Blame SOURCES/0002-zsh-5.5.1-static-analysis.patch

021e4f
From bc943b78268ad633f79756639d4295f7b61dbedd Mon Sep 17 00:00:00 2001
021e4f
From: Kamil Dudka <kdudka@redhat.com>
021e4f
Date: Wed, 7 Nov 2018 14:04:52 +0100
021e4f
Subject: [PATCH 1/5] 43791: File descriptor could be closed twice in clone
021e4f
021e4f
Upstream-commit: a8cc017c74a916b690dc074c299faf4bd24b5af4
021e4f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
021e4f
021e4f
Error: USE_AFTER_FREE (CWE-825):
021e4f
zsh-5.5.1/Src/Modules/clone.c:71: closed_arg: "close(int)" closes "ttyfd".
021e4f
zsh-5.5.1/Src/Modules/clone.c:99: double_close: Calling "close(int)" closes handle "ttyfd" which has already been closed.
021e4f
 97|   	setsparam("TTY", ztrdup(ttystrname));
021e4f
 98|       }
021e4f
 99|->     close(ttyfd);
021e4f
100|       if (pid < 0) {
021e4f
101|   	zerrnam(nam, "fork failed: %e", errno);
021e4f
---
021e4f
 Src/Modules/clone.c | 3 ++-
021e4f
 1 file changed, 2 insertions(+), 1 deletion(-)
021e4f
021e4f
diff --git a/Src/Modules/clone.c b/Src/Modules/clone.c
021e4f
index 9304292..dfd8e8a 100644
021e4f
--- a/Src/Modules/clone.c
021e4f
+++ b/Src/Modules/clone.c
021e4f
@@ -96,7 +96,8 @@ bin_clone(char *nam, char **args, UNUSED(Options ops), UNUSED(int func))
021e4f
 	init_io(NULL);
021e4f
 	setsparam("TTY", ztrdup(ttystrname));
021e4f
     }
021e4f
-    close(ttyfd);
021e4f
+    else
021e4f
+	close(ttyfd);
021e4f
     if (pid < 0) {
021e4f
 	zerrnam(nam, "fork failed: %e", errno);
021e4f
 	return 1;
021e4f
-- 
021e4f
2.17.2
021e4f
021e4f
021e4f
From 6096988f02635ed336a056e3670b63070400e6bc Mon Sep 17 00:00:00 2001
021e4f
From: Kamil Dudka <kdudka@redhat.com>
021e4f
Date: Wed, 7 Nov 2018 14:04:53 +0100
021e4f
Subject: [PATCH 2/5] 43793: computil could overrun buffer
021e4f
021e4f
Upstream-commit: 031afe420725e328e9d7742be69ef0bd81c62b9a
021e4f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
021e4f
021e4f
Error: BUFFER_SIZE (CWE-120):
021e4f
zsh-5.5.1/Src/Zle/computil.c:564: overlapping_buffer: The source buffer "str->str + 2" potentially overlaps with the destination buffer "str->str", which results in undefined behavior for "strcpy".
021e4f
zsh-5.5.1/Src/Zle/computil.c:564: remediation: Replace "strcpy(dest, src)" with "memmove(dest, src, strlen(src)+1)".
021e4f
562|                       str->str = ztrdup(str->str);
021e4f
563|                   if (hide[1] && str->str[0] == '-' && str->str[1] == '-')
021e4f
564|->                     strcpy(str->str, str->str + 2);
021e4f
565|                   else if (str->str[0] == '-' || str->str[0] == '+')
021e4f
566|                       strcpy(str->str, str->str + 1);
021e4f
021e4f
Error: BUFFER_SIZE (CWE-120):
021e4f
zsh-5.5.1/Src/Zle/computil.c:566: overlapping_buffer: The source buffer "str->str + 1" potentially overlaps with the destination buffer "str->str", which results in undefined behavior for "strcpy".
021e4f
zsh-5.5.1/Src/Zle/computil.c:566: remediation: Replace "strcpy(dest, src)" with "memmove(dest, src, strlen(src)+1)".
