900526
From 127701d9d32e568f09c775e722286e9c0b8c72ec Mon Sep 17 00:00:00 2001
900526
From: Tomas Hozza <thozza@redhat.com>
900526
Date: Fri, 22 May 2015 16:56:25 +0200
900526
Subject: [PATCH] Fix coverity issues
900526
900526
http://cov01.lab.eng.brq.redhat.com/covscanhub/waiving/9377/
900526
Signed-off-by: Tomas Hozza <thozza@redhat.com>
900526
---
900526
 bin/named/server.c |  8 +++-----
900526
 lib/dns/dispatch.c |  5 +++--
900526
 lib/dns/dst_api.c  |  6 ++++++
900526
 lib/dns/gen.c      | 16 +++++++++++++++-
900526
 lib/dns/name.c     |  8 ++------
900526
 lib/dns/nsec3.c    |  4 ++--
900526
 lib/dns/rcode.c    |  4 +++-
900526
 lib/isc/netaddr.c  |  1 +
900526
 lib/isc/pk11.c     | 21 ++++++++++++++-------
900526
 9 files changed, 49 insertions(+), 24 deletions(-)
900526
900526
diff --git a/bin/named/server.c b/bin/named/server.c
900526
index 227c646..5e94660 100644
900526
--- a/bin/named/server.c
900526
+++ b/bin/named/server.c
900526
@@ -8018,9 +8018,11 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) {
900526
 	dns_zone_t *zone = NULL;
900526
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
900526
 	char zonename[DNS_NAME_FORMATSIZE];
900526
-	const char *vname, *sep, *msg = NULL, *arg;
900526
+	const char *vname, *sep, *arg;
900526
 	isc_boolean_t cleanup = ISC_FALSE;
900526
 
900526
+	UNUSED(text);
900526
+
900526
 	(void) next_token(&args, " \t");
900526
 
900526
 	arg = next_token(&args, " \t");
900526
@@ -8061,10 +8063,6 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t *text) {
900526
 	result = synczone(zone, &cleanup);
900526
 	isc_task_endexclusive(server->task);
900526
 
900526
-	if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text))
900526
-		isc_buffer_putmem(text, (const unsigned char *)msg,
900526
-				  strlen(msg) + 1);
900526
-
900526
 	view = dns_zone_getview(zone);
900526
 	if (strcmp(view->name, "_default") == 0 ||
900526
 	    strcmp(view->name, "_bind") == 0)
900526
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
900526
index 5063914..c93651d 100644
900526
--- a/lib/dns/dispatch.c
900526
+++ b/lib/dns/dispatch.c
900526
@@ -2278,9 +2278,10 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
900526
 
900526
 	/* Create or adjust socket pool */
900526
 	if (mgr->spool != NULL) {
900526
-		if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2)
900526
+		if (maxrequests < DNS_DISPATCH_POOLSOCKS * 2) {
900526
 		  isc_mempool_setmaxalloc(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
900526
 		  isc_mempool_setfreemax(mgr->spool, DNS_DISPATCH_POOLSOCKS * 2);
900526
+		}
900526
 		UNLOCK(&mgr->buffer_lock);
900526
 		return (ISC_R_SUCCESS);
900526
 	}
900526
@@ -3765,7 +3766,7 @@ dns_dispatchset_create(isc_mem_t *mctx, isc_socketmgr_t *sockmgr,
900526
 		goto fail_alloc;
900526
 
900526
 	dset->dispatches = isc_mem_get(mctx, sizeof(dns_dispatch_t *) * n);
900526
-	if (dset == NULL) {
900526
+	if (dset->dispatches == NULL) {
900526
 		result = ISC_R_NOMEMORY;
900526
 		goto fail_lock;
900526
 	}
900526
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
900526
index d96473f..e71f202 100644
900526
--- a/lib/dns/dst_api.c
900526
+++ b/lib/dns/dst_api.c
900526
@@ -1882,6 +1882,9 @@ dst__entropy_getdata(void *buf, unsigned int len, isc_boolean_t pseudo) {
900526
 #ifdef BIND9
900526
 	unsigned int flags = dst_entropy_flags;
900526
 
900526
+	if (dst_entropy_pool == NULL)
900526
+		return (ISC_R_FAILURE);
900526
+
900526
 	if (len == 0)
900526
 		return (ISC_R_SUCCESS);
900526
 
900526
@@ -1914,6 +1917,9 @@ dst__entropy_status(void) {
900526
 	unsigned char buf[32];
900526
 	static isc_boolean_t first = ISC_TRUE;
900526
 
