From 9c088b29dcdb8a3e013120d8272a6e0314a8f3df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 3 Sep 2021 19:29:23 +0200 Subject: [PATCH 11/15] Fix coverity detected issue in radv.c Error: NULL_RETURNS (CWE-476): [#def114] dnsmasq-2.86test7/src/radv.c:748: returned_null: "expand" returns "NULL" (checked 10 out of 11 times). dnsmasq-2.86test7/src/radv.c:748: var_assigned: Assigning: "p" = "NULL" return value from "expand". dnsmasq-2.86test7/src/radv.c:749: dereference: Dereferencing a pointer that might be "NULL" "p" when calling "memset". [Note: The source code implementation of the function has been overridden by a builtin model.] dnsmasq-2.86test7/src/outpacket.c:83: example_checked: Example 1: "expand(len)" has its value checked in "p = expand(len)". dnsmasq-2.86test7/src/outpacket.c:109: example_checked: Example 2: "expand(1UL)" has its value checked in "p = expand(1UL)". dnsmasq-2.86test7/src/radv.c:269: example_checked: Example 3: "expand(16UL)" has its value checked in "ra = expand(16UL)". dnsmasq-2.86test7/src/radv.c:363: example_checked: Example 4: "expand(32UL)" has its value checked in "opt = expand(32UL)". dnsmasq-2.86test7/src/radv.c:708: example_checked: Example 5: "expand(32UL)" has its value checked in "opt = expand(32UL)". # 747| int len = (maclen + 9) >> 3; # 748| unsigned char *p = expand(len << 3); # 749|-> memset(p, 0, len << 3); # 750| *p++ = ICMP6_OPT_SOURCE_MAC; # 751| *p++ = len; Error: NULL_RETURNS (CWE-476): [#def115] dnsmasq-2.86test7/src/radv.c:748: returned_null: "expand" returns "NULL" (checked 10 out of 11 times). dnsmasq-2.86test7/src/radv.c:748: var_assigned: Assigning: "p" = "NULL" return value from "expand". dnsmasq-2.86test7/src/radv.c:750: dereference: Incrementing a pointer which might be null: "p". dnsmasq-2.86test7/src/outpacket.c:83: example_checked: Example 1: "expand(len)" has its value checked in "p = expand(len)". dnsmasq-2.86test7/src/outpacket.c:109: example_checked: Example 2: "expand(1UL)" has its value checked in "p = expand(1UL)". dnsmasq-2.86test7/src/radv.c:269: example_checked: Example 3: "expand(16UL)" has its value checked in "ra = expand(16UL)". dnsmasq-2.86test7/src/radv.c:363: example_checked: Example 4: "expand(32UL)" has its value checked in "opt = expand(32UL)". dnsmasq-2.86test7/src/radv.c:708: example_checked: Example 5: "expand(32UL)" has its value checked in "opt = expand(32UL)". # 748| unsigned char *p = expand(len << 3); # 749| memset(p, 0, len << 3); # 750|-> *p++ = ICMP6_OPT_SOURCE_MAC; # 751| *p++ = len; # 752| memcpy(p, mac, maclen); --- src/radv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/radv.c b/src/radv.c index 3255904..6d6fa32 100644 --- a/src/radv.c +++ b/src/radv.c @@ -746,6 +746,8 @@ static int add_lla(int index, unsigned int type, char *mac, size_t maclen, void add 7 to round up */ int len = (maclen + 9) >> 3; unsigned char *p = expand(len << 3); + if (!p) + return 1; memset(p, 0, len << 3); *p++ = ICMP6_OPT_SOURCE_MAC; *p++ = len; -- 2.31.1