From 127701d9d32e568f09c775e722286e9c0b8c72ec Mon Sep 17 00:00:00 2001 From: Tomas Hozza Date: Fri, 22 May 2015 16:56:25 +0200 Subject: [PATCH] Fix coverity issues http://cov01.lab.eng.brq.redhat.com/covscanhub/waiving/9377/ Signed-off-by: Tomas Hozza --- bin/named/server.c | 8 +++----- lib/dns/dispatch.c | 5 +++-- lib/dns/dst_api.c | 6 ++++++ lib/dns/gen.c | 16 +++++++++++++++- lib/dns/name.c | 8 ++------ lib/dns/nsec3.c | 4 ++-- lib/dns/rcode.c | 4 +++- lib/isc/netaddr.c | 1 + lib/isc/pk11.c | 21 ++++++++++++++------- 9 files changed, 49 insertions(+), 24 deletions(-) diff --git a/bin/named/server.c b/bin/named/server.c index 227c646..5e94660 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -8018,9 +8018,11 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { dns_zone_t *zone = NULL; char classstr[DNS_RDATACLASS_FORMATSIZE]; char zonename[DNS_NAME_FORMATSIZE]; - const char *vname, *sep, *msg = NULL, *arg; + const char *vname, *sep, *arg; isc_boolean_t cleanup = ISC_FALSE; + UNUSED(text); + (void) next_token(&args, " \t"); arg = next_token(&args, " \t"); @@ -8061,10 +8063,6 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) { result = synczone(zone, &cleanup); isc_task_endexclusive(server->task); - if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text)) - isc_buffer_putmem(text, (const unsigned char *)msg, - strlen(msg) + 1); - view = dns_zone_getview(zone); if (strcmp(view->name, "_default") == 0 || strcmp(view->name, "_bind") == 0) diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c index 5063914..c93651d 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -2278,9 +2278,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr, /* Create or adjust socket pool */ if (mgr->spool != NULL) { - if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) + if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) { isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); isc_mempool_setfreemax(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2); + } UNLOCK(&mgr->buffer_lock); return (ISC_R_SUCCESS); } @@ -3765,7 +3766,7 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr, goto fail_alloc; dset->dispatches = isc_mem_get(mctx, sizeof(dns_dispatch_t *) * n); - if (dset == NULL) { + if (dset->dispatches == NULL) { result = ISC_R_NOMEMORY; goto fail_lock; } diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c index d96473f..e71f202 100644 --- a/lib/dns/dst_api.c +++ b/lib/dns/dst_api.c @@ -1882,6 +1882,9 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) { #ifdef BIND9 unsigned int flags = dst_entropy_flags; + if (dst_entropy_pool == NULL) + return (ISC_R_FAILURE); + if (len == 0) return (ISC_R_SUCCESS); @@ -1914,6 +1917,9 @@ dst__entropy_status(void) { unsigned char buf[32]; static isc_boolean_t first = ISC_TRUE; + if (dst_entropy_pool == NULL) + return (0); + if (first) { /* Someone believes RAND_status() initializes the PRNG */ flags &= ~ISC_ENTROPY_GOODONLY; diff --git a/lib/dns/gen.c b/lib/dns/gen.c index 6b533dd..548f892 100644 --- a/lib/dns/gen.c +++ b/lib/dns/gen.c @@ -335,10 +335,14 @@ insert_into_typenames(int type, const char *typename, const char *attr) { typename); exit(1); } + strncpy(ttn->typename, typename, sizeof(ttn->typename)); - ttn->type = type; + ttn->typename[sizeof(ttn->typename) - 1] = '\0'; strncpy(ttn->macroname, ttn->typename, sizeof(ttn->macroname)); + ttn->macroname[sizeof(ttn->macroname) - 1] = '\0'; + + ttn->type = type; c = strlen(ttn->macroname); while (c > 0) { if (ttn->macroname[c - 1] == '-') @@ -364,7 +368,10 @@ insert_into_typenames(int type, const char *typename, const char *attr) { attr, typename); exit(1); } + strncpy(ttn->attr, attr, sizeof(ttn->attr)); + ttn->attr[sizeof(ttn->attr) - 1] = '\0'; + ttn->sorted = 0; if (maxtype < type) maxtype = type; @@ -393,11 +400,17 @@ add(int rdclass, const char *classname, int type, const char *typename, newtt->next = NULL; newtt->rdclass = rdclass; newtt->type = type; + strncpy(newtt->classname, classname, sizeof(newtt->classname)); + newtt->classname[sizeof(newtt->classname) - 1] = '\0'; + strncpy(newtt->typename, typename, sizeof(newtt->typename)); + newtt->typename[sizeof(newtt->typename) - 1] = '\0'; + if (strncmp(dirname, "./", 2) == 0) dirname += 2; strncpy(newtt->dirname, dirname, sizeof(newtt->dirname)); + newtt->dirname[sizeof(newtt->dirname) - 1] = '\0'; tt = types; oldtt = NULL; @@ -436,6 +449,7 @@ add(int rdclass, const