410 lines
13 KiB
Diff
410 lines
13 KiB
Diff
diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
|
|
--- openssh-8.5p1/auth-krb5.c.coverity 2021-03-24 12:03:33.724967756 +0100
|
|
+++ openssh-8.5p1/auth-krb5.c 2021-03-24 12:03:33.782968159 +0100
|
|
@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
|
|
umask(old_umask);
|
|
if (tmpfd == -1) {
|
|
logit("mkstemp(): %.100s", strerror(oerrno));
|
|
+ free(ccname);
|
|
return oerrno;
|
|
}
|
|
|
|
@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
|
|
oerrno = errno;
|
|
logit("fchmod(): %.100s", strerror(oerrno));
|
|
close(tmpfd);
|
|
+ free(ccname);
|
|
return oerrno;
|
|
}
|
|
/* make sure the KRB5CCNAME is set for non-standard location */
|
|
diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
|
|
--- openssh-8.5p1/gss-genr.c.coverity 2021-03-26 11:52:46.613942552 +0100
|
|
+++ openssh-8.5p1/gss-genr.c 2021-03-26 11:54:37.881726318 +0100
|
|
@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
|
|
enclen = __b64_ntop(digest,
|
|
ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
|
|
ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
|
|
-
|
|
+#pragma GCC diagnostic ignored "-Wstringop-overflow"
|
|
cp = strncpy(s, kex, strlen(kex));
|
|
+#pragma GCC diagnostic pop
|
|
for ((p = strsep(&cp, ",")); p && *p != '\0';
|
|
(p = strsep(&cp, ","))) {
|
|
if (sshbuf_len(buf) != 0 &&
|
|
diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
|
|
--- openssh-8.5p1/krl.c.coverity 2021-03-02 11:31:47.000000000 +0100
|
|
+++ openssh-8.5p1/krl.c 2021-03-24 12:03:33.783968166 +0100
|
|
@@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
|
return r;
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
|
|
free(rb.blob);
|
|
+ rb.blob = NULL; /* make coverity happy */
|
|
if (erb != NULL) {
|
|
KRL_DBG(("revoked by key SHA1"));
|
|
return SSH_ERR_KEY_REVOKED;
|
|
@@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
|
return r;
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
|
|
free(rb.blob);
|
|
+ rb.blob = NULL; /* make coverity happy */
|
|
if (erb != NULL) {
|
|
KRL_DBG(("revoked by key SHA256"));
|
|
return SSH_ERR_KEY_REVOKED;
|
|
@@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
|
return r;
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
|
|
free(rb.blob);
|
|
+ rb.blob = NULL; /* make coverity happy */
|
|
if (erb != NULL) {
|
|
KRL_DBG(("revoked by explicit key"));
|
|
return SSH_ERR_KEY_REVOKED;
|
|
diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
|
|
--- openssh-8.5p1/loginrec.c.coverity 2021-03-24 13:18:53.793225885 +0100
|
|
+++ openssh-8.5p1/loginrec.c 2021-03-24 13:21:27.948404751 +0100
|
|
@@ -690,9 +690,11 @@ construct_utmp(struct logininfo *li,
|
|
*/
|
|
|
|
/* Use strncpy because we don't necessarily want null termination */
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
|
strncpy(ut->ut_name, li->username,
|
|
MIN_SIZEOF(ut->ut_name, li->username));
|
|
# ifdef HAVE_HOST_IN_UTMP
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
|
strncpy(ut->ut_host, li->hostname,
|
|
MIN_SIZEOF(ut->ut_host, li->hostname));
|
|
# endif
|
|
diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
|
|
--- openssh-8.5p1/misc.c.coverity 2021-03-24 12:03:33.745967902 +0100
|
|
+++ openssh-8.5p1/misc.c 2021-03-24 13:31:47.037079617 +0100
|
|
@@ -1425,6 +1425,8 @@ sanitise_stdfd(void)
