From c5fcd8ab8ee1b66d0ef75b02f72ccfc3ebf50cf5 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Wed, 12 Sep 2018 15:01:37 +0200

Subject: [PATCH 1/2] Purge unused variables

---

 packaging/ldns-config.in | 3 ---

 1 file changed, 3 deletions(-)

diff --git a/packaging/ldns-config.in b/packaging/ldns-config.in

index 950c135..a8c860e 100755

--- a/packaging/ldns-config.in

+++ b/packaging/ldns-config.in

@@ -1,9 +1,6 @@

 #!/bin/sh

-prefix="@prefix@"

-exec_prefix="@exec_prefix@"

 VERSION="@PACKAGE_VERSION@"

-CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@ @PYTHON_CPPFLAGS@"

 LIBS="@LIBS@ @LIBSSL_LIBS@"

 INCLUDEDIR="@includedir@"

 LIBVERSION="@VERSION_INFO@"

-- 

2.20.1

From db06eb482b09a0bcdaf3f688702b1c0df2cb1eca Mon Sep 17 00:00:00 2001

From: Willem Toorop <willem@nlnetlabs.nl>

Date: Thu, 11 Jul 2019 15:22:44 +0200

Subject: [PATCH 2/2] Issues detected in ldns library by scan of Coverity

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Thanks Petr Menšík

---

 dnssec.c        |  6 +++++-

 dnssec_sign.c   |  4 ++--

 dnssec_verify.c | 18 ++++++------------

 dnssec_zone.c   | 23 +++++++++++++++++------

 host2str.c      | 13 +++++++------

 host2wire.c     | 22 ++++++++++++++++------

 net.c           | 12 ++++++++++--

 packet.c        |  2 ++

 radix.c         |  5 ++++-

 str2host.c      |  2 ++

 10 files changed, 71 insertions(+), 36 deletions(-)

diff --git a/dnssec.c b/dnssec.c

index e3c99de..b2dd3f3 100644

--- a/dnssec.c

+++ b/dnssec.c

@@ -149,6 +149,7 @@ ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname,

 	                LDNS_FREE(salt);

 	                ldns_rdf_deep_free(zone_name);

 	                ldns_rdf_deep_free(sname);

+			ldns_rdf_deep_free(hashed_sname);

                         return NULL;

                 }

@@ -1556,6 +1557,7 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,

 	ldns_rr_list *sigs_covered;

 	ldns_rdf *rdf_t;

 	ldns_rr_type t_netorder;

+	ldns_status status;

 	if (!k) {

 		return LDNS_STATUS_ERR;

@@ -1607,7 +1609,9 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,

 		}

 		return LDNS_STATUS_ERR;

 	}

-	return ldns_verify_time(rrset, sigs, k, check_time, good_keys);

+	status = ldns_verify_time(rrset, sigs, k, check_time, good_keys);

+	ldns_rr_list_deep_free(rrset);

+	return status;

 }

 ldns_status

diff --git a/dnssec_sign.c b/dnssec_sign.c

index 22f0981..94ea925 100644

--- a/dnssec_sign.c

+++ b/dnssec_sign.c

@@ -234,8 +234,6 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)

 	new_owner = NULL;

-	signatures = ldns_rr_list_new();

-

 	/* prepare a signature and add all the know data

 	 * prepare the rrset. Sign this together.  */

 	rrset_clone = ldns_rr_list_clone(rrset);

@@ -252,6 +250,8 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)

 	/* sort */

 	ldns_rr_list_sort(rrset_clone);

+	signatures = ldns_rr_list_new();

+

 	for (key_count = 0;

 		key_count < ldns_key_list_key_count(keys);

 		key_count++) {

diff --git a/dnssec_verify.c b/dnssec_verify.c

index c554e4f..c7e2fba 100644

--- a/dnssec_verify.c

+++ b/dnssec_verify.c

@@ -1583,8 +1583,6 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr

 	bool wildcard_covered = false;

 	ldns_rdf *zone_name;

 	ldns_rdf *hashed_name;

