated for each of these functions. There’s also a new option '—target=FUNCTION' that allows restricting the resulting graph to only the branches including specified functions (the '—target' option can be specified multiple times). New commands have been added to the cflow-mode for navigating the graph: 'c' — go to the calling function, 'n' — proceed to the next function at the same level of nesting, and 'p' — go to the previous function at the same level of nesting.
The new version also addresses two vulnerabilities that were identified as early as 2019, which cause memory corruption when cflow processes specially formatted source texts. The first vulnerability (CVE-2019-16165) is caused by accessing memory after it has been freed (use-after-free) in the parser code (function reference in parser.c). The second vulnerability (CVE-2019-16166) is related to a buffer overflow in the nexttoken() function. According to the developers, these issues do not pose a security threat as they are limited to the utility crashing.
Source: opennet.ru
