kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/addr.c.coverity openssh-8.5p1/addr.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/addr.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/addr.c	2021-03-24 12:03:33.782968159 +0100
Dmitry Belyavskiy 925484
@@ -312,8 +312,10 @@ addr_pton(const char *p, struct xaddr *n
Dmitry Belyavskiy 925484
 	if (p == NULL || getaddrinfo(p, NULL, &hints, &ai) != 0)
Dmitry Belyavskiy 925484
 		return -1;
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
-	if (ai == NULL || ai->ai_addr == NULL)
Dmitry Belyavskiy 925484
+	if (ai == NULL || ai->ai_addr == NULL) {
Dmitry Belyavskiy 925484
+		freeaddrinfo(ai);
Dmitry Belyavskiy 925484
 		return -1;
Dmitry Belyavskiy 925484
+	}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	if (n != NULL && addr_sa_to_xaddr(ai->ai_addr, ai->ai_addrlen,
Dmitry Belyavskiy 925484
 	    n) == -1) {
Dmitry Belyavskiy 925484
@@ -336,12 +338,16 @@ addr_sa_pton(const char *h, const char *
Dmitry Belyavskiy 925484
 	if (h == NULL || getaddrinfo(h, s, &hints, &ai) != 0)
Dmitry Belyavskiy 925484
 		return -1;
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
-	if (ai == NULL || ai->ai_addr == NULL)
Dmitry Belyavskiy 925484
+	if (ai == NULL || ai->ai_addr == NULL) {
Dmitry Belyavskiy 925484
+		freeaddrinfo(ai);
Dmitry Belyavskiy 925484
 		return -1;
Dmitry Belyavskiy 925484
+	}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	if (sa != NULL) {
Dmitry Belyavskiy 925484
-		if (slen < ai->ai_addrlen)
Dmitry Belyavskiy 925484
+		if (slen < ai->ai_addrlen) {
Dmitry Belyavskiy 925484
+			freeaddrinfo(ai);
Dmitry Belyavskiy 925484
 			return -1;
Dmitry Belyavskiy 925484
+		}
Dmitry Belyavskiy 925484
 		memcpy(sa, &ai->ai_addr, ai->ai_addrlen);
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/auth-krb5.c.coverity	2021-03-24 12:03:33.724967756 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/auth-krb5.c	2021-03-24 12:03:33.782968159 +0100
Dmitry Belyavskiy 925484
@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
Dmitry Belyavskiy 925484
 		umask(old_umask);
Dmitry Belyavskiy 925484
 		if (tmpfd == -1) {
Dmitry Belyavskiy 925484
 			logit("mkstemp(): %.100s", strerror(oerrno));
Dmitry Belyavskiy 925484
+			free(ccname);
Dmitry Belyavskiy 925484
 			return oerrno;
Dmitry Belyavskiy 925484
 		}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
Dmitry Belyavskiy 925484
 			oerrno = errno;
Dmitry Belyavskiy 925484
 			logit("fchmod(): %.100s", strerror(oerrno));
Dmitry Belyavskiy 925484
 			close(tmpfd);
Dmitry Belyavskiy 925484
+			free(ccname);
Dmitry Belyavskiy 925484
 			return oerrno;
Dmitry Belyavskiy 925484
 		}
Dmitry Belyavskiy 925484
 		/* make sure the KRB5CCNAME is set for non-standard location */
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/auth-options.c.coverity openssh-8.5p1/auth-options.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/auth-options.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/auth-options.c	2021-03-24 12:03:33.782968159 +0100
Dmitry Belyavskiy 925484
@@ -706,6 +708,7 @@ serialise_array(struct sshbuf *m, char *
Dmitry Belyavskiy 925484
 		return r;
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 	/* success */
Dmitry Belyavskiy 925484
+	sshbuf_free(b);
Dmitry Belyavskiy 925484
 	return 0;
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Petr Šabata 81d24c
diff -up openssh-7.4p1/channels.c.coverity openssh-7.4p1/channels.c
Petr Šabata 81d24c
--- openssh-7.4p1/channels.c.coverity	2016-12-23 16:40:26.881788686 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/channels.c	2016-12-23 16:42:36.244818763 +0100
Dmitry Belyavskiy 925484
@@ -1875,7 +1875,7 @@ channel_post_connecting(struct ssh *ssh,
Dmitry Belyavskiy 925484
 		debug("channel %d: connection failed: %s",
Dmitry Belyavskiy 925484
 		    c->self, strerror(err));