900526
+	if (dst_entropy_pool == NULL)
900526
+		return (0);
900526
+
900526
 	if (first) {
900526
 		/* Someone believes RAND_status() initializes the PRNG */
900526
 		flags &= ~ISC_ENTROPY_GOODONLY;
900526
diff --git a/lib/dns/gen.c b/lib/dns/gen.c
900526
index 6b533dd..548f892 100644
900526
--- a/lib/dns/gen.c
900526
+++ b/lib/dns/gen.c
900526
@@ -335,10 +335,14 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
900526
 			typename);
900526
 		exit(1);
900526
 	}
900526
+
900526
 	strncpy(ttn->typename, typename, sizeof(ttn->typename));
900526
-	ttn->type = type;
900526
+	ttn->typename[sizeof(ttn->typename) - 1] = '\0';
900526
 
900526
 	strncpy(ttn->macroname, ttn->typename, sizeof(ttn->macroname));
900526
+	ttn->macroname[sizeof(ttn->macroname) - 1] = '\0';
900526
+
900526
+	ttn->type = type;
900526
 	c = strlen(ttn->macroname);
900526
 	while (c > 0) {
900526
 		if (ttn->macroname[c - 1] == '-')
900526
@@ -364,7 +368,10 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
900526
 			attr, typename);
900526
 		exit(1);
900526
 	}
900526
+
900526
 	strncpy(ttn->attr, attr, sizeof(ttn->attr));
900526
+	ttn->attr[sizeof(ttn->attr) - 1] = '\0';
900526
+
900526
 	ttn->sorted = 0;
900526
 	if (maxtype < type)
900526
 		maxtype = type;
900526
@@ -393,11 +400,17 @@ add(int rdclass, const char *classname, int type, const char *typename,
900526
 	newtt->next = NULL;
900526
 	newtt->rdclass = rdclass;
900526
 	newtt->type = type;
900526
+
900526
 	strncpy(newtt->classname, classname, sizeof(newtt->classname));
900526
+	newtt->classname[sizeof(newtt->classname) - 1] = '\0';
900526
+
900526
 	strncpy(newtt->typename, typename, sizeof(newtt->typename));
900526
+	newtt->typename[sizeof(newtt->typename) - 1] = '\0';
900526
+
900526
 	if (strncmp(dirname, "./", 2) == 0)
900526
 		dirname += 2;
900526
 	strncpy(newtt->dirname, dirname, sizeof(newtt->dirname));
900526
+	newtt->dirname[sizeof(newtt->dirname) - 1] = '\0';
900526
 
900526
 	tt = types;
900526
 	oldtt = NULL;
900526
@@ -436,6 +449,7 @@ add(int rdclass, const char *classname, int type, const char *typename,
900526
 	}
900526
 	newcc->rdclass = rdclass;
900526
 	strncpy(newcc->classname, classname, sizeof(newcc->classname));
900526
+	newcc->classname[sizeof(newcc->classname) - 1] = '\0';
900526
 	cc = classes;
900526
 	oldcc = NULL;
900526
 
900526
diff --git a/lib/dns/name.c b/lib/dns/name.c
900526
index 4fcabb1..93173ee 100644
900526
--- a/lib/dns/name.c
900526
+++ b/lib/dns/name.c
900526
@@ -1859,7 +1859,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
900526
 				    0)
900526
 					return (DNS_R_DISALLOWED);
900526
 				new_current = c & 0x3F;
900526
-				n = 1;
900526
 				state = fw_newcurrent;
900526
 			} else
900526
 				return (DNS_R_BADLABELTYPE);
900526
@@ -1867,8 +1866,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
900526
 		case fw_ordinary:
900526
 			if (downcase)
900526
 				c = maptolower[c];
900526
-			/* FALLTHROUGH */
900526
-		case fw_copy:
900526
 			*ndata++ = c;
900526
 			n--;
900526
 			if (n == 0)
900526
@@ -1877,9 +1874,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
900526
 		case fw_newcurrent:
900526
 			new_current *= 256;
900526
 			new_current += c;
900526
-			n--;
900526
-			if (n != 0)
900526
-				break;
900526
 			if (new_current >= biggest_pointer)
900526
 				return (DNS_R_BADPOINTER);
900526
 			biggest_pointer = new_current;
900526
@@ -2398,6 +2392,8 @@ dns_name_tostring(dns_name_t *name, char **target, isc_mem_t *mctx) {
900526
 
900526
 	isc_buffer_usedregion(&buf, ®);
900526
 	p = isc_mem_allocate(mctx, reg.length + 1);
900526
+	if (p == NULL)
900526
+		return (ISC_R_NOMEMORY);
900526
 	memcpy(p, (char *) reg.base, (int) reg.length);
900526
 	p[reg.length] = '\0';
900526
 
900526
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
900526
index 935f515..86fad33 100644
900526
--- a/lib/dns/nsec3.c
900526
+++ b/lib/dns/nsec3.c
900526
@@ -842,8 +842,8 @@ dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
900526
 		dns_db_detachnode(db, &newnode);
900526
 	} while (1);
900526
 
900526
-	if (result == ISC_R_NOMORE)
900526
-		result = ISC_R_SUCCESS;
900526
+	/* result cannot be ISC_R_NOMORE here */
900526
+	INSIST(result != ISC_R_NOMORE);
900526
 
