From c5fcd8ab8ee1b66d0ef75b02f72ccfc3ebf50cf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 12 Sep 2018 15:01:37 +0200
Subject: [PATCH 1/2] Purge unused variables
---
packaging/ldns-config.in | 3 ---
1 file changed, 3 deletions(-)
diff --git a/packaging/ldns-config.in b/packaging/ldns-config.in
index 950c135..a8c860e 100755
--- a/packaging/ldns-config.in
+++ b/packaging/ldns-config.in
@@ -1,9 +1,6 @@
#!/bin/sh
-prefix="@prefix@"
-exec_prefix="@exec_prefix@"
VERSION="@PACKAGE_VERSION@"
-CPPFLAGS="@CPPFLAGS@ @LIBSSL_CPPFLAGS@ @PYTHON_CPPFLAGS@"
LIBS="@LIBS@ @LIBSSL_LIBS@"
INCLUDEDIR="@includedir@"
LIBVERSION="@VERSION_INFO@"
--
2.20.1
From db06eb482b09a0bcdaf3f688702b1c0df2cb1eca Mon Sep 17 00:00:00 2001
From: Willem Toorop <willem@nlnetlabs.nl>
Date: Thu, 11 Jul 2019 15:22:44 +0200
Subject: [PATCH 2/2] Issues detected in ldns library by scan of Coverity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Thanks Petr Menšík
---
dnssec.c | 6 +++++-
dnssec_sign.c | 4 ++--
dnssec_verify.c | 18 ++++++------------
dnssec_zone.c | 23 +++++++++++++++++------
host2str.c | 13 +++++++------
host2wire.c | 22 ++++++++++++++++------
net.c | 12 ++++++++++--
packet.c | 2 ++
radix.c | 5 ++++-
str2host.c | 2 ++
10 files changed, 71 insertions(+), 36 deletions(-)
diff --git a/dnssec.c b/dnssec.c
index e3c99de..b2dd3f3 100644
--- a/dnssec.c
+++ b/dnssec.c
@@ -149,6 +149,7 @@ ldns_dnssec_nsec3_closest_encloser(const ldns_rdf *qname,
LDNS_FREE(salt);
ldns_rdf_deep_free(zone_name);
ldns_rdf_deep_free(sname);
+ ldns_rdf_deep_free(hashed_sname);
return NULL;
}
@@ -1556,6 +1557,7 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,
ldns_rr_list *sigs_covered;
ldns_rdf *rdf_t;
ldns_rr_type t_netorder;
+ ldns_status status;
if (!k) {
return LDNS_STATUS_ERR;
@@ -1607,7 +1609,9 @@ ldns_pkt_verify_time(const ldns_pkt *p, ldns_rr_type t, const ldns_rdf *o,
}
return LDNS_STATUS_ERR;
}
- return ldns_verify_time(rrset, sigs, k, check_time, good_keys);
+ status = ldns_verify_time(rrset, sigs, k, check_time, good_keys);
+ ldns_rr_list_deep_free(rrset);
+ return status;
}
ldns_status
diff --git a/dnssec_sign.c b/dnssec_sign.c
index 22f0981..94ea925 100644
--- a/dnssec_sign.c
+++ b/dnssec_sign.c
@@ -234,8 +234,6 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
new_owner = NULL;
- signatures = ldns_rr_list_new();
-
/* prepare a signature and add all the know data
* prepare the rrset. Sign this together. */
rrset_clone = ldns_rr_list_clone(rrset);
@@ -252,6 +250,8 @@ ldns_sign_public(ldns_rr_list *rrset, ldns_key_list *keys)
/* sort */
ldns_rr_list_sort(rrset_clone);
+ signatures = ldns_rr_list_new();
+
for (key_count = 0;
key_count < ldns_key_list_key_count(keys);
key_count++) {
diff --git a/dnssec_verify.c b/dnssec_verify.c
index c554e4f..c7e2fba 100644
--- a/dnssec_verify.c
+++ b/dnssec_verify.c
@@ -1583,8 +1583,6 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
bool wildcard_covered = false;
ldns_rdf *zone_name;
ldns_rdf *hashed_name;
- /* self assignment to suppress uninitialized warning */
- ldns_rdf *next_closer = next_closer;
ldns_rdf *hashed_next_closer;
size_t i;
ldns_status result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;
@@ -1659,6 +1657,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
}
}
}
+ ldns_rdf_deep_free(hashed_name);
result = LDNS_STATUS_DNSSEC_NSEC_RR_NOT_COVERED;
/* wildcard no data? section 8.7 */
closest_encloser = ldns_dnssec_nsec3_closest_encloser(
@@ -1748,7 +1747,9 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
/* Query name *is* the "next closer". */
hashed_next_closer = hashed_name;
} else {
-
+ ldns_rdf *next_closer;
+
+ ldns_rdf_deep_free(hashed_name);
/* "next closer" has less labels than the query name.