Dmitry Belyavskiy 925484
 		/* Try next address, if any */
Dmitry Belyavskiy 925484
-		if ((sock = connect_next(&c->connect_ctx)) > 0) {
Dmitry Belyavskiy 925484
+		if ((sock = connect_next(&c->connect_ctx)) >= 0) {
Dmitry Belyavskiy 925484
 			close(c->sock);
Dmitry Belyavskiy 925484
 			c->sock = c->rfd = c->wfd = sock;
Dmitry Belyavskiy 925484
 			channel_find_maxfd(ssh->chanctxt);
Dmitry Belyavskiy 925484
@@ -3804,7 +3804,7 @@ int
Dmitry Belyavskiy 925484
 channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd)
Dmitry Belyavskiy 925484
 {
Dmitry Belyavskiy 925484
 	int r, success = 0, idx = -1;
Dmitry Belyavskiy 925484
-	char *host_to_connect, *listen_host, *listen_path;
Dmitry Belyavskiy 925484
+	char *host_to_connect = NULL, *listen_host = NULL, *listen_path = NULL;
Dmitry Belyavskiy 925484
 	int port_to_connect, listen_port;
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	/* Send the forward request to the remote side. */
Dmitry Belyavskiy 925484
@@ -3832,7 +3832,6 @@ channel_request_remote_forwarding(struct
Dmitry Belyavskiy 925484
 	success = 1;
Dmitry Belyavskiy 925484
 	if (success) {
Dmitry Belyavskiy 925484
 		/* Record that connection to this host/port is permitted. */
Dmitry Belyavskiy 925484
-		host_to_connect = listen_host = listen_path = NULL;
Dmitry Belyavskiy 925484
 		port_to_connect = listen_port = 0;
Dmitry Belyavskiy 925484
 		if (fwd->connect_path != NULL) {
Dmitry Belyavskiy 925484
 			host_to_connect = xstrdup(fwd->connect_path);
Dmitry Belyavskiy 925484
@@ -3853,6 +3852,9 @@ channel_request_remote_forwarding(struct
Dmitry Belyavskiy 925484
 		    host_to_connect, port_to_connect,
Dmitry Belyavskiy 925484
 		    listen_host, listen_path, listen_port, NULL);
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
+	free(host_to_connect);
Dmitry Belyavskiy 925484
+	free(listen_host);
Dmitry Belyavskiy 925484
+	free(listen_path);
Dmitry Belyavskiy 925484
 	return idx;
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/dns.c.coverity openssh-8.5p1/dns.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/dns.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/dns.c	2021-03-24 12:03:33.783968166 +0100
Dmitry Belyavskiy 925484
@@ -282,6 +282,7 @@ verify_host_key_dns(const char *hostname
Dmitry Belyavskiy f9e5de
		    &hostkey_digest, &hostkey_digest_len, hostkey)) {
Dmitry Belyavskiy f9e5de
			error("Error calculating key fingerprint.");
Dmitry Belyavskiy f9e5de
			freerrset(fingerprints);
Dmitry Belyavskiy 925484
+				free(dnskey_digest);
Dmitry Belyavskiy f9e5de
			return -1;
Dmitry Belyavskiy f9e5de
		}
Dmitry Belyavskiy f9e5de
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/gss-genr.c.coverity	2021-03-26 11:52:46.613942552 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/gss-genr.c	2021-03-26 11:54:37.881726318 +0100
Dmitry Belyavskiy 925484
@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
Dmitry Belyavskiy 925484
 			enclen = __b64_ntop(digest,
Dmitry Belyavskiy 925484
 			    ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
Dmitry Belyavskiy 925484
 			    ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
Dmitry Belyavskiy 925484
-
Dmitry Belyavskiy 925484
+#pragma GCC diagnostic ignored "-Wstringop-overflow"
Dmitry Belyavskiy 925484
 			cp = strncpy(s, kex, strlen(kex));
Dmitry Belyavskiy 925484
+#pragma pop
Dmitry Belyavskiy 925484
 			for ((p = strsep(&cp, ",")); p && *p != '\0';
Dmitry Belyavskiy 925484
 				(p = strsep(&cp, ","))) {
Dmitry Belyavskiy 925484
 				if (sshbuf_len(buf) != 0 &&
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/krl.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/krl.c	2021-03-24 12:03:33.783968166 +0100
Dmitry Belyavskiy 925484
@@ -1209,6 +1209,7 @@ ssh_krl_from_blob(struct sshbuf *buf, st
Dmitry Belyavskiy 925484
 	sshkey_free(key);
Dmitry Belyavskiy 925484
 	sshbuf_free(copy);
