55 lines
3.1 KiB
Diff
55 lines
3.1 KiB
Diff
|
From 9c088b29dcdb8a3e013120d8272a6e0314a8f3df Mon Sep 17 00:00:00 2001
|
||
|
|
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
||
|
|
Date: Fri, 3 Sep 2021 19:29:23 +0200
|
||
|
|
Subject: [PATCH 11/15] Fix coverity detected issue in radv.c
|
||
|
|
|
||
|
|
Error: NULL_RETURNS (CWE-476): [#def114]
|
||
|
|
dnsmasq-2.86test7/src/radv.c:748: returned_null: "expand" returns "NULL" (checked 10 out of 11 times).
|
||
|
|
dnsmasq-2.86test7/src/radv.c:748: var_assigned: Assigning: "p" = "NULL" return value from "expand".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:749: dereference: Dereferencing a pointer that might be "NULL" "p" when calling "memset". [Note: The source code implementation of the function has been overridden by a builtin model.]
|
||
|
|
dnsmasq-2.86test7/src/outpacket.c:83: example_checked: Example 1: "expand(len)" has its value checked in "p = expand(len)".
|
||
|
|
dnsmasq-2.86test7/src/outpacket.c:109: example_checked: Example 2: "expand(1UL)" has its value checked in "p = expand(1UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:269: example_checked: Example 3: "expand(16UL)" has its value checked in "ra = expand(16UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:363: example_checked: Example 4: "expand(32UL)" has its value checked in "opt = expand(32UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:708: example_checked: Example 5: "expand(32UL)" has its value checked in "opt = expand(32UL)".
|
||
|
|
# 747| int len = (maclen + 9) >> 3;
|
||
|
|
# 748| unsigned char *p = expand(len << 3);
|
||
|
|
# 749|-> memset(p, 0, len << 3);
|
||
|
|
# 750| *p++ = ICMP6_OPT_SOURCE_MAC;
|
||
|
|
# 751| *p++ = len;
|
||
|
|
|
||
|
|
Error: NULL_RETURNS (CWE-476): [#def115]
|
||
|
|
dnsmasq-2.86test7/src/radv.c:748: returned_null: "expand" returns "NULL" (checked 10 out of 11 times).
|
||
|
|
dnsmasq-2.86test7/src/radv.c:748: var_assigned: Assigning: "p" = "NULL" return value from "expand".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:750: dereference: Incrementing a pointer which might be null: "p".
|
||
|
|
dnsmasq-2.86test7/src/outpacket.c:83: example_checked: Example 1: "expand(len)" has its value checked in "p = expand(len)".
|
||
|
|
dnsmasq-2.86test7/src/outpacket.c:109: example_checked: Example 2: "expand(1UL)" has its value checked in "p = expand(1UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:269: example_checked: Example 3: "expand(16UL)" has its value checked in "ra = expand(16UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:363: example_checked: Example 4: "expand(32UL)" has its value checked in "opt = expand(32UL)".
|
||
|
|
dnsmasq-2.86test7/src/radv.c:708: example_checked: Example 5: "expand(32UL)" has its value checked in "opt = expand(32UL)".
|
||
|
|
# 748| unsigned char *p = expand(len << 3);
|
||
|
|
# 749| memset(p, 0, len << 3);
|
||
|
|
# 750|-> *p++ = ICMP6_OPT_SOURCE_MAC;
|
||
|
|
# 751| *p++ = len;
|
||
|
|
# 752| memcpy(p, mac, maclen);
|
||
|
|
---
|
||
|
|
src/radv.c | 2 ++
|
||
|
|
1 file changed, 2 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/src/radv.c b/src/radv.c
|
||
|
|
index 3255904..6d6fa32 100644
|
||
|
|
--- a/src/radv.c
|
||
|
|
+++ b/src/radv.c
|
||
|
|
@@ -746,6 +746,8 @@ static int add_lla(int index, unsigned int type, char *mac, size_t maclen, void
|
||
|
|
add 7 to round up */
|
||
|
|
int len = (maclen + 9) >> 3;
|
||
|
|
unsigned char *p = expand(len << 3);
|
||
|
|
+ if (!p)
|
||
|
|
+ return 1;
|
||
|
|
memset(p, 0, len << 3);
|
||
|
|
*p++ = ICMP6_OPT_SOURCE_MAC;
|
||
|
|
*p++ = len;
|
||
|
|
--
|
||
|
|
2.31.1
|
||
|
|
|