-	/* self assignment to suppress uninitialized warning */

-	ldns_rdf *next_closer = next_closer;

 	ldns_rdf *hashed_next_closer;

 	size_t i;

 	ldns_status result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;

@@ -1659,6 +1657,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr

 				}

 			}

 		}

+		ldns_rdf_deep_free(hashed_name);

 		result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;

 		/* wildcard no data? section 8.7 */

 		closest_encloser = ldns_dnssec_nsec3_closest_encloser(

@@ -1748,7 +1747,9 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr

 			/* Query name *is* the "next closer". */

 			hashed_next_closer = hashed_name;

 		} else {

-

+			ldns_rdf *next_closer;

+			

+			ldns_rdf_deep_free(hashed_name);

 			/* "next closer" has less labels than the query name.

 			 * Create the name and hash it.

 			 */

@@ -1762,6 +1763,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr

 					next_closer

 					);

 			(void) ldns_dname_cat(hashed_next_closer, zone_name);

+			ldns_rdf_deep_free(next_closer);

 		}

 		/* Find the NSEC3 that covers the "next closer" */

 		for (i = 0; i < ldns_rr_list_rr_count(nsecs); i++) {

@@ -1776,15 +1778,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr

 				break;

 			}

 		}

-		if (ldns_dname_label_count(closest_encloser) + 1

-		    < ldns_dname_label_count(ldns_rr_owner(rr))) {

-

-			/* "next closer" has less labels than the query name.

-			 * Dispose of the temporary variables that held that name.

-			 */

-			ldns_rdf_deep_free(hashed_next_closer);

-			ldns_rdf_deep_free(next_closer);

-		}

+		ldns_rdf_deep_free(hashed_next_closer);

 		ldns_rdf_deep_free(closest_encloser);

 	}

diff --git a/dnssec_zone.c b/dnssec_zone.c

index f610a3c..e089754 100644

--- a/dnssec_zone.c

+++ b/dnssec_zone.c

@@ -746,6 +746,7 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or

 		newzone = NULL;

 	} else {

 		ldns_dnssec_zone_free(newzone);

+		newzone = NULL;

 	}

 error:

@@ -1105,8 +1106,12 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(

 				ldns_rdf *ent_name;

 				if (!(ent_name = ldns_dname_clone_from(

-						next_name, i)))

+						next_name, i))) {

+					

+					ldns_rdf_deep_free(l1);

+					ldns_rdf_deep_free(l2);

 					return LDNS_STATUS_MEM_ERR;

+				}

 				if (nsec3s && zone->_nsec3params) {

 					ldns_rdf *ent_hashed_name;

@@ -1114,28 +1119,34 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(

 					if (!(ent_hashed_name =

 					    ldns_nsec3_hash_name_frm_nsec3(

 							zone->_nsec3params,

-							ent_name)))

+							ent_name))) {

+						ldns_rdf_deep_free(l1);

+						ldns_rdf_deep_free(l2);

+						ldns_rdf_deep_free(ent_name);

 						return LDNS_STATUS_MEM_ERR;

+					}

 					node = ldns_rbtree_search(nsec3s, 

 							ent_hashed_name);

 					if (!node) {

 						ldns_rdf_deep_free(l1);

 						ldns_rdf_deep_free(l2);

+						ldns_rdf_deep_free(ent_name);

 						continue;

 					}

 				}

 				new_name = ldns_dnssec_name_new();

 				if (!new_name) {

+					ldns_rdf_deep_free(l1);

+					ldns_rdf_deep_free(l2);

+					ldns_rdf_deep_free(ent_name);

 					return LDNS_STATUS_MEM_ERR;

 				}

 				new_name->name = ent_name;

-				if (!new_name->name) {

-					ldns_dnssec_name_free(new_name);

-					return LDNS_STATUS_MEM_ERR;

-				}

 				new_name->name_alloced = true;

 				new_node = LDNS_MALLOC(ldns_rbnode_t);

 				if (!new_node) {

+					ldns_rdf_deep_free(l1);