Dmitry Belyavskiy 925484
 	sshbuf_free(sect);
Dmitry Belyavskiy 925484
+	/* coverity[leaked_storage : FALSE] */
Dmitry Belyavskiy 925484
 	return r;
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
@@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
Dmitry Belyavskiy 925484
 		return r;
Dmitry Belyavskiy 925484
 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
Dmitry Belyavskiy 925484
 	free(rb.blob);
Dmitry Belyavskiy 925484
+	rb.blob = NULL; /* make coverity happy */
Dmitry Belyavskiy 925484
 	if (erb != NULL) {
Dmitry Belyavskiy 925484
 		KRL_DBG(("revoked by key SHA1"));
Dmitry Belyavskiy 925484
 		return SSH_ERR_KEY_REVOKED;
Dmitry Belyavskiy 925484
@@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, cons
Dmitry Belyavskiy 925484
 		return r;
Dmitry Belyavskiy 925484
 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
Dmitry Belyavskiy 925484
 	free(rb.blob);
Dmitry Belyavskiy 925484
+	rb.blob = NULL; /* make coverity happy */
Dmitry Belyavskiy 925484
 	if (erb != NULL) {
Dmitry Belyavskiy 925484
 		KRL_DBG(("revoked by key SHA256"));
Dmitry Belyavskiy 925484
 		return SSH_ERR_KEY_REVOKED;
Dmitry Belyavskiy 925484
@@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, cons
Dmitry Belyavskiy 925484
 		return r;
Dmitry Belyavskiy 925484
 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
Dmitry Belyavskiy 925484
 	free(rb.blob);
Dmitry Belyavskiy 925484
+	rb.blob = NULL; /* make coverity happy */
Dmitry Belyavskiy 925484
 	if (erb != NULL) {
Dmitry Belyavskiy 925484
 		KRL_DBG(("revoked by explicit key"));
Dmitry Belyavskiy 925484
 		return SSH_ERR_KEY_REVOKED;
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/loginrec.c.coverity	2021-03-24 13:18:53.793225885 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/loginrec.c	2021-03-24 13:21:27.948404751 +0100
Dmitry Belyavskiy 925484
@@ -690,9 +690,11 @@ construct_utmp(struct logininfo *li,
Dmitry Belyavskiy 925484
 	 */
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	/* Use strncpy because we don't necessarily want null termination */
Dmitry Belyavskiy 925484
+	/* coverity[buffer_size_warning : FALSE] */
Dmitry Belyavskiy 925484
 	strncpy(ut->ut_name, li->username,
Dmitry Belyavskiy 925484
 	    MIN_SIZEOF(ut->ut_name, li->username));
Dmitry Belyavskiy 925484
 # ifdef HAVE_HOST_IN_UTMP
Dmitry Belyavskiy 925484
+	/* coverity[buffer_size_warning : FALSE] */
Dmitry Belyavskiy 925484
 	strncpy(ut->ut_host, li->hostname,
Dmitry Belyavskiy 925484
 	    MIN_SIZEOF(ut->ut_host, li->hostname));
Dmitry Belyavskiy 925484
 # endif
Dmitry Belyavskiy 925484
@@ -1690,6 +1692,7 @@ record_failed_login(struct ssh *ssh, con
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	memset(&ut, 0, sizeof(ut));
Dmitry Belyavskiy 925484
 	/* strncpy because we don't necessarily want nul termination */
Dmitry Belyavskiy 925484
+	/* coverity[buffer_size_warning : FALSE] */
Dmitry Belyavskiy 925484
 	strncpy(ut.ut_user, username, sizeof(ut.ut_user));
Dmitry Belyavskiy 925484
 	strlcpy(ut.ut_line, "ssh:notty", sizeof(ut.ut_line));
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
@@ -1699,6 +1702,7 @@ record_failed_login(struct ssh *ssh, con
Dmitry Belyavskiy 925484
 	ut.ut_pid = getpid();
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	/* strncpy because we don't necessarily want nul termination */
Dmitry Belyavskiy 925484
+	/* coverity[buffer_size_warning : FALSE] */
Dmitry Belyavskiy 925484
 	strncpy(ut.ut_host, hostname, sizeof(ut.ut_host));
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	if (ssh_packet_connection_is_on_socket(ssh) &&
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/misc.c.coverity	2021-03-24 12:03:33.745967902 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/misc.c	2021-03-24 13:31:47.037079617 +0100
Dmitry Belyavskiy 925484
@@ -1425,6 +1425,8 @@ sanitise_stdfd(void)