|
|
}
|
|
if (nullfd > STDERR_FILENO)
|
|
close(nullfd);
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
|
}
|
|
|
|
char *
|
|
@@ -2511,6 +2513,7 @@ stdfd_devnull(int do_stdin, int do_stdou
|
|
}
|
|
if (devnull > STDERR_FILENO)
|
|
close(devnull);
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
|
return ret;
|
|
}
|
|
|
|
diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
|
|
--- openssh-7.4p1/monitor.c.coverity 2016-12-23 16:40:26.888788688 +0100
|
|
+++ openssh-7.4p1/monitor.c 2016-12-23 16:40:26.900788691 +0100
|
|
@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
|
|
mm_get_keystate(ssh, pmonitor);
|
|
|
|
/* Drain any buffered messages from the child */
|
|
- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
|
|
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
|
|
;
|
|
|
|
if (pmonitor->m_recvfd >= 0)
|
|
@@ -1678,7 +1678,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
|
|
s->ptymaster = s->ptyfd;
|
|
|
|
debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
|
|
-
|
|
+ /* coverity[leaked_handle : FALSE] */
|
|
return (0);
|
|
|
|
error:
|
|
diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
|
|
--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity 2016-12-19 05:59:41.000000000 +0100
|
|
+++ openssh-7.4p1/openbsd-compat/bindresvport.c 2016-12-23 16:40:26.901788691 +0100
|
|
@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
|
|
struct sockaddr_in6 *in6;
|
|
u_int16_t *portp;
|
|
u_int16_t port;
|
|
- socklen_t salen;
|
|
+ socklen_t salen = sizeof(struct sockaddr_storage);
|
|
int i;
|
|
|
|
if (sa == NULL) {
|
|
diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openbsd-compat/bsd-pselect.c
|
|
--- openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity 2021-08-30 16:36:11.357288009 +0200
|
|
+++ openssh-8.7p1/openbsd-compat/bsd-pselect.c 2021-08-30 16:37:21.791897976 +0200
|
|
@@ -113,13 +113,13 @@ pselect_notify_setup(void)
|
|
static void
|
|
pselect_notify_parent(void)
|
|
{
|
|
- if (notify_pipe[1] != -1)
|
|
+ if (notify_pipe[1] >= 0)
|
|
(void)write(notify_pipe[1], "", 1);
|
|
}
|
|
static void
|
|
pselect_notify_prepare(fd_set *readset)
|
|
{
|
|
- if (notify_pipe[0] != -1)
|
|
+ if (notify_pipe[0] >= 0)
|
|
FD_SET(notify_pipe[0], readset);
|
|
}
|
|
static void
|
|
@@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset)
|
|
{
|
|
char c;
|
|
|
|
- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
|
|
- while (read(notify_pipe[0], &c, 1) != -1)
|
|
+ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
|
|
+ while (read(notify_pipe[0], &c, 1) >= 0)
|
|
debug2_f("reading");
|
|
FD_CLR(notify_pipe[0], readset);
|
|
}
|
|
diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
|
|
--- openssh-8.5p1/readconf.c.coverity 2021-03-24 12:03:33.778968131 +0100
|
|
+++ openssh-8.5p1/readconf.c 2021-03-24 12:03:33.785968180 +0100
|
|
@@ -749,12 +749,12 @@ match_cfg_line(Options *options, const c
|
|
debug2("checking match for '%s' host %s originally %s",
|
|
full_line, host, original_host);
|
|
while ((attrib = argv_next(acp, avp)) != NULL) {
|
|
- attrib = oattrib = xstrdup(attrib);
|
|
/* Terminate on comment */
|
|
if (*attrib == '#') {
|
|
argv_consume(acp);
|
|
break;
|
|
}
|
|
+ attrib = oattrib = xstrdup(attrib);
|
|
arg = criteria = NULL;
|
|
this_result = 1;
|
|
if ((negate = (attrib[0] == '!')))
