Projects
Factory:RISC-V:Base
openssh
_service:tar_scm:openssh-6.7p1-coverity.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:openssh-6.7p1-coverity.patch of Package openssh
Reference:https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-6.7p1-coverity.patch --- auth-krb5.c | 2 ++ auth-options.c | 1 + channels.c | 6 ++++-- dns.c | 1 + gss-genr.c | 3 ++- kexgssc.c | 4 +++- krl.c | 4 ++++ loginrec.c | 4 ++++ misc.c | 3 +++ moduli.c | 1 + monitor.c | 4 ++-- monitor_wrap.c | 6 +++--- openbsd-compat/bindresvport.c | 2 +- openbsd-compat/bsd-pselect.c | 8 ++++---- readconf.c | 1 + scp.c | 4 ++-- servconf.c | 5 +++-- serverloop.c | 2 +- session.c | 2 ++ sftp.c | 3 ++- ssh-agent.c | 5 +++-- ssh-keygen.c | 7 +++++++ ssh.c | 1 + sshd.c | 9 +++++++-- sshsig.c | 1 + 25 files changed, 65 insertions(+), 24 deletions(-) diff --git a/auth-krb5.c b/auth-krb5.c index d80c3ab..71ea1e3 100644 --- a/auth-krb5.c +++ b/auth-krb5.c @@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm umask(old_umask); if (tmpfd == -1) { logit("mkstemp(): %.100s", strerror(oerrno)); + free(ccname); return oerrno; } @@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx, krb5_ccache *ccache, int *need_environm oerrno = errno; logit("fchmod(): %.100s", strerror(oerrno)); close(tmpfd); + free(ccname); return oerrno; } /* make sure the KRB5CCNAME is set for non-standard location */ diff --git a/auth-options.c b/auth-options.c index 7cb2a64..a4b1db4 100644 --- a/auth-options.c +++ b/auth-options.c @@ -723,6 +723,7 @@ serialise_array(struct sshbuf *m, char **a, size_t n) return r; } /* success */ + sshbuf_free(b); return 0; } diff --git a/channels.c b/channels.c index 300c753..ea4d8da 100644 --- a/channels.c +++ b/channels.c @@ -4081,7 +4081,7 @@ int channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd) { int r, success = 0, idx = -1; - char *host_to_connect, *listen_host, *listen_path; + char *host_to_connect = NULL, *listen_host = NULL, *listen_path = NULL; int port_to_connect, listen_port; /* Send the forward request to the remote side. */ @@ -4109,7 +4109,6 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd) success = 1; if (success) { /* Record that connection to this host/port is permitted. */ - host_to_connect = listen_host = listen_path = NULL; port_to_connect = listen_port = 0; if (fwd->connect_path != NULL) { host_to_connect = xstrdup(fwd->connect_path); @@ -4130,6 +4129,9 @@ channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd) host_to_connect, port_to_connect, listen_host, listen_path, listen_port, NULL); } + free(host_to_connect); + free(listen_host); + free(listen_path); return idx; } diff --git a/dns.c b/dns.c index f2310be..15218f1 100644 --- a/dns.c +++ b/dns.c @@ -259,6 +259,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address, &hostkey_digest, &hostkey_digest_len, hostkey)) { error("Error calculating key fingerprint."); freerrset(fingerprints); + free(dnskey_digest); return -1; } diff --git a/gss-genr.c b/gss-genr.c index 9f9745b..810b382 100644 --- a/gss-genr.c +++ b/gss-genr.c @@ -168,8 +168,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check, enclen = __b64_ntop(digest, ssh_digest_bytes(SSH_DIGEST_MD5), encoded, ssh_digest_bytes(SSH_DIGEST_MD5) * 2); - +#pragma GCC diagnostic ignored "-Wstringop-overflow" cp = strncpy(s, kex, strlen(kex)); +#pragma pop for ((p = strsep(&cp, ",")); p && *p != '\0'; (p = strsep(&cp, ","))) { if (sshbuf_len(buf) != 0 && diff --git a/kexgssc.c b/kexgssc.c index 1c62740..080cf04 100644 --- a/kexgssc.c +++ b/kexgssc.c @@ -98,8 +98,10 @@ kexgss_client(struct ssh *ssh) default: fatal_f("Unexpected KEX type %d", kex->kex_type); } - if (r != 