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 	if (nullfd > STDERR_FILENO)
Dmitry Belyavskiy 925484
 		close(nullfd);
Dmitry Belyavskiy 925484
+	/* coverity[leaked_handle : FALSE]*/
Dmitry Belyavskiy 925484
+	/* coverity[leaked_handle : FALSE]*/
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 char *
Dmitry Belyavskiy 925484
@@ -2511,6 +2513,7 @@ stdfd_devnull(int do_stdin, int do_stdou
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 	if (devnull > STDERR_FILENO)
Dmitry Belyavskiy 925484
 		close(devnull);
Dmitry Belyavskiy 925484
+	/* coverity[leaked_handle : FALSE]*/
Dmitry Belyavskiy 925484
 	return ret;
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/moduli.c.coverity openssh-8.5p1/moduli.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/moduli.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/moduli.c	2021-03-24 12:03:33.784968173 +0100
Dmitry Belyavskiy 925484
@@ -476,6 +476,7 @@ write_checkpoint(char *cpfile, u_int32_t
Dmitry Belyavskiy 925484
 	else
Dmitry Belyavskiy 925484
 		logit("failed to write to checkpoint file '%s': %s", cpfile,
Dmitry Belyavskiy 925484
 		    strerror(errno));
Dmitry Belyavskiy 925484
+	/* coverity[leaked_storage : FALSE] */
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 static unsigned long
Petr Šabata 81d24c
diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
Petr Šabata 81d24c
--- openssh-7.4p1/monitor.c.coverity	2016-12-23 16:40:26.888788688 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/monitor.c	2016-12-23 16:40:26.900788691 +0100
Petr Šabata 81d24c
@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
Petr Šabata 81d24c
 	mm_get_keystate(ssh, pmonitor);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* Drain any buffered messages from the child */
Petr Šabata 81d24c
-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
Petr Šabata 81d24c
+	while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
Petr Šabata 81d24c
 		;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	if (pmonitor->m_recvfd >= 0)
Dmitry Belyavskiy 925484
@@ -1678,7 +1678,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
Dmitry Belyavskiy 925484
 	s->ptymaster = s->ptyfd;
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
Dmitry Belyavskiy 925484
-
Dmitry Belyavskiy 925484
+	/* coverity[leaked_handle : FALSE] */
Dmitry Belyavskiy 925484
 	return (0);
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
  error:
Petr Šabata 81d24c
diff -up openssh-7.4p1/monitor_wrap.c.coverity openssh-7.4p1/monitor_wrap.c
Petr Šabata 81d24c
--- openssh-7.4p1/monitor_wrap.c.coverity	2016-12-23 16:40:26.892788689 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/monitor_wrap.c	2016-12-23 16:40:26.900788691 +0100
Petr Šabata 81d24c
@@ -525,10 +525,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
Petr Šabata 81d24c
 	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
Petr Šabata 81d24c
 	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
DistroBaker d029bb
 		error_f("cannot allocate fds for pty");
Petr Šabata 81d24c
-		if (tmp1 > 0)
Petr Šabata 81d24c
+		if (tmp1 >= 0)
Petr Šabata 81d24c
 			close(tmp1);
Petr Šabata 81d24c
-		if (tmp2 > 0)
Petr Šabata 81d24c
-			close(tmp2);
Petr Šabata 81d24c
+		/*DEAD CODE if (tmp2 >= 0)
Petr Šabata 81d24c
+			close(tmp2);*/
Petr Šabata 81d24c
 		return 0;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 	close(tmp1);
Petr Šabata 81d24c
diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
Petr Šabata 81d24c
--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity	2016-12-19 05:59:41.000000000 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/openbsd-compat/bindresvport.c	2016-12-23 16:40:26.901788691 +0100
Petr Šabata 81d24c
@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
Petr Šabata 81d24c
 	struct sockaddr_in6 *in6;
Petr Šabata 81d24c
 	u_int16_t *portp;