021e4f
564|                       strcpy(str->str, str->str + 2);
021e4f
565|                   else if (str->str[0] == '-' || str->str[0] == '+')
021e4f
566|->                     strcpy(str->str, str->str + 1);
021e4f
567|               }
021e4f
568|           }
021e4f
---
021e4f
 Src/Zle/computil.c | 4 ++--
021e4f
 1 file changed, 2 insertions(+), 2 deletions(-)
021e4f
021e4f
diff --git a/Src/Zle/computil.c b/Src/Zle/computil.c
021e4f
index 5526e0a..cb1c010 100644
021e4f
--- a/Src/Zle/computil.c
021e4f
+++ b/Src/Zle/computil.c
021e4f
@@ -561,9 +561,9 @@ cd_init(char *nam, char *hide, char *mlen, char *sep,
021e4f
                 if (str->str == str->match)
021e4f
                     str->str = ztrdup(str->str);
021e4f
                 if (hide[1] && str->str[0] == '-' && str->str[1] == '-')
021e4f
-                    strcpy(str->str, str->str + 2);
021e4f
+                    memmove(str->str, str->str + 2, strlen(str->str) - 1);
021e4f
                 else if (str->str[0] == '-' || str->str[0] == '+')
021e4f
-                    strcpy(str->str, str->str + 1);
021e4f
+                    memmove(str->str, str->str + 1, strlen(str->str));
021e4f
             }
021e4f
         }
021e4f
 	for (ap = args; *args &&
021e4f
-- 
021e4f
2.17.2
021e4f
021e4f
021e4f
From 29445bdf10714bd41d2124d3c31cc16c1f682854 Mon Sep 17 00:00:00 2001
021e4f
From: Kamil Dudka <kdudka@redhat.com>
021e4f
Date: Wed, 7 Nov 2018 14:04:54 +0100
021e4f
Subject: [PATCH 3/5] 43723: file descriptor could leak on fork error
021e4f
021e4f
Upstream-commit: d1095bdf744c190c7e8ff126ba02caea8f63880d
021e4f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
021e4f
021e4f
Error: RESOURCE_LEAK (CWE-772):
021e4f
zsh-5.5.1/Src/exec.c:4680: open_fn: Returning handle opened by "open".
021e4f
zsh-5.5.1/Src/exec.c:4680: var_assign: Assigning: "fd" = handle returned from "open(nam, 449, 384)".
021e4f
zsh-5.5.1/Src/exec.c:4810: leaked_handle: Handle variable "fd" going out of scope leaks the handle.
021e4f
4808|   	/* fork or open error */
021e4f
4809|   	child_unblock();
021e4f
4810|-> 	return nam;
021e4f
4811|       } else if (pid) {
021e4f
4812|   	int os;
021e4f
---
021e4f
 Src/exec.c | 3 ++-
021e4f
 1 file changed, 2 insertions(+), 1 deletion(-)
021e4f
021e4f
diff --git a/Src/exec.c b/Src/exec.c
021e4f
index 0908a1a..8045db2 100644
021e4f
--- a/Src/exec.c
021e4f
+++ b/Src/exec.c
021e4f
@@ -4722,7 +4722,8 @@ getoutputfile(char *cmd, char **eptr)
021e4f
     }
021e4f
 
021e4f
     if ((cmdoutpid = pid = zfork(NULL)) == -1) {
021e4f
-	/* fork or open error */
021e4f
+	/* fork error */
021e4f
+	close(fd);
021e4f
 	child_unblock();
021e4f
 	return nam;
021e4f
     } else if (pid) {
021e4f
-- 
021e4f
2.17.2
021e4f
021e4f
021e4f
From afb4192a75066f86ce7051a72c0feb7b80c0cdd8 Mon Sep 17 00:00:00 2001
021e4f
From: Kamil Dudka <kdudka@redhat.com>
021e4f
Date: Wed, 7 Nov 2018 14:04:55 +0100
021e4f
Subject: [PATCH 4/5] 43789: possible use after free clearing up math func from
021e4f
 module
021e4f
021e4f
Upstream-commit: e27175c7c8cdfeb4e28d4ff21eb51aa003d70a03
021e4f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
021e4f
021e4f
Error: USE_AFTER_FREE (CWE-825):
021e4f
zsh-5.5.1/Src/module.c:1390: freed_arg: "deletemathfunc" frees "f".