+					ldns_rdf_deep_free(l2);

 					ldns_dnssec_name_free(new_name);

 					return LDNS_STATUS_MEM_ERR;

 				}

diff --git a/host2str.c b/host2str.c

index 747d543..f39a184 100644

--- a/host2str.c

+++ b/host2str.c

@@ -1085,12 +1085,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)

 			/* no gateway */

 			break;

 		case 1:

-			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);

-                        if(!gateway_data)

-                                return LDNS_STATUS_MEM_ERR;

 			if (ldns_rdf_size(rdf) < offset + LDNS_IP4ADDRLEN) {

 				return LDNS_STATUS_ERR;

 			}

+			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);

+                        if(!gateway_data)

+                                return LDNS_STATUS_MEM_ERR;

 			memcpy(gateway_data, &data[offset], LDNS_IP4ADDRLEN);

 			gateway = ldns_rdf_new(LDNS_RDF_TYPE_A,

 					LDNS_IP4ADDRLEN , gateway_data);

@@ -1101,12 +1101,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)

                         }

 			break;

 		case 2:

-			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);

-                        if(!gateway_data)

-                                return LDNS_STATUS_MEM_ERR;

 			if (ldns_rdf_size(rdf) < offset + LDNS_IP6ADDRLEN) {

 				return LDNS_STATUS_ERR;

 			}

+			gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);

+                        if(!gateway_data)

+                                return LDNS_STATUS_MEM_ERR;

 			memcpy(gateway_data, &data[offset], LDNS_IP6ADDRLEN);

 			offset += LDNS_IP6ADDRLEN;

 			gateway =

@@ -1129,6 +1129,7 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)

 	}

 	if (ldns_rdf_size(rdf) <= offset) {

+                ldns_rdf_deep_free(gateway);

 		return LDNS_STATUS_ERR;

 	}

 	public_key_size = ldns_rdf_size(rdf) - offset;

diff --git a/host2wire.c b/host2wire.c

index 4d8aa30..a12b6b0 100644

--- a/host2wire.c

+++ b/host2wire.c

@@ -67,17 +67,27 @@ ldns_dname2buffer_wire_compress(ldns_buffer *buffer, const ldns_rdf *name, ldns_

 	{

 		/* Not found. Write cache entry, take off first label, write it, */

 		/* try again with the rest of the name. */

-		node = LDNS_MALLOC(ldns_rbnode_t);

-		if(!node)

-		{

-			return LDNS_STATUS_MEM_ERR;

-		}

 		if (ldns_buffer_position(buffer) < 16384) {

-			node->key = ldns_rdf_clone(name);

+			ldns_rdf *key;

+

+			node = LDNS_MALLOC(ldns_rbnode_t);

+			if(!node)

+			{

+				return LDNS_STATUS_MEM_ERR;

+			}

+

+			key = ldns_rdf_clone(name);

+			if (!key) {

+				LDNS_FREE(node);

+				return LDNS_STATUS_MEM_ERR;

+			}

+			node->key = key;

 			node->data = (void *) (intptr_t) ldns_buffer_position(buffer);

 			if(!ldns_rbtree_insert(compression_data,node))

 			{

 				/* fprintf(stderr,"Name not found but now it's there?\n"); */

+				ldns_rdf_deep_free(key);

+				LDNS_FREE(node);

 			}

 		}

 		label = ldns_dname_label(name, 0);

diff --git a/net.c b/net.c

index 9e048d2..6e6a12b 100644

--- a/net.c

+++ b/net.c

@@ -202,6 +202,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,

 	}

 #endif

 	if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == SOCK_INVALID){

+		close_socket(sockfd);

 		return 0;

 	}

@@ -337,7 +338,7 @@ ldns_tcp_send_from(uint8_t **result,  ldns_buffer *qbin,

 	answer = ldns_tcp_read_wire_timeout(sockfd, answer_size, timeout);

 	close_socket(sockfd);