* Create the name and hash it.
*/
@@ -1762,6 +1763,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
next_closer
);
(void) ldns_dname_cat(hashed_next_closer, zone_name);
+ ldns_rdf_deep_free(next_closer);
}
/* Find the NSEC3 that covers the "next closer" */
for (i = 0; i < ldns_rr_list_rr_count(nsecs); i++) {
@@ -1776,15 +1778,7 @@ ldns_dnssec_verify_denial_nsec3_match( ldns_rr *rr
break;
}
}
- if (ldns_dname_label_count(closest_encloser) + 1
- < ldns_dname_label_count(ldns_rr_owner(rr))) {
-
- /* "next closer" has less labels than the query name.
- * Dispose of the temporary variables that held that name.
- */
- ldns_rdf_deep_free(hashed_next_closer);
- ldns_rdf_deep_free(next_closer);
- }
+ ldns_rdf_deep_free(hashed_next_closer);
ldns_rdf_deep_free(closest_encloser);
}
diff --git a/dnssec_zone.c b/dnssec_zone.c
index f610a3c..e089754 100644
--- a/dnssec_zone.c
+++ b/dnssec_zone.c
@@ -746,6 +746,7 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
newzone = NULL;
} else {
ldns_dnssec_zone_free(newzone);
+ newzone = NULL;
}
error:
@@ -1105,8 +1106,12 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(
ldns_rdf *ent_name;
if (!(ent_name = ldns_dname_clone_from(
- next_name, i)))
+ next_name, i))) {
+
+ ldns_rdf_deep_free(l1);
+ ldns_rdf_deep_free(l2);
return LDNS_STATUS_MEM_ERR;
+ }
if (nsec3s && zone->_nsec3params) {
ldns_rdf *ent_hashed_name;
@@ -1114,28 +1119,34 @@ ldns_dnssec_zone_add_empty_nonterminals_nsec3(
if (!(ent_hashed_name =
ldns_nsec3_hash_name_frm_nsec3(
zone->_nsec3params,
- ent_name)))
+ ent_name))) {
+ ldns_rdf_deep_free(l1);
+ ldns_rdf_deep_free(l2);
+ ldns_rdf_deep_free(ent_name);
return LDNS_STATUS_MEM_ERR;
+ }
node = ldns_rbtree_search(nsec3s,
ent_hashed_name);
if (!node) {
ldns_rdf_deep_free(l1);
ldns_rdf_deep_free(l2);
+ ldns_rdf_deep_free(ent_name);
continue;
}
}
new_name = ldns_dnssec_name_new();
if (!new_name) {
+ ldns_rdf_deep_free(l1);
+ ldns_rdf_deep_free(l2);
+ ldns_rdf_deep_free(ent_name);
return LDNS_STATUS_MEM_ERR;
}
new_name->name = ent_name;
- if (!new_name->name) {
- ldns_dnssec_name_free(new_name);
- return LDNS_STATUS_MEM_ERR;
- }
new_name->name_alloced = true;
new_node = LDNS_MALLOC(ldns_rbnode_t);
if (!new_node) {
+ ldns_rdf_deep_free(l1);
+ ldns_rdf_deep_free(l2);
ldns_dnssec_name_free(new_name);
return LDNS_STATUS_MEM_ERR;
}
diff --git a/host2str.c b/host2str.c
index 747d543..f39a184 100644
--- a/host2str.c
+++ b/host2str.c
@@ -1085,12 +1085,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
/* no gateway */
break;
case 1:
- gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);
- if(!gateway_data)
- return LDNS_STATUS_MEM_ERR;