021e4f
zsh-5.5.1/Src/module.c:1352:6: freed_arg: "zfree" frees parameter "f".
021e4f
zsh-5.5.1/Src/mem.c:1888:5: freed_arg: "free" frees parameter "p".
021e4f
zsh-5.5.1/Src/module.c:1394: deref_after_free: Dereferencing freed pointer "f".
021e4f
1392|   		ret = 1;
021e4f
1393|   	    } else {
021e4f
1394|-> 		f->flags &= ~MFF_ADDED;
021e4f
1395|   	    }
021e4f
1396|   	}
021e4f
---
021e4f
 Src/module.c | 2 --
021e4f
 1 file changed, 2 deletions(-)
021e4f
021e4f
diff --git a/Src/module.c b/Src/module.c
021e4f
index 4ae7831..33d75eb 100644
021e4f
--- a/Src/module.c
021e4f
+++ b/Src/module.c
021e4f
@@ -1390,8 +1390,6 @@ setmathfuncs(char const *nam, MathFunc f, int size, int *e)
021e4f
 	    if (deletemathfunc(f)) {
021e4f
 		zwarnnam(nam, "math function `%s' already deleted", f->name);
021e4f
 		ret = 1;
021e4f
-	    } else {
021e4f
-		f->flags &= ~MFF_ADDED;
021e4f
 	    }
021e4f
 	}
021e4f
 	f++;
021e4f
-- 
021e4f
2.17.2
021e4f
021e4f
021e4f
From 4553645c00d9a2e81a79e2014b106f6590500287 Mon Sep 17 00:00:00 2001
021e4f
From: Kamil Dudka <kdudka@redhat.com>
021e4f
Date: Wed, 7 Nov 2018 14:04:56 +0100
021e4f
Subject: [PATCH 5/5] 43790: failed mailstat could leak memory
021e4f
021e4f
Upstream-commit: d50e204b0c4c10164a711bf640500e46987de9c3
021e4f
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
021e4f
021e4f
Error: RESOURCE_LEAK (CWE-772):
021e4f
zsh-5.5.1/Src/utils.c:7406: alloc_fn: Storage is returned from allocation function "appstr".
021e4f
zsh-5.5.1/Src/string.c:200:5: alloc_fn: Storage is returned from allocation function "realloc".
021e4f
zsh-5.5.1/Src/string.c:200:5: identity_transfer: Passing "realloc(base, strlen(base) + strlen(append) + 1UL)" as argument 1 to function "strcat", which returns that argument.
021e4f
zsh-5.5.1/Src/string.c:200:5: return_alloc_fn: Directly returning storage allocated by "strcat".
021e4f
zsh-5.5.1/Src/utils.c:7406: var_assign: Assigning: "dir" = storage returned from "appstr(ztrdup(path), "/cur")".
021e4f
zsh-5.5.1/Src/utils.c:7407: noescape: Resource "dir" is not freed or pointed-to in "stat".
021e4f
zsh-5.5.1/Src/utils.c:7407: leaked_storage: Variable "dir" going out of scope leaks the storage it points to.
021e4f
7405|          /* See if cur/ is present */
021e4f
7406|          dir = appstr(ztrdup(path), "/cur");
021e4f
7407|->        if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
7408|          st_ret.st_atime = st_tmp.st_atime;
021e4f
7409|
021e4f
021e4f
Error: RESOURCE_LEAK (CWE-772):
021e4f
zsh-5.5.1/Src/utils.c:7412: alloc_fn: Storage is returned from allocation function "appstr".
021e4f
zsh-5.5.1/Src/string.c:200:5: alloc_fn: Storage is returned from allocation function "realloc".
021e4f
zsh-5.5.1/Src/string.c:200:5: identity_transfer: Passing "realloc(base, strlen(base) + strlen(append) + 1UL)" as argument 1 to function "strcat", which returns that argument.
021e4f
zsh-5.5.1/Src/string.c:200:5: return_alloc_fn: Directly returning storage allocated by "strcat".
021e4f
zsh-5.5.1/Src/utils.c:7412: var_assign: Assigning: "dir" = storage returned from "appstr(dir, "/tmp")".