900526
  failure:
900526
 	if (dbit != NULL)
900526
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
900526
index 0b7fe8c..091b3c7 100644
900526
--- a/lib/dns/rcode.c
900526
+++ b/lib/dns/rcode.c
900526
@@ -216,7 +216,9 @@ maybe_numeric(unsigned int *valuep, isc_textregion_t *source,
900526
 	 * isc_parse_uint32().  isc_parse_uint32() requires
900526
 	 * null termination, so we must make a copy.
900526
 	 */
900526
-	strncpy(buffer, source->base, NUMBERSIZE);
900526
+	strncpy(buffer, source->base, sizeof(buffer));
900526
+	buffer[sizeof(buffer) - 1] = '\0';
900526
+
900526
 	INSIST(buffer[source->length] == '\0');
900526
 
900526
 	result = isc_parse_uint32(&n, buffer, 10);
900526
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
900526
index 5cce1bc..6706542 100644
900526
--- a/lib/isc/netaddr.c
900526
+++ b/lib/isc/netaddr.c
900526
@@ -235,6 +235,7 @@ isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
900526
 	nbytes = prefixlen / 8;
900526
 	nbits = prefixlen % 8;
900526
 	if (nbits != 0) {
900526
+		INSIST(nbytes < ipbytes);
900526
 		if ((p[nbytes] & (0xff>>nbits)) != 0U)
900526
 			return (ISC_R_FAILURE);
900526
 		nbytes++;
900526
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
900526
index 015bff2..de4479b 100644
900526
--- a/lib/isc/pk11.c
900526
+++ b/lib/isc/pk11.c
900526
@@ -130,7 +130,10 @@
900526
 #include <pkcs11/cryptoki.h>
900526
 #include <pkcs11/pkcs11.h>
900526
 
900526
-#define PINLEN	32
900526
+/* was 32 octets, Petr Spacek suggested 1024, SoftHSMv2 uses 256... */
900526
+#ifndef PINLEN
900526
+#define PINLEN	256
900526
+#endif
900526
 
900526
 #ifndef PK11_NO_LOGERR
900526
 #define PK11_NO_LOGERR 1
900526
@@ -163,7 +166,7 @@ struct pk11_token {
900526
 	char			manuf[32];
900526
 	char			model[16];
900526
 	char			serial[16];
900526
-	char			pin[PINLEN];
900526
+	char			pin[PINLEN + 1];
900526
 };
900526
 static ISC_LIST(pk11_token_t) tokens;
900526
 
900526
@@ -498,7 +501,9 @@ pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype,
900526
 
900526
 	/* Override the token's PIN */
900526
 	if (logon && pin != NULL && *pin != '\0') {
900526
-		memset(token->pin, 0, PINLEN);
900526
+		if (strlen(pin) > PINLEN)
900526
+			return ISC_R_RANGE;
900526
+		memset(token->pin, 0, PINLEN + 1);
900526
 		strncpy(token->pin, pin, PINLEN);
900526
 	}
900526
 
900526
@@ -1099,7 +1104,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
900526
 	char *uri, *p, *a, *na, *v;
900526
 	size_t len, l;
900526
 	FILE *stream = NULL;
900526
-	char pin[PINLEN];
900526
+	char pin[PINLEN + 1];
900526
 	isc_boolean_t gotpin = ISC_FALSE;
900526
 	isc_result_t ret;
900526
 
900526
@@ -1207,10 +1212,12 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
900526
 			ret = isc_stdio_open(v, "r", &stream);
900526
 			if (ret != ISC_R_SUCCESS)
900526
 				goto err;
900526
-			memset(pin, 0, PINLEN);
900526
-			ret = isc_stdio_read(pin, 1, PINLEN - 1, stream, NULL);
900526
+			memset(pin, 0, PINLEN + 1);
900526
+			ret = isc_stdio_read(pin, 1, PINLEN + 1, stream, &l);
900526
 			if ((ret != ISC_R_SUCCESS) && (ret != ISC_R_EOF))
900526
 				goto err;
900526
+			if (l > PINLEN)
900526
+				DST_RET(ISC_R_RANGE);
900526
 			ret = isc_stdio_close(stream);
900526
 			stream = NULL;
900526
 			if (ret != ISC_R_SUCCESS)
900526
@@ -1238,7 +1245,7 @@ pk11_parse_uri(pk11_object_t *obj, const char *label,
900526
 		DST_RET(ISC_R_NOTFOUND);
900526
 	obj->slot = token->slotid;
900526
 	if (gotpin) {
900526
-		memmove(token->pin, pin, PINLEN);
900526
+		memmove(token->pin, pin, PINLEN + 1);
900526
 		obj->reqlogon = ISC_TRUE;
900526
 	}
900526
 
900526
-- 
900526
2.1.0
900526