Petr Šabata 81d24c
 	u_int16_t port;
Petr Šabata 81d24c
-	socklen_t salen;
Petr Šabata 81d24c
+	socklen_t salen = sizeof(struct sockaddr_storage);
Petr Šabata 81d24c
 	int i;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	if (sa == NULL) {
Dmitry Belyavskiy f9e5de
diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openbsd-compat/bsd-pselect.c
Dmitry Belyavskiy f9e5de
--- openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity	2021-08-30 16:36:11.357288009 +0200
Dmitry Belyavskiy f9e5de
+++ openssh-8.7p1/openbsd-compat/bsd-pselect.c	2021-08-30 16:37:21.791897976 +0200
Dmitry Belyavskiy f9e5de
@@ -113,13 +113,13 @@ pselect_notify_setup(void)
Dmitry Belyavskiy f9e5de
 static void
Dmitry Belyavskiy f9e5de
 pselect_notify_parent(void)
Dmitry Belyavskiy f9e5de
 {
Dmitry Belyavskiy f9e5de
-	if (notify_pipe[1] != -1)
Dmitry Belyavskiy f9e5de
+	if (notify_pipe[1] >= 0)
Dmitry Belyavskiy f9e5de
 		(void)write(notify_pipe[1], "", 1);
Dmitry Belyavskiy f9e5de
 }
Dmitry Belyavskiy f9e5de
 static void
Dmitry Belyavskiy f9e5de
 pselect_notify_prepare(fd_set *readset)
Dmitry Belyavskiy f9e5de
 {
Dmitry Belyavskiy f9e5de
-	if (notify_pipe[0] != -1)
Dmitry Belyavskiy f9e5de
+	if (notify_pipe[0] >= 0)
Dmitry Belyavskiy f9e5de
 		FD_SET(notify_pipe[0], readset);
Dmitry Belyavskiy f9e5de
 }
Dmitry Belyavskiy f9e5de
 static void
Dmitry Belyavskiy f9e5de
@@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset)
Dmitry Belyavskiy f9e5de
 {
Dmitry Belyavskiy f9e5de
 	char c;
Dmitry Belyavskiy f9e5de
 
Dmitry Belyavskiy f9e5de
-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
Dmitry Belyavskiy f9e5de
-		while (read(notify_pipe[0], &c, 1) != -1)
Dmitry Belyavskiy f9e5de
+	if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
Dmitry Belyavskiy f9e5de
+		while (read(notify_pipe[0], &c, 1) >= 0)
Dmitry Belyavskiy f9e5de
 			debug2_f("reading");
Dmitry Belyavskiy f9e5de
 		FD_CLR(notify_pipe[0], readset);
Dmitry Belyavskiy f9e5de
 	}
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/readconf.c.coverity	2021-03-24 12:03:33.778968131 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/readconf.c	2021-03-24 12:03:33.785968180 +0100
Dmitry Belyavskiy 925484
@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
Dmitry Belyavskiy 925484
 			} else if (r != 0) {
Dmitry Belyavskiy 925484
 				error("%.200s line %d: glob failed for %s.",
Dmitry Belyavskiy 925484
 				    filename, linenum, arg2);
Dmitry Belyavskiy 925484
+				free(arg2);
Dmitry Belyavskiy f9e5de
 				goto out;
Dmitry Belyavskiy 925484
 			}
Dmitry Belyavskiy 925484
 			free(arg2);
Dmitry Belyavskiy f9e5de
diff -up openssh-8.7p1/scp.c.coverity openssh-8.7p1/scp.c
Dmitry Belyavskiy f9e5de
--- openssh-8.7p1/scp.c.coverity	2021-08-30 16:23:35.389741329 +0200
Dmitry Belyavskiy f9e5de
+++ openssh-8.7p1/scp.c	2021-08-30 16:27:04.854555296 +0200
Dmitry Belyavskiy f9e5de
@@ -186,11 +186,11 @@ killchild(int signo)
Petr Šabata 81d24c
 {
Petr Šabata 81d24c
 	if (do_cmd_pid > 1) {
Petr Šabata 81d24c
 		kill(do_cmd_pid, signo ? signo : SIGTERM);
Petr Šabata 81d24c
-		waitpid(do_cmd_pid, NULL, 0);
Petr Šabata 81d24c
+		(void) waitpid(do_cmd_pid, NULL, 0);
Petr Šabata 81d24c
 	}
Dmitry Belyavskiy f9e5de
 	if (do_cmd_pid2 > 1) {
Dmitry Belyavskiy f9e5de
 		kill(do_cmd_pid2, signo ? signo : SIGTERM);
Dmitry Belyavskiy f9e5de
-		waitpid(do_cmd_pid2, NULL, 0);
Dmitry Belyavskiy f9e5de
+		(void) waitpid(do_cmd_pid2, NULL, 0);
Dmitry Belyavskiy f9e5de
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	if (signo)
Petr Šabata 81d24c
diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
Petr Šabata 81d24c
--- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
Petr Šabata 81d24c
@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
Petr Šabata 81d24c
 		if (*activep && *charptr == NULL) {
Petr Šabata 81d24c
 			*charptr = tilde_expand_filename(arg, getuid());