0) + if (r != 0) { + ssh_gssapi_delete_ctx(&ctxt); return r; + } token_ptr = GSS_C_NO_BUFFER; diff --git a/krl.c b/krl.c index 473a9d7..ae19762 100644 --- a/krl.c +++ b/krl.c @@ -1209,6 +1209,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp, sshkey_free(key); sshbuf_free(copy); sshbuf_free(sect); + /* coverity[leaked_storage : FALSE] */ return r; } @@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key) return r; erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb); free(rb.blob); + rb.blob = NULL; /* make coverity happy */ if (erb != NULL) { KRL_DBG(("revoked by key SHA1")); return SSH_ERR_KEY_REVOKED; @@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key) return r; erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb); free(rb.blob); + rb.blob = NULL; /* make coverity happy */ if (erb != NULL) { KRL_DBG(("revoked by key SHA256")); return SSH_ERR_KEY_REVOKED; @@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, const struct sshkey *key) return r; erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb); free(rb.blob); + rb.blob = NULL; /* make coverity happy */ if (erb != NULL) { KRL_DBG(("revoked by explicit key")); return SSH_ERR_KEY_REVOKED; diff --git a/loginrec.c b/loginrec.c index 4f21499..e0606be 100644 --- a/loginrec.c +++ b/loginrec.c @@ -691,9 +691,11 @@ construct_utmp(struct logininfo *li, */ /* Use strncpy because we don't necessarily want null termination */ + /* coverity[buffer_size_warning : FALSE] */ strncpy(ut->ut_name, li->username, MIN_SIZEOF(ut->ut_name, li->username)); # ifdef HAVE_HOST_IN_UTMP + /* coverity[buffer_size_warning : FALSE] */ strncpy(ut->ut_host, li->hostname, MIN_SIZEOF(ut->ut_host, li->hostname)); # endif @@ -1691,6 +1693,7 @@ record_failed_login(struct ssh *ssh, const char *username, const char *hostname, memset(&ut, 0, sizeof(ut)); /* strncpy because we don't necessarily want nul termination */ + /* coverity[buffer_size_warning : FALSE] */ strncpy(ut.ut_user, username, sizeof(ut.ut_user)); strlcpy(ut.ut_line, "ssh:notty", sizeof(ut.ut_line)); @@ -1700,6 +1703,7 @@ record_failed_login(struct ssh *ssh, const char *username, const char *hostname, ut.ut_pid = getpid(); /* strncpy because we don't necessarily want nul termination */ + /* coverity[buffer_size_warning : FALSE] */ strncpy(ut.ut_host, hostname, sizeof(ut.ut_host)); if (ssh_packet_connection_is_on_socket(ssh) && diff --git a/misc.c b/misc.c index e4d3120..5420e24 100644 --- a/misc.c +++ b/misc.c @@ -1492,6 +1492,8 @@ sanitise_stdfd(void) } if (nullfd > STDERR_FILENO) close(nullfd); + /* coverity[leaked_handle : FALSE]*/ + /* coverity[leaked_handle : FALSE]*/ } char * @@ -2625,6 +2627,7 @@ stdfd_devnull(int do_stdin, int do_stdout, int do_stderr) } if (devnull > STDERR_FILENO) close(devnull); + /* coverity[leaked_handle : FALSE]*/ return ret; } diff --git a/moduli.c b/moduli.c index 9f660ef..2669edd 100644 --- a/moduli.c +++ b/moduli.c @@ -476,6 +476,7 @@ write_checkpoint(char *cpfile, u_int32_t lineno) else logit("failed to write to checkpoint file '%s': %s", cpfile, strerror(errno)); + /* coverity[leaked_storage : FALSE] */ } static unsigned long diff --git a/monitor.c b/monitor.c index fc05db6..dca2fe7 100644 --- a/monitor.c +++ b/monitor.c @@ -397,7 +397,7 @@ monitor_child_preauth(struct ssh *ssh, struct monitor *pmonitor) mm_get_keystate(ssh, pmonitor); /* Drain any buffered messages from the child */ - while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0) + while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0) ; if (pmonitor->m_recvfd >= 0) @@ -1684,7 +1684,7 @@ mm_answer_pty(struct ssh *ssh, int sock, struct sshbuf *m) s->ptymaster = s->ptyfd; debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd); - + /* coverity[leaked_handle : FALSE] */ return (0); error: diff --git a/monitor_wrap.c b/monitor_wrap.c index e125eca..c394d68 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c @@ -612,10 +612,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen) if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || (tmp2 = dup(pmonitor->m_recvfd)) == -1) { error_f("cannot allocate fds for pty"); - if (tmp1 > 0) + if (tmp1 >= 0) close(tmp1); - if (tmp2 > 0) - close(tmp2); + /*DEAD CODE if (tmp2 >= 0) + close(tmp2);*/ return 0; } close(tmp1); diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c index 346c7fe..f42792f 100644 --- a/openbsd-compat/bindresvport.c +++ b/openbsd-compat/bindresvport.c @@ -59,7 +59,7 @@ bindresvport_sa(int sd, struct sockaddr *sa) struct sockaddr_in6 *in6; u_int16_t *portp; u_int16_t port; - socklen_t salen; + socklen_t salen = sizeof(struct sockaddr_storage); int i; if (sa == NULL) { diff --git a/openbsd-compat/bsd-pselect.c b/openbsd-compat/bsd-pselect.c index b363208..cf7157c 100644 --- a/openbsd-compat/bsd-pselect.c +++ b/openbsd-compat/bsd-pselect.c @@ -113,13 +113,13 @@ pselect_notify_setup(void) static void pselect_notify_parent(void) { - if (notify_pipe[1] != -1) + if (notify_pipe[1] >= 0) (void)write(notify_pipe[1], "", 1); } static void pselect_notify_prepare(fd_set *readset) { - if (notify_pipe[0] != -1) + if (notify_pipe[0] >= 0) FD_SET(notify_pipe[0], readset); } static void @@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset) { char c; - if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) { - while (read(notify_pipe[0], &c, 1) != -1) + if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) { + while (read(notify_pipe[0], &c, 1) >= 0) debug2_f("reading"); FD_CLR(notify_pipe[0], readset); } diff --git a/readconf.c b/readconf.c index 1e1b78d..b6c998e 100644 --- a/readconf.c +++ b/readconf.c @@ -1933,6 +1933,7 @@ parse_pubkey_algos: } else if (r != 0) { error("%.200s line %d: glob failed for %s.", filename, linenum, arg2); + free(arg2); goto out; } free(arg2); diff --git a/scp.c b/scp.c index 6146260..74f5b10 100644 --- a/scp.c +++ b/scp.c @@ -187,11 +187,11 @@ killchild(int signo) { if (do_cmd_pid > 1) { kill(do_cmd_pid, signo ? signo : SIGTERM); - waitpid(do_cmd_pid, NULL, 0); + (void) waitpid(do_cmd_pid, NULL, 0); } if (do_cmd_pid2 > 1) { kill(do_cmd_pid2, signo ? signo : SIGTERM); - waitpid(do_cmd_pid2, NULL, 0); + (void) waitpid(do_cmd_pid2, NULL, 0); } if (signo) diff --git a/servconf.c b/servconf.c index 8b9540d..d72fb62 100644 --- a/servconf.c +++ b/servconf.c @@ -2081,8 +2081,9 @@ process_server_config_line_depth(ServerOptions *options, char *line, if (*activep && *charptr == NULL) { *charptr = tilde_expand_filename(arg, getuid()); /* increase optional counter */ - if (intptr != NULL) - *intptr = *intptr + 1; + /* DEAD CODE intptr is still NULL ;) + if (intptr != NULL) + *intptr = *intptr + 1; */ } break; diff --git a/serverloop.c b/serverloop.c index b4c0d82..62c7e90 100644 --- a/serverloop.c +++ b/serverloop.c @@ -546,7 +546,7 @@ server_request_tun(struct ssh *ssh) debug_f("invalid tun"); goto done; } - if (auth_opts->force_tun_device != -1) { + if (auth_opts->force_tun_device >= 0) { if (tun != SSH_TUNID_ANY && auth_opts->force_tun_device != (int)tun) goto done; diff --git a/session.c b/session.c index 58cf557..cdb301b 100644 --- a/session.c +++ b/session.c @@ -1222,12 +1222,14 @@ do_setup_env(struct ssh *ssh, Session *s, const char *shell) /* Environment specified by admin */ for (i = 0; i < options.num_setenv; i++) { cp = xstrdup(options.setenv[i]); + /* coverity[overwrite_var : FALSE] */ if ((value = strchr(cp, '=')) == NULL) { /* shouldn't happen; vars are checked in servconf.c */ fatal("Invalid config SetEnv: %s", options.setenv[i]); } *value++ = '\0'; child_set_env(&env, &envsize, cp, value); + free(cp); } /* SSH_CLIENT deprecated */ diff --git a/sftp.c b/sftp.c index c3c347e..c18a354 100644 --- a/sftp.c +++ b/sftp.c @@ -226,7 +226,7 @@ killchild(int signo) pid = sshpid; if (pid > 1) { kill(pid, SIGTERM); - waitpid(pid, NULL, 0); + (void) waitpid(pid, NULL, 0); } _exit(1); @@ -1029,6 +1029,7 @@ do_globbed_ls(struct sftp_conn *conn, const char *path, if (lflag & LS_LONG_VIEW) { if (g.gl_statv[i] == NULL) { error("no stat information for %s", fname); + free(fname); continue; } lname = ls_file(fname, g.gl_statv[i], 1, diff --git a/ssh-agent.c b/ssh-agent.c index 50d0638..a292a9e 100644 --- a/ssh-agent.c +++ b/ssh-agent.c @@ -1391,6 +1391,7 @@ sanitize_pkcs11_provider(const char *provider) if (pkcs11_uri_parse(provider, uri) != 0) { error("Failed to parse PKCS#11 URI"); + pkcs11_uri_cleanup(uri); return NULL; } /* validate also provider from URI */ @@ -2080,8 +2081,8 @@ main(int ac, char **av) sanitise_stdfd(); /* drop */ - setegid(getgid()); - setgid(getgid()); + (void) setegid(getgid()); + (void) setgid(getgid()); platform_disable_tracing(0); /* strict=no */ diff --git a/ssh-keygen.c b/ssh-keygen.c index 6ae72ab..076dd33 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -2365,6 +2365,9 @@ update_krl_from_file(struct passwd *pw, const char *file, int wild_ca, r = ssh_krl_revoke_key_sha256(krl, blob, blen); if (r != 0) fatal_fr(r, "revoke key failed"); + freezero(blob, blen); + blob = NULL; + blen = 0; } else { if (strncasecmp(cp, "key:", 4) == 0) { cp += 4; @@ -3023,6 +3026,7 @@ do_moduli_screen(const char *out_file, char **opts, size_t nopts) } else if (strncmp(opts[i], "start-line=", 11) == 0) { start_lineno = strtoul(opts[i]+11, NULL, 10); } else if (strncmp(opts[i], "checkpoint=", 11) == 0) { + free(checkpoint); checkpoint = xstrdup(opts[i]+11); } else if (strncmp(opts[i], "generator=", 10) == 0) { generator_wanted = (u_int32_t)strtonum( @@ -3064,6 +3068,9 @@ do_moduli_screen(const char *out_file, char **opts, size_t nopts) #else /* WITH_OPENSSL */ fatal("Moduli screening is not supported"); #endif /* WITH_OPENSSL */ + free(checkpoint); + if (in != stdin) + fclose(in); } /* Read and confirm a passphrase */ diff --git a/ssh.c b/ssh.c index a5155f4..68558d4 100644 --- a/ssh.c +++ b/ssh.c @@ -1755,6 +1755,7 @@ control_persist_detach(void) close(muxserver_sock); muxserver_sock = -1; options.control_master = SSHCTL_MASTER_NO; + /* coverity[leaked_handle: FALSE]*/ muxclient(options.control_path); /* muxclient() doesn't return on success. */ fatal("Failed to connect to new control master"); diff --git a/sshd.c b/sshd.c index e05dd82..a4a1b79 100644 --- a/sshd.c +++ b/sshd.c @@ -595,8 +595,10 @@ privsep_preauth(struct ssh *ssh) privsep_preauth_child(ssh); setproctitle("%s", "[net]"); - if (box != NULL) + if (box != NULL) { ssh_sandbox_child(box); + free(box); + } return 0; } @@ -2560,8 +2562,11 @@ do_ssh2_kex(struct ssh *ssh) if (newstr) myproposal[PROPOSAL_KEX_ALGS] = newstr; - else + else { fatal("No supported key exchange algorithms"); + free(gss); + } + /* coverity[leaked_storage: FALSE]*/ } #endif diff --git a/sshsig.c b/sshsig.c index eb2a931..3e91c14 100644 --- a/sshsig.c +++ b/sshsig.c @@ -551,6 +551,7 @@ hash_file(int fd, const char *hashalg, struct sshbuf **bp) oerrno = errno; sshbuf_free(b); ssh_digest_free(ctx); + ctx = NULL; explicit_bzero(hash, sizeof(hash)); errno = oerrno; return r; -- 2.27.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2