if (ldns_rdf_size(rdf) < offset + LDNS_IP4ADDRLEN) {
return LDNS_STATUS_ERR;
}
+ gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP4ADDRLEN);
+ if(!gateway_data)
+ return LDNS_STATUS_MEM_ERR;
memcpy(gateway_data, &data[offset], LDNS_IP4ADDRLEN);
gateway = ldns_rdf_new(LDNS_RDF_TYPE_A,
LDNS_IP4ADDRLEN , gateway_data);
@@ -1101,12 +1101,12 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
}
break;
case 2:
- gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);
- if(!gateway_data)
- return LDNS_STATUS_MEM_ERR;
if (ldns_rdf_size(rdf) < offset + LDNS_IP6ADDRLEN) {
return LDNS_STATUS_ERR;
}
+ gateway_data = LDNS_XMALLOC(uint8_t, LDNS_IP6ADDRLEN);
+ if(!gateway_data)
+ return LDNS_STATUS_MEM_ERR;
memcpy(gateway_data, &data[offset], LDNS_IP6ADDRLEN);
offset += LDNS_IP6ADDRLEN;
gateway =
@@ -1129,6 +1129,7 @@ ldns_rdf2buffer_str_ipseckey(ldns_buffer *output, const ldns_rdf *rdf)
}
if (ldns_rdf_size(rdf) <= offset) {
+ ldns_rdf_deep_free(gateway);
return LDNS_STATUS_ERR;
}
public_key_size = ldns_rdf_size(rdf) - offset;
diff --git a/host2wire.c b/host2wire.c
index 4d8aa30..a12b6b0 100644
--- a/host2wire.c
+++ b/host2wire.c
@@ -67,17 +67,27 @@ ldns_dname2buffer_wire_compress(ldns_buffer *buffer, const ldns_rdf *name, ldns_
{
/* Not found. Write cache entry, take off first label, write it, */
/* try again with the rest of the name. */
- node = LDNS_MALLOC(ldns_rbnode_t);
- if(!node)
- {
- return LDNS_STATUS_MEM_ERR;
- }
if (ldns_buffer_position(buffer) < 16384) {
- node->key = ldns_rdf_clone(name);
+ ldns_rdf *key;
+
+ node = LDNS_MALLOC(ldns_rbnode_t);
+ if(!node)
+ {
+ return LDNS_STATUS_MEM_ERR;
+ }
+
+ key = ldns_rdf_clone(name);
+ if (!key) {
+ LDNS_FREE(node);
+ return LDNS_STATUS_MEM_ERR;
+ }
+ node->key = key;
node->data = (void *) (intptr_t) ldns_buffer_position(buffer);
if(!ldns_rbtree_insert(compression_data,node))
{
/* fprintf(stderr,"Name not found but now it's there?\n"); */
+ ldns_rdf_deep_free(key);
+ LDNS_FREE(node);
}
}
label = ldns_dname_label(name, 0);
diff --git a/net.c b/net.c
index 9e048d2..6e6a12b 100644
--- a/net.c
+++ b/net.c
@@ -202,6 +202,7 @@ ldns_tcp_connect_from(const struct sockaddr_storage *to, socklen_t tolen,
}
#endif
if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == SOCK_INVALID){
+ close_socket(sockfd);
return 0;
}
@@ -337,7 +338,7 @@ ldns_tcp_send_from(uint8_t **result, ldns_buffer *qbin,
answer = ldns_tcp_read_wire_timeout(sockfd, answer_size, timeout);
close_socket(sockfd);
- if (*answer_size == 0) {
+ if (!answer) {
/* oops */
return LDNS_STATUS_NETWORK_ERR;
}
@@ -390,6 +391,7 @@ ldns_udp_bgsend_from(ldns_buffer *qbin,