Petr Šabata 81d24c
 			/* increase optional counter */
Petr Šabata 81d24c
-			if (intptr != NULL)
Petr Šabata 81d24c
-				*intptr = *intptr + 1;
Petr Šabata 81d24c
+			/* DEAD CODE intptr is still NULL ;)
Petr Šabata 81d24c
+  			 if (intptr != NULL)
Petr Šabata 81d24c
+				*intptr = *intptr + 1; */
Petr Šabata 81d24c
 		}
Petr Šabata 81d24c
 		break;
Petr Šabata 81d24c
 
Dmitry Belyavskiy f9e5de
diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
Dmitry Belyavskiy f9e5de
--- openssh-8.7p1/serverloop.c.coverity	2021-08-20 06:03:49.000000000 +0200
Dmitry Belyavskiy f9e5de
+++ openssh-8.7p1/serverloop.c	2021-08-30 16:28:22.416226981 +0200
Dmitry Belyavskiy f9e5de
@@ -547,7 +547,7 @@ server_request_tun(struct ssh *ssh)
DistroBaker d029bb
 		debug_f("invalid tun");
Petr Šabata 81d24c
 		goto done;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
-	if (auth_opts->force_tun_device != -1) {
Petr Šabata 81d24c
+	if (auth_opts->force_tun_device >= 0) {
Petr Šabata 81d24c
 		if (tun != SSH_TUNID_ANY &&
Petr Šabata 81d24c
 		    auth_opts->force_tun_device != (int)tun)
Petr Šabata 81d24c
 			goto done;
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/session.c.coverity openssh-8.5p1/session.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/session.c.coverity	2021-03-24 12:03:33.777968124 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/session.c	2021-03-24 12:03:33.786968187 +0100
Dmitry Belyavskiy 925484
@@ -1223,12 +1223,14 @@ do_setup_env(struct ssh *ssh, Session *s
Dmitry Belyavskiy 925484
 	/* Environment specified by admin */
Dmitry Belyavskiy 925484
 	for (i = 0; i < options.num_setenv; i++) {
Dmitry Belyavskiy 925484
 		cp = xstrdup(options.setenv[i]);
Dmitry Belyavskiy 925484
+		/* coverity[overwrite_var : FALSE] */
Dmitry Belyavskiy 925484
 		if ((value = strchr(cp, '=')) == NULL) {
Dmitry Belyavskiy 925484
 			/* shouldn't happen; vars are checked in servconf.c */
Dmitry Belyavskiy 925484
 			fatal("Invalid config SetEnv: %s", options.setenv[i]);
Dmitry Belyavskiy 925484
 		}
Dmitry Belyavskiy 925484
 		*value++ = '\0';
Dmitry Belyavskiy 925484
 		child_set_env(&env, &envsize, cp, value);
Dmitry Belyavskiy 925484
+		free(cp);
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	/* SSH_CLIENT deprecated */
Zoltan Fridrich c958ea
--- a/sftp.c	2022-06-30 10:43:13.914058913 +0200
Zoltan Fridrich c958ea
+++ b/sftp.c	2022-06-30 10:48:17.243997888 +0200
Zoltan Fridrich c958ea
@@ -222,7 +222,7 @@ killchild(int signo)
Petr Šabata 81d24c
 	pid = sshpid;
Petr Šabata 81d24c
 	if (pid > 1) {
Petr Šabata 81d24c
 		kill(pid, SIGTERM);
Petr Šabata 81d24c
-		waitpid(pid, NULL, 0);
Petr Šabata 81d24c
+		(void) waitpid(pid, NULL, 0);
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	_exit(1);
Zoltan Fridrich c958ea
@@ -768,6 +768,8 @@ process_put(struct sftp_conn *conn, cons
Zoltan Fridrich c958ea
 			    fflag || global_fflag, 0) == -1)
Dmitry Belyavskiy 925484
 				err = -1;
Dmitry Belyavskiy 925484
 		}
Dmitry Belyavskiy 925484
+		free(abs_dst);
Dmitry Belyavskiy 925484
+		abs_dst = NULL;
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 out:
Zoltan Fridrich c958ea
@@ -991,6 +993,7 @@ do_globbed_ls(struct sftp_conn *conn, co
Dmitry Belyavskiy 925484
 		if (lflag & LS_LONG_VIEW) {
Dmitry Belyavskiy 925484
 			if (g.gl_statv[i] == NULL) {
Dmitry Belyavskiy 925484
 				error("no stat information for %s", fname);
Dmitry Belyavskiy 925484
+				free(fname);
Dmitry Belyavskiy 925484
 				continue;
Dmitry Belyavskiy 925484
 			}
Dmitry Belyavskiy 925484
 			lname = ls_file(fname, g.gl_statv[i], 1,
Dmitry Belyavskiy 581a7d
diff --git a/sftp-client.c b/sftp-client.c
Dmitry Belyavskiy 581a7d
index 9de9afa20f..ea98d9f8d0 100644
Dmitry Belyavskiy 581a7d
--- a/sftp-client.c
Dmitry Belyavskiy 581a7d
+++ b/sftp-client.c
Dmitry Belyavskiy 581a7d