char *classname, int type, const char *typename, } newcc->rdclass = rdclass; strncpy(newcc->classname, classname, sizeof(newcc->classname)); + newcc->classname[sizeof(newcc->classname) - 1] = '\0'; cc = classes; oldcc = NULL; diff --git a/lib/dns/name.c b/lib/dns/name.c index 4fcabb1..93173ee 100644 --- a/lib/dns/name.c +++ b/lib/dns/name.c @@ -1859,7 +1859,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, 0) return (DNS_R_DISALLOWED); new_current = c & 0x3F; - n = 1; state = fw_newcurrent; } else return (DNS_R_BADLABELTYPE); @@ -1867,8 +1866,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, case fw_ordinary: if (downcase) c = maptolower[c]; - /* FALLTHROUGH */ - case fw_copy: *ndata++ = c; n--; if (n == 0) @@ -1877,9 +1874,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source, case fw_newcurrent: new_current *= 256; new_current += c; - n--; - if (n != 0) - break; if (new_current >= biggest_pointer) return (DNS_R_BADPOINTER); biggest_pointer = new_current; @@ -2398,6 +2392,8 @@ dns_name_tostring(dns_name_t *name, char **target, isc_mem_t *mctx) { isc_buffer_usedregion(&buf, ®); p = isc_mem_allocate(mctx, reg.length + 1); + if (p == NULL) + return (ISC_R_NOMEMORY); memcpy(p, (char *) reg.base, (int) reg.length); p[reg.length] = '\0'; diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c index 935f515..86fad33 100644 --- a/lib/dns/nsec3.c +++ b/lib/dns/nsec3.c @@ -842,8 +842,8 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version, dns_db_detachnode(db, &newnode); } while (1); - if (result == ISC_R_NOMORE) - result = ISC_R_SUCCESS; + /* result cannot be ISC_R_NOMORE here */ + INSIST(result != ISC_R_NOMORE); failure: if (dbit != NULL) diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c index 0b7fe8c..091b3c7 100644 --- a/lib/dns/rcode.c +++ b/lib/dns/rcode.c @@ -216,7 +216,9 @@ maybe_numeric(unsigned int *valuep, isc_textregion_t *source, * isc_parse_uint32(). isc_parse_uint32() requires * null termination, so we must make a copy. */ - strncpy(buffer, source->base, NUMBERSIZE); + strncpy(buffer, source->base, sizeof(buffer)); + buffer[sizeof(buffer) - 1] = '\0'; + INSIST(buffer[source->length] == '\0'); result = isc_parse_uint32(&n, buffer, 10); diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c index 5cce1bc..6706542 100644 --- a/lib/isc/netaddr.c +++ b/lib/isc/netaddr.c @@ -235,6 +235,7 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) { nbytes = prefixlen / 8; nbits = prefixlen % 8; if (nbits != 0) { + INSIST(nbytes < ipbytes); if ((p[nbytes] & (0xff>>nbits)) != 0U) return (ISC_R_FAILURE); nbytes++; diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c index 015bff2..de4479b 100644 --- a/lib/isc/pk11.c +++ b/lib/isc/pk11.c @@ -130,7 +130,10 @@ #include #include -#define PINLEN 32 +/* was 32 octets, Petr Spacek suggested 1024, SoftHSMv2 uses 256... */ +#ifndef PINLEN +#define PINLEN 256 +#endif #ifndef PK11_NO_LOGERR #define PK11_NO_LOGERR 1 @@ -163,7 +166,7 @@ struct pk11_token { char manuf[32]; char model[16]; char serial[16]; - char pin[PINLEN]; + char pin[PINLEN + 1]; }; static ISC_LIST(pk11_token_t) tokens; @@ -498,7 +501,9 @@ pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype, /* Override the token's PIN */ if (logon && pin != NULL && *pin != '\0') { - memset(token->pin, 0, PINLEN); + if (strlen(pin) > PINLEN) + return ISC_R_RANGE; + memset(token->pin, 0, PINLEN + 1); strncpy(token->pin, pin, PINLEN); } @@ -1099,7 +1104,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label, char *uri, *p, *a, *na, *v; size_t len, l; FILE *stream = NULL; - char pin[PINLEN]; + char pin[PINLEN + 1]; isc_boolean_t gotpin = ISC_FALSE; isc_result_t ret; @@ -1207,10 +1212,12 @@ pk11_parse_uri(pk11_object_t *obj, const char *label, ret = isc_stdio_open(v, "r", &stream); if (ret != ISC_R_SUCCESS) goto err; - memset(pin, 0, PINLEN); - ret = isc_stdio_read(pin, 1, PINLEN - 1, stream, NULL); + memset(pin, 0, PINLEN + 1); + ret = isc_stdio_read(pin, 1, PINLEN + 1, stream, &l); if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF)) goto err; + if (l > PINLEN) + DST_RET(ISC_R_RANGE); ret = isc_stdio_close(stream); stream = NULL; if (ret != ISC_R_SUCCESS) @@ -1238,7 +1245,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label, DST_RET(ISC_R_NOTFOUND); obj->slot = token->slotid; if (gotpin) { - memmove(token->pin, pin, PINLEN); + memmove(token->pin, pin, PINLEN + 1); obj->reqlogon = ISC_TRUE; } -- 2.1.0