021e4f
zsh-5.5.1/Src/utils.c:7413: noescape: Resource "dir" is not freed or pointed-to in "stat".
021e4f
zsh-5.5.1/Src/utils.c:7413: leaked_storage: Variable "dir" going out of scope leaks the storage it points to.
021e4f
7411|          dir[plen] = 0;
021e4f
7412|          dir = appstr(dir, "/tmp");
021e4f
7413|->        if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
7414|          st_ret.st_mtime = st_tmp.st_mtime;
021e4f
7415|
021e4f
021e4f
Error: RESOURCE_LEAK (CWE-772):
021e4f
zsh-5.5.1/Src/utils.c:7418: alloc_fn: Storage is returned from allocation function "appstr".
021e4f
zsh-5.5.1/Src/string.c:200:5: alloc_fn: Storage is returned from allocation function "realloc".
021e4f
zsh-5.5.1/Src/string.c:200:5: identity_transfer: Passing "realloc(base, strlen(base) + strlen(append) + 1UL)" as argument 1 to function "strcat", which returns that argument.
021e4f
zsh-5.5.1/Src/string.c:200:5: return_alloc_fn: Directly returning storage allocated by "strcat".
021e4f
zsh-5.5.1/Src/utils.c:7418: var_assign: Assigning: "dir" = storage returned from "appstr(dir, "/new")".
021e4f
zsh-5.5.1/Src/utils.c:7419: noescape: Resource "dir" is not freed or pointed-to in "stat".
021e4f
zsh-5.5.1/Src/utils.c:7419: leaked_storage: Variable "dir" going out of scope leaks the storage it points to.
021e4f
7417|          dir[plen] = 0;
021e4f
7418|          dir = appstr(dir, "/new");
021e4f
7419|->        if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
7420|          st_ret.st_mtime = st_tmp.st_mtime;
021e4f
7421|
021e4f
---
021e4f
 Src/utils.c | 16 +++++++++++++---
021e4f
 1 file changed, 13 insertions(+), 3 deletions(-)
021e4f
021e4f
diff --git a/Src/utils.c b/Src/utils.c
021e4f
index b418517..492babc 100644
021e4f
--- a/Src/utils.c
021e4f
+++ b/Src/utils.c
021e4f
@@ -7404,19 +7404,28 @@ mailstat(char *path, struct stat *st)
021e4f
 
021e4f
        /* See if cur/ is present */
021e4f
        dir = appstr(ztrdup(path), "/cur");
021e4f
-       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
+       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) {
021e4f
+	   zsfree(dir);
021e4f
+	   return 0;
021e4f
+       }
021e4f
        st_ret.st_atime = st_tmp.st_atime;
021e4f
 
021e4f
        /* See if tmp/ is present */
021e4f
        dir[plen] = 0;
021e4f
        dir = appstr(dir, "/tmp");
021e4f
-       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
+       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) {
021e4f
+	   zsfree(dir);
021e4f
+	   return 0;
021e4f
+       }
021e4f
        st_ret.st_mtime = st_tmp.st_mtime;
021e4f
 
021e4f
        /* And new/ */
021e4f
        dir[plen] = 0;
021e4f
        dir = appstr(dir, "/new");
021e4f
-       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) return 0;
021e4f
+       if (stat(dir, &st_tmp) || !S_ISDIR(st_tmp.st_mode)) {
021e4f
+	   zsfree(dir);
021e4f
+	   return 0;
021e4f
+       }
021e4f
        st_ret.st_mtime = st_tmp.st_mtime;
021e4f
 
021e4f
 #if THERE_IS_EXACTLY_ONE_MAILDIR_IN_MAILPATH
021e4f
@@ -7428,6 +7437,7 @@ mailstat(char *path, struct stat *st)
021e4f
            st_tmp.st_atime == st_new_last.st_atime &&
021e4f
            st_tmp.st_mtime == st_new_last.st_mtime) {
021e4f
 	   *st = st_ret_last;
021e4f
+	   zsfree(dir);
021e4f
 	   return 0;
021e4f
        }
021e4f
        st_new_last = st_tmp;
021e4f
-- 
021e4f
2.17.2
021e4f