@@ -2195,6 +2195,7 @@ handle_dest_replies(struct sftp_conn *to, const char *to_path, int synchronous,
Dmitry Belyavskiy 581a7d
 		(*nreqsp)--;
Dmitry Belyavskiy 581a7d
 	}
Dmitry Belyavskiy 581a7d
 	debug3_f("done: %u outstanding replies", *nreqsp);
Dmitry Belyavskiy 581a7d
+	sshbuf_free(msg);
Dmitry Belyavskiy 581a7d
 }
Dmitry Belyavskiy 581a7d
 
Dmitry Belyavskiy 581a7d
 int
Dmitry Belyavskiy 581a7d
diff --git a/sftp-server.c b/sftp-server.c
Dmitry Belyavskiy 581a7d
index 18d1949112..6380c4dd23 100644
Dmitry Belyavskiy 581a7d
--- a/sftp-server.c
Dmitry Belyavskiy 581a7d
+++ b/sftp-server.c
Dmitry Belyavskiy 581a7d
@@ -1553,6 +1553,7 @@ process_extended_expand(u_int32_t id)
Dmitry Belyavskiy 581a7d
 			npath = xstrdup(path + 2);
Dmitry Belyavskiy 581a7d
 			free(path);
Dmitry Belyavskiy 581a7d
 			xasprintf(&path, "%s/%s", cwd, npath);
Dmitry Belyavskiy 581a7d
+			free(npath);
Dmitry Belyavskiy 581a7d
 		} else {
Dmitry Belyavskiy 581a7d
 			/* ~user expansions */
Dmitry Belyavskiy 581a7d
 			if (tilde_expand(path, pw->pw_uid, &npath) != 0) {
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/sk-usbhid.c.coverity openssh-8.5p1/sk-usbhid.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/sk-usbhid.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/sk-usbhid.c	2021-03-24 12:03:33.786968187 +0100
Dmitry Belyavskiy 925484
@@ -1256,6 +1256,7 @@ sk_load_resident_keys(const char *pin, s
Dmitry Belyavskiy 925484
 		freezero(rks[i], sizeof(*rks[i]));
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 	free(rks);
Dmitry Belyavskiy 925484
+	free(device);
Dmitry Belyavskiy 925484
 	return ret;
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Petr Šabata 81d24c
diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
Petr Šabata 81d24c
--- openssh-7.4p1/ssh-agent.c.coverity	2016-12-19 05:59:41.000000000 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/ssh-agent.c	2016-12-23 16:40:26.903788691 +0100
Dmitry Belyavskiy 925484
@@ -869,6 +869,7 @@ sanitize_pkcs11_provider(const char *pro
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 		if (pkcs11_uri_parse(provider, uri) != 0) {
Dmitry Belyavskiy 925484
 			error("Failed to parse PKCS#11 URI");
Dmitry Belyavskiy 925484
+			pkcs11_uri_cleanup(uri);
Dmitry Belyavskiy 925484
 			return NULL;
Dmitry Belyavskiy 925484
 		}
Dmitry Belyavskiy 925484
 		/* validate also provider from URI */
Petr Šabata 81d24c
@@ -1220,8 +1220,8 @@ main(int ac, char **av)
Petr Šabata 81d24c
 	sanitise_stdfd();
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* drop */
Petr Šabata 81d24c
-	setegid(getgid());
Petr Šabata 81d24c
-	setgid(getgid());
Petr Šabata 81d24c
+	(void) setegid(getgid());
Petr Šabata 81d24c
+	(void) setgid(getgid());
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	platform_disable_tracing(0);	/* strict=no */
Petr Šabata 81d24c
 
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/ssh.c.coverity openssh-8.5p1/ssh.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/ssh.c.coverity	2021-03-24 12:03:33.779968138 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/ssh.c	2021-03-24 12:03:33.786968187 +0100
Dmitry Belyavskiy 925484
@@ -1746,6 +1746,7 @@ control_persist_detach(void)
Dmitry Belyavskiy 925484
 		close(muxserver_sock);
Dmitry Belyavskiy 925484
 		muxserver_sock = -1;
Dmitry Belyavskiy 925484
 		options.control_master = SSHCTL_MASTER_NO;
Dmitry Belyavskiy 925484
+		/* coverity[leaked_handle: FALSE]*/
Dmitry Belyavskiy 925484
 		muxclient(options.control_path);
Dmitry Belyavskiy 925484
 		/* muxclient() doesn't return on success. */
Dmitry Belyavskiy 925484
 		fatal("Failed to connect to new control master");
Petr Šabata 81d24c
diff -up openssh-7.4p1/sshd.c.coverity openssh-7.4p1/sshd.c
Petr Šabata 81d24c
--- openssh-7.4p1/sshd.c.coverity	2016-12-23 16:40:26.897788690 +0100
Petr Šabata 81d24c