|
|
@@ -793,7 +793,7 @@ match_cfg_line(Options *options, const c
|
|
debug3("%.200s line %d: %smatched '%s'",
|
|
filename, linenum,
|
|
this_result ? "" : "not ", oattrib);
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
|
|
/* Keep this list in sync with below */
|
|
@@ -863,7 +863,7 @@ match_cfg_line(Options *options, const c
|
|
debug3("%.200s line %d: skipped exec "
|
|
"\"%.100s\"", filename, linenum, cmd);
|
|
free(cmd);
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
r = execute_in_shell(cmd);
|
|
if (r == -1) {
|
|
@@ -887,6 +887,7 @@ match_cfg_line(Options *options, const c
|
|
criteria == NULL ? "" : " \"",
|
|
criteria == NULL ? "" : criteria,
|
|
criteria == NULL ? "" : "\"");
|
|
+next:
|
|
free(criteria);
|
|
free(oattrib);
|
|
oattrib = attrib = NULL;
|
|
@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
|
|
} else if (r != 0) {
|
|
error("%.200s line %d: glob failed for %s.",
|
|
filename, linenum, arg2);
|
|
+ free(arg2);
|
|
goto out;
|
|
}
|
|
free(arg2);
|
|
diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
|
|
--- openssh-7.4p1/servconf.c.coverity 2016-12-23 16:40:26.896788690 +0100
|
|
+++ openssh-7.4p1/servconf.c 2016-12-23 16:40:26.901788691 +0100
|
|
@@ -1120,12 +1120,12 @@ match_cfg_line(const char *full_line, in
|
|
}
|
|
|
|
while ((oattrib = argv_next(acp, avp)) != NULL) {
|
|
- attrib = xstrdup(oattrib);
|
|
/* Terminate on comment */
|
|
- if (*attrib == '#') {
|
|
+ if (*oattrib == '#') {
|
|
argv_consume(acp); /* mark all arguments consumed */
|
|
break;
|
|
}
|
|
+ attrib = xstrdup(oattrib);
|
|
arg = NULL;
|
|
attributes++;
|
|
/* Criterion "all" has no argument and must appear alone */
|
|
@@ -1147,13 +1147,13 @@ match_cfg_line(const char *full_line, in
|
|
if (strcasecmp(attrib, "invalid-user") == 0) {
|
|
if (ci == NULL) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->user_invalid == 0)
|
|
result = 0;
|
|
else
|
|
debug("matched invalid-user at line %d", line);
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
|
|
/* Keep this list in sync with below */
|
|
@@ -1179,7 +1179,7 @@ match_cfg_line(const char *full_line, in
|
|
if (strcasecmp(attrib, "user") == 0) {
|
|
if (ci == NULL || (ci->test && ci->user == NULL)) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->user == NULL)
|
|
match_test_missing_fatal("User", "user");
|
|
@@ -1191,7 +1191,7 @@ match_cfg_line(const char *full_line, in
|
|
} else if (strcasecmp(attrib, "group") == 0) {
|
|
if (ci == NULL || (ci->test && ci->user == NULL)) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->user == NULL)
|
|
match_test_missing_fatal("Group", "user");
|
|
@@ -1205,7 +1205,7 @@ match_cfg_line(const char *full_line, in
|
|
} else if (strcasecmp(attrib, "host") == 0) {
|
|
if (ci == NULL || (ci->test && ci->host == NULL)) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->host == NULL)
|
|
match_test_missing_fatal("Host", "host");
|
|
@@ -1220,7 +1220,7 @@ match_cfg_line(const char *full_line, in
|
|
fatal("Invalid Match address argument "
|
|
"'%s' at line %d", arg, line);
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->address == NULL)
|
|
match_test_missing_fatal("Address", "addr");
|
|
@@ -1244,7 +1244,7 @@ match_cfg_line(const char *full_line, in
|
|
"argument '%s' at line %d", arg,
|
|
line);
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->laddress == NULL)
|
|
match_test_missing_fatal("LocalAddress",
|
|
@@ -1272,7 +1272,7 @@ match_cfg_line(const char *full_line, in
|
|
}
|
|
if (ci == NULL || (ci->test && ci->lport == -1)) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->lport == 0)
|
|
match_test_missing_fatal("LocalPort", "lport");
