Warning on SHA1Transform when compiling with GCC 14.2.1 on Linux

[Neko-Box-Coder]

When doing a normal build with make on latest commit, I got the following warning and therefore failed to compile due to -Werror.

cc -c  -Wall -Wextra -Wstrict-prototypes -Wshadow -Wpointer-arith -Wformat-security -Winit-self -Wcast-qual -Wcast-align -Wwrite-strings -Wnested-externs -Wredundant-decls -Werror -O3 -funsigned-char -Iinclude/ -DUSE_STACK_SIZE=102400 -oobj/extern_sha1.o src/extern_sha1.c
In function ‘SHA1Update’,
    inlined from ‘SHA1Final’ at src/extern_sha1.c:248:2:
src/extern_sha1.c:227:25: error: ‘SHA1Transform’ reading 64 bytes from a region of size 0 [-Werror=stringop-overread]
  227 |                         SHA1Transform(context->state, &data[i]);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/extern_sha1.c:227:25: note: referencing argument 2 of type ‘const unsigned char[64]’
src/extern_sha1.c: In function ‘SHA1Final’:
src/extern_sha1.c:93:13: note: in a call to function ‘SHA1Transform’
   93 | static void SHA1Transform(uint32_t state[5], const unsigned char buffer[64]) {
      |             ^~~~~~~~~~~~~
In function ‘SHA1Update’,
    inlined from ‘SHA1Final’ at src/extern_sha1.c:251:3:
src/extern_sha1.c:227:25: error: ‘SHA1Transform’ reading 64 bytes from a region of size 0 [-Werror=stringop-overread]
  227 |                         SHA1Transform(context->state, &data[i]);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/extern_sha1.c:227:25: note: referencing argument 2 of type ‘const unsigned char[64]’
src/extern_sha1.c: In function ‘SHA1Final’:
src/extern_sha1.c:93:13: note: in a call to function ‘SHA1Transform’
   93 | static void SHA1Transform(uint32_t state[5], const unsigned char buffer[64]) {
      |             ^~~~~~~~~~~~~
cc1: all warnings being treated as errors
make: *** [Makefile:149: obj/extern_sha1.o] Error 1

It seems like a false positive to me since SHA1Transform is guarded by the if check if ((j + len) > 63)

Would you consider adding back COPT so that people can manually put in -Wno-stringop-overread or to suppress any other warnings in the future?

[kaisawind]

change const unsigned char buffer[64] to const unsigned char* buffer

libhttp/src/extern_sha1.c

Line 93 in 652e253

static void SHA1Transform(uint32_t state[5], const unsigned char buffer[64]) {

[juwannes]

What I notest:
in func sha1Update var i is not initialized.
with new openssl the macro CRYPT_num_lock should be (1)
const unsigned char *buffer does not work neither.
the compiler transforms warnings into errors (-Werr)

[juwannes]

I also saw LAMMERT Bies' work. Nice job!