+++ openssh-7.4p1/sshd.c	2016-12-23 16:40:26.904788692 +0100
Petr Šabata 81d24c
@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 		privsep_preauth_child(ssh);
Petr Šabata 81d24c
 		setproctitle("%s", "[net]");
Petr Šabata 81d24c
-		if (box != NULL)
Petr Šabata 81d24c
+		if (box != NULL) {
Petr Šabata 81d24c
 			ssh_sandbox_child(box);
Petr Šabata 81d24c
+			free(box);
Petr Šabata 81d24c
+		}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 		return 0;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
@@ -1386,6 +1388,9 @@ server_accept_loop(int *sock_in, int *so
Petr Šabata 81d24c
 			explicit_bzero(rnd, sizeof(rnd));
Petr Šabata 81d24c
 		}
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if (fdset != NULL)
Petr Šabata 81d24c
+		free(fdset);
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 /*
Dmitry Belyavskiy 925484
@@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 	if (newstr)
Dmitry Belyavskiy 925484
 		myproposal[PROPOSAL_KEX_ALGS] = newstr;
Dmitry Belyavskiy 925484
-	else
Dmitry Belyavskiy 925484
+	else {
Dmitry Belyavskiy 925484
 		fatal("No supported key exchange algorithms");
Dmitry Belyavskiy 925484
+		free(gss);
Dmitry Belyavskiy 925484
+	     }
Dmitry Belyavskiy 925484
+	     /* coverity[leaked_storage: FALSE]*/
Dmitry Belyavskiy 925484
 	}
Dmitry Belyavskiy 925484
 #endif
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/ssh-keygen.c.coverity	2021-03-24 12:03:33.780968145 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/ssh-keygen.c	2021-03-24 12:03:33.787968194 +0100
Dmitry Belyavskiy 925484
@@ -2332,6 +2332,9 @@ update_krl_from_file(struct passwd *pw,
Dmitry Belyavskiy 925484
 			r = ssh_krl_revoke_key_sha256(krl, blob, blen);
Dmitry Belyavskiy 925484
 			if (r != 0)
Dmitry Belyavskiy 925484
 				fatal_fr(r, "revoke key failed");
Dmitry Belyavskiy 925484
+			freezero(blob, blen);
Dmitry Belyavskiy 925484
+			blob = NULL;
Dmitry Belyavskiy 925484
+			blen = 0;
Dmitry Belyavskiy 925484
 		} else {
Dmitry Belyavskiy 925484
 			if (strncasecmp(cp, "key:", 4) == 0) {
Dmitry Belyavskiy 925484
 				cp += 4;
Dmitry Belyavskiy 925484
@@ -2879,6 +2882,7 @@ do_moduli_screen(const char *out_file, c
Dmitry Belyavskiy 925484
 		} else if (strncmp(opts[i], "start-line=", 11) == 0) {
Dmitry Belyavskiy 925484
 			start_lineno = strtoul(opts[i]+11, NULL, 10);
Dmitry Belyavskiy 925484
 		} else if (strncmp(opts[i], "checkpoint=", 11) == 0) {
Dmitry Belyavskiy 925484
+			free(checkpoint);
Dmitry Belyavskiy 925484
 			checkpoint = xstrdup(opts[i]+11);
Dmitry Belyavskiy 925484
 		} else if (strncmp(opts[i], "generator=", 10) == 0) {
Dmitry Belyavskiy 925484
 			generator_wanted = (u_int32_t)strtonum(
Dmitry Belyavskiy 925484
@@ -2920,6 +2924,9 @@ do_moduli_screen(const char *out_file, c
Dmitry Belyavskiy 925484
 #else /* WITH_OPENSSL */
Dmitry Belyavskiy 925484
 	fatal("Moduli screening is not supported");
Dmitry Belyavskiy 925484
 #endif /* WITH_OPENSSL */
Dmitry Belyavskiy 925484
+	free(checkpoint);
Dmitry Belyavskiy 925484
+	if (in != stdin)
Dmitry Belyavskiy 925484
+		fclose(in);
Dmitry Belyavskiy 925484
 }
Dmitry Belyavskiy 925484
 
Dmitry Belyavskiy 925484
 static char *
Dmitry Belyavskiy 925484
diff -up openssh-8.5p1/sshsig.c.coverity openssh-8.5p1/sshsig.c
Dmitry Belyavskiy 925484
--- openssh-8.5p1/sshsig.c.coverity	2021-03-02 11:31:47.000000000 +0100
Dmitry Belyavskiy 925484
+++ openssh-8.5p1/sshsig.c	2021-03-24 12:03:33.787968194 +0100
Dmitry Belyavskiy 925484
@@ -515,6 +515,7 @@ hash_file(int fd, const char *hashalg, s
Dmitry Belyavskiy 925484
 			oerrno = errno;
Dmitry Belyavskiy 925484
 			error_f("read: %s", strerror(errno));
Dmitry Belyavskiy 925484
 			ssh_digest_free(ctx);
Dmitry Belyavskiy 925484
+			ctx = NULL;
Dmitry Belyavskiy 925484
 			errno = oerrno;
Dmitry Belyavskiy 925484
 			r = SSH_ERR_SYSTEM_ERROR;
Dmitry Belyavskiy 925484
 			goto out;