|
|
@@ -1286,7 +1286,7 @@ match_cfg_line(const char *full_line, in
|
|
} else if (strcasecmp(attrib, "rdomain") == 0) {
|
|
if (ci == NULL || (ci->test && ci->rdomain == NULL)) {
|
|
result = 0;
|
|
- continue;
|
|
+ goto next;
|
|
}
|
|
if (ci->rdomain == NULL)
|
|
match_test_missing_fatal("RDomain", "rdomain");
|
|
@@ -1300,6 +1300,7 @@ match_cfg_line(const char *full_line, in
|
|
result = -1;
|
|
goto out;
|
|
}
|
|
+next:
|
|
free(attrib);
|
|
attrib = NULL;
|
|
}
|
|
@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
|
|
if (*activep && *charptr == NULL) {
|
|
*charptr = tilde_expand_filename(arg, getuid());
|
|
/* increase optional counter */
|
|
- if (intptr != NULL)
|
|
- *intptr = *intptr + 1;
|
|
+ /* DEAD CODE intptr is still NULL ;)
|
|
+ if (intptr != NULL)
|
|
+ *intptr = *intptr + 1; */
|
|
}
|
|
break;
|
|
|
|
diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
|
|
--- openssh-8.7p1/serverloop.c.coverity 2021-08-20 06:03:49.000000000 +0200
|
|
+++ openssh-8.7p1/serverloop.c 2021-08-30 16:28:22.416226981 +0200
|
|
@@ -547,7 +547,7 @@ server_request_tun(struct ssh *ssh)
|
|
debug_f("invalid tun");
|
|
goto done;
|
|
}
|
|
- if (auth_opts->force_tun_device != -1) {
|
|
+ if (auth_opts->force_tun_device >= 0) {
|
|
if (tun != SSH_TUNID_ANY &&
|
|
auth_opts->force_tun_device != (int)tun)
|
|
goto done;
|
|
diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
|
|
--- openssh-7.4p1/ssh-agent.c.coverity 2016-12-19 05:59:41.000000000 +0100
|
|
+++ openssh-7.4p1/ssh-agent.c 2016-12-23 16:40:26.903788691 +0100
|
|
@@ -869,6 +869,7 @@ sanitize_pkcs11_provider(const char *pro
|
|
|
|
if (pkcs11_uri_parse(provider, uri) != 0) {
|
|
error("Failed to parse PKCS#11 URI");
|
|
+ pkcs11_uri_cleanup(uri);
|
|
return NULL;
|
|
}
|
|
/* validate also provider from URI */
|
|
diff -up openssh-7.4p1/sshd-session.c.coverity openssh-7.4p1/sshd-session.c
|
|
--- openssh-7.4p1/sshd-session.c.coverity 2016-12-23 16:40:26.897788690 +0100
|
|
+++ openssh-7.4p1/sshd-session.c 2016-12-23 16:40:26.904788692 +0100
|
|
@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
|
|
|
|
privsep_preauth_child(ssh);
|
|
setproctitle("%s", "[net]");
|
|
- if (box != NULL)
|
|
+ if (box != NULL) {
|
|
ssh_sandbox_child(box);
|
|
+ free(box);
|
|
+ }
|
|
|
|
return 0;
|
|
}
|
|
@@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
|
|
|
|
if (newstr)
|
|
myproposal[PROPOSAL_KEX_ALGS] = newstr;
|
|
- else
|
|
+ else {
|
|
fatal("No supported key exchange algorithms");
|
|
+ free(gss);
|
|
+ }
|
|
+ /* coverity[leaked_storage: FALSE]*/
|
|
}
|
|
#endif
|
|
|
|
diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
|
|
--- openssh-8.5p1/ssh-keygen.c.coverity 2021-03-24 12:03:33.780968145 +0100
|
|
+++ openssh-8.5p1/ssh-keygen.c 2021-03-24 12:03:33.787968194 +0100
|
|
@@ -2332,6 +2332,9 @@ update_krl_from_file(struct passwd *pw,
|
|
r = ssh_krl_revoke_key_sha256(krl, blob, blen);
|
|
if (r != 0)
|
|
fatal_fr(r, "revoke key failed");
|
|
+ freezero(blob, blen);
|
|
+ blob = NULL;
|
|
+ blen = 0;
|
|
} else {
|
|
if (strncasecmp(cp, "key:", 4) == 0) {
|
|
cp += 4;
|
|
diff --color -ruNp a/sshd.c b/sshd.c
|
|
--- a/sshd.c 2026-04-01 14:29:14.186736233 +0200
|
|
+++ b/sshd.c 2026-04-01 14:36:59.136881819 +0200
|
|
@@ -1079,6 +1079,7 @@ server_accept_loop(int *sock_in, int *so
|
|
send_rexec_state(config_s[0], cfg);
|
|
close(config_s[0]);
|
|
free(pfd);
|
|
+ free(startup_pollfd);
|
|
return;
|
|
}
|
|
|
|
@@ -1111,6 +1112,7 @@ server_accept_loop(int *sock_in, int *so
|
|
log_stderr);
|
|
close(config_s[0]);
|
|
free(pfd);
|
|
+ free(startup_pollfd);
|
|
return;
|
|
}
|
|
|