}
if (from && bind(sockfd, (const struct sockaddr*)from, fromlen) == -1){
+ close_socket(sockfd);
return 0;
}
@@ -437,7 +439,7 @@ ldns_udp_send_from(uint8_t **result, ldns_buffer *qbin,
answer = ldns_udp_read_wire(sockfd, answer_size, NULL, NULL);
close_socket(sockfd);
- if (*answer_size == 0) {
+ if (!answer) {
/* oops */
return LDNS_STATUS_NETWORK_ERR;
}
@@ -571,6 +573,9 @@ ldns_send_buffer(ldns_pkt **result, ldns_resolver *r, ldns_buffer *qb, ldns_rdf
if (!reply_bytes) {
/* the current nameserver seems to have a problem, blacklist it */
if (ldns_resolver_fail(r)) {
+ if(src) {
+ LDNS_FREE(src);
+ }
LDNS_FREE(ns);
return LDNS_STATUS_ERR;
} else {
@@ -918,6 +923,9 @@ ldns_axfr_start(ldns_resolver *resolver, const ldns_rdf *domain, ldns_rr_class c
src, (socklen_t)src_len,
ldns_resolver_timeout(resolver));
}
+ if (src) {
+ LDNS_FREE(src);
+ }
if (resolver->_socket == SOCK_INVALID) {
ldns_pkt_free(query);
diff --git a/packet.c b/packet.c
index 95f8f3f..f8fb960 100644
--- a/packet.c
+++ b/packet.c
@@ -928,11 +928,13 @@ ldns_pkt_query_new_frm_str_internal(ldns_pkt **p, const char *name,
}
if (!ldns_pkt_set_flags(packet, flags)) {
+ ldns_pkt_free(packet);
return LDNS_STATUS_ERR;
}
question_rr = ldns_rr_new();
if (!question_rr) {
+ ldns_pkt_free(packet);
return LDNS_STATUS_MEM_ERR;
}
diff --git a/radix.c b/radix.c
index 43f7365..9695e13 100644
--- a/radix.c
+++ b/radix.c
@@ -225,9 +225,9 @@ ldns_radix_insert(ldns_radix_t* tree, uint8_t* key, radix_strlen_t len,
}
} else if (pos == len) {
/** Exact match found */
+ LDNS_FREE(add);
if (prefix->data) {
/* Element already exists */
- LDNS_FREE(add);
return LDNS_STATUS_EXISTS_ERR;
}
prefix->data = data;
@@ -1120,12 +1120,15 @@ ldns_radix_array_split(ldns_radix_array_t* array, uint8_t* key,
if (array->len - common_len > 1) {
if (!ldns_radix_prefix_remainder(common_len+1,
array->str, array->len, &s1, &l1)) {
+ LDNS_FREE(common);
return 0;
}
}
if (strlen_to_add - common_len > 1) {
if (!ldns_radix_prefix_remainder(common_len+1,
str_to_add, strlen_to_add, &s2, &l2)) {
+ LDNS_FREE(common);
+ LDNS_FREE(s1);
return 0;
}
}
diff --git a/str2host.c b/str2host.c
index c3afba1..68bccf1 100644
--- a/str2host.c
+++ b/str2host.c
@@ -445,6 +445,7 @@ ldns_str2rdf_str(ldns_rdf **rd, const char *str)
*++dp = ch;
}
if (! str) {
+ LDNS_FREE(data);
return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
}
length = (size_t)(dp - data);
@@ -1494,6 +1495,7 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str)
}
}
if (! str) {
+ LDNS_FREE(data);
return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
}
if (!(length = (size_t)(dp - data))) {
--
2.20.1