Skip to contentSkip to conversation

crypto: avoid two coverity false positive error reports

PATCH Applied Daniel P. Berrange 3 participants 3 messages Nov 13, 2015 – Nov 29, 2015 Crypto API

lore
Share & tools
lore

Daniel P. Berrange

author
#0 lore raw

PATCH 1/1 crypto: avoid two coverity false positive error reports

In qcrypto_tls_creds_get_path() coverity complains that we are checking '*creds' for NULL, despite having dereferenced it previously. This is harmless bug due to fact that the trace call was too early. Moving it after the cleanup gets the desired semantics.

In qcrypto_tls_creds_check_cert_key_purpose() coverity complains that we're passing a pointer to a previously free'd buffer into gnutls_x509_crt_get_key_purpose_oid() This is harmless because we're passing a size == 0, so gnutls won't access the buffer, but rather just report what size it needs to be. We can avoid it though by explicitly setting the buffer to NULL after free'ing it.

Signed-off-by Daniel P. Berrange <[email protected]>
---
 crypto/tlscreds.c     | 4 ++--
 crypto/tlscredsx509.c | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)
crypto/tlscreds.c +2 -2
index 5ec982c..e7d9c1c 100644
@@ -123,10 +123,10 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
         goto cleanup;
     }
 
-    trace_qcrypto_tls_creds_get_path(creds, filename,
-                                     *cred ? *cred : "<none>");
     ret = 0;
  cleanup:
+    trace_qcrypto_tls_creds_get_path(creds, filename,
+                                     *cred ? *cred : "<none>");
     return ret;
 }
crypto/tlscredsx509.c +1 -0
index dc46bc4..e39c10f 100644
@@ -255,6 +255,7 @@ qcrypto_tls_creds_check_cert_key_purpose(QCryptoTLSCredsX509 *creds,
         }
 
         g_free(buffer);
+        buffer = NULL;
     }
 
     if (isServer) {
Signature · 1 line
2.5.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · Daniel P. Berrange

In qcrypto_tls_creds_get_path() coverity complains that we are checking '*creds' for NULL, despite having dereferenced it previously. This is harmless bug due to fact that the trace call was too early. Moving it after the cleanup gets the desired semantics.

In qcrypto_tls_creds_check_cert_key_purpose() coverity complains that we're passing a pointer to a previously free'd buffer into gnutls_x509_crt_get_key_purpose_oid() This is harmless because we're passing a size == 0, so gnutls won't access the buffer, but rather just report what size it needs to be. We can avoid it though by explicitly setting the buffer to NULL after free'ing it.

Quoted 5 lines
Signed-off-by Daniel P. Berrange <[email protected]>
---
 crypto/tlscreds.c     | 4 ++--
 crypto/tlscredsx509.c | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)
Reviewed-by Eric Blake <[email protected]>
Signature · 2 lines
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Applied
#2 lore raw
In reply to Daniel P. Berrange
Quoted 5 lines · Daniel P. Berrange

In qcrypto_tls_creds_get_path() coverity complains that we are checking '*creds' for NULL, despite having dereferenced it previously. This is harmless bug due to fact that the trace call was too early. Moving it after the cleanup gets the desired semantics.

...

Applied to -trivial, thank you!

/mjt