-	if (*answer_size == 0) {

+	if (!answer) {

 		/* oops */

 		return LDNS_STATUS_NETWORK_ERR;

 	}

@@ -390,6 +391,7 @@ ldns_udp_bgsend_from(ldns_buffer *qbin,

 	}

 	if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == -1){

+		close_socket(sockfd);

 		return 0;

 	}

@@ -437,7 +439,7 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin,

 	answer = ldns_udp_read_wire(sockfd, answer_size, NULL, NULL);

 	close_socket(sockfd);

-	if (*answer_size == 0) {

+	if (!answer) {

 		/* oops */

 		return LDNS_STATUS_NETWORK_ERR;

 	}

@@ -571,6 +573,9 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf

 		if (!reply_bytes) {

 			/* the current nameserver seems to have a problem, blacklist it */

 			if (ldns_resolver_fail(r)) {

+				if(src) {

+					LDNS_FREE(src);

+				}

 				LDNS_FREE(ns);

 				return LDNS_STATUS_ERR;

 			} else {

@@ -918,6 +923,9 @@ ldns_axfr_start(ldns_resolver *resolver, const ldns_rdf *domain, ldns_rr_class c

 				src, (socklen_t)src_len,

 				ldns_resolver_timeout(resolver));

 	}

+	if (src) {

+		LDNS_FREE(src);

+	}

 	if (resolver->_socket == SOCK_INVALID) {

 		ldns_pkt_free(query);

diff --git a/packet.c b/packet.c

index 95f8f3f..f8fb960 100644

--- a/packet.c

+++ b/packet.c

@@ -928,11 +928,13 @@ ldns_pkt_query_new_frm_str_internal(ldns_pkt **p, const char *name,

 	}

 	if (!ldns_pkt_set_flags(packet, flags)) {

+		ldns_pkt_free(packet);

 		return LDNS_STATUS_ERR;

 	}

 	question_rr = ldns_rr_new();

 	if (!question_rr) {

+		ldns_pkt_free(packet);

 		return LDNS_STATUS_MEM_ERR;

 	}

diff --git a/radix.c b/radix.c

index 43f7365..9695e13 100644

--- a/radix.c

+++ b/radix.c

@@ -225,9 +225,9 @@ ldns_radix_insert(ldns_radix_t* tree, uint8_t* key, radix_strlen_t len,

 		}

 	} else if (pos == len) {

 		/** Exact match found */

+		LDNS_FREE(add);

 		if (prefix->data) {

 			/* Element already exists */

-			LDNS_FREE(add);

 			return LDNS_STATUS_EXISTS_ERR;

 		}

 		prefix->data = data;

@@ -1120,12 +1120,15 @@ ldns_radix_array_split(ldns_radix_array_t* array, uint8_t* key,

 		if (array->len - common_len > 1) {

 			if (!ldns_radix_prefix_remainder(common_len+1,

 				array->str, array->len, &s1, &l1)) {

+				LDNS_FREE(common);

 				return 0;

 			}

 		}

 		if (strlen_to_add - common_len > 1) {

 			if (!ldns_radix_prefix_remainder(common_len+1,

 				str_to_add, strlen_to_add, &s2, &l2)) {

+				LDNS_FREE(common);

+				LDNS_FREE(s1);

 				return 0;

 			}

 		}

diff --git a/str2host.c b/str2host.c

index c3afba1..68bccf1 100644

--- a/str2host.c

+++ b/str2host.c

@@ -445,6 +445,7 @@ ldns_str2rdf_str(ldns_rdf **rd, const char *str)

 		*++dp = ch;

 	}

 	if (! str) {

+		LDNS_FREE(data);

 		return LDNS_STATUS_SYNTAX_BAD_ESCAPE;

 	}

 	length = (size_t)(dp - data);

@@ -1494,6 +1495,7 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str)

 		}

 	}

 	if (! str) {

+		LDNS_FREE(data);

 		return LDNS_STATUS_SYNTAX_BAD_ESCAPE;

 	}

 	if (!(length = (size_t)(dp - data))) {

-- 

2.20.1