You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
265 lines
9.3 KiB
265 lines
9.3 KiB
4 weeks ago
|
diff -up openssh-8.5p1/auth-krb5.c.coverity openssh-8.5p1/auth-krb5.c
|
||
|
|
--- openssh-8.5p1/auth-krb5.c.coverity 2021-03-24 12:03:33.724967756 +0100
|
||
|
|
+++ openssh-8.5p1/auth-krb5.c 2021-03-24 12:03:33.782968159 +0100
|
||
|
|
@@ -426,6 +426,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
|
||
|
|
umask(old_umask);
|
||
|
|
if (tmpfd == -1) {
|
||
|
|
logit("mkstemp(): %.100s", strerror(oerrno));
|
||
|
|
+ free(ccname);
|
||
|
|
return oerrno;
|
||
|
|
}
|
||
|
|
|
||
|
|
@@ -433,6 +434,7 @@ ssh_krb5_cc_new_unique(krb5_context ctx,
|
||
|
|
oerrno = errno;
|
||
|
|
logit("fchmod(): %.100s", strerror(oerrno));
|
||
|
|
close(tmpfd);
|
||
|
|
+ free(ccname);
|
||
|
|
return oerrno;
|
||
|
|
}
|
||
|
|
/* make sure the KRB5CCNAME is set for non-standard location */
|
||
|
|
diff -up openssh-8.5p1/gss-genr.c.coverity openssh-8.5p1/gss-genr.c
|
||
|
|
--- openssh-8.5p1/gss-genr.c.coverity 2021-03-26 11:52:46.613942552 +0100
|
||
|
|
+++ openssh-8.5p1/gss-genr.c 2021-03-26 11:54:37.881726318 +0100
|
||
|
|
@@ -167,8 +167,9 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_sup
|
||
|
|
enclen = __b64_ntop(digest,
|
||
|
|
ssh_digest_bytes(SSH_DIGEST_MD5), encoded,
|
||
|
|
ssh_digest_bytes(SSH_DIGEST_MD5) * 2);
|
||
|
|
-
|
||
|
|
+#pragma GCC diagnostic ignored "-Wstringop-overflow"
|
||
|
|
cp = strncpy(s, kex, strlen(kex));
|
||
|
|
+#pragma GCC diagnostic pop
|
||
|
|
for ((p = strsep(&cp, ",")); p && *p != '\0';
|
||
|
|
(p = strsep(&cp, ","))) {
|
||
|
|
if (sshbuf_len(buf) != 0 &&
|
||
|
|
diff -up openssh-8.5p1/krl.c.coverity openssh-8.5p1/krl.c
|
||
|
|
--- openssh-8.5p1/krl.c.coverity 2021-03-02 11:31:47.000000000 +0100
|
||
|
|
+++ openssh-8.5p1/krl.c 2021-03-24 12:03:33.783968166 +0100
|
||
|
|
@@ -1261,6 +1262,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
||
|
|
return r;
|
||
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
|
||
|
|
free(rb.blob);
|
||
|
|
+ rb.blob = NULL; /* make coverity happy */
|
||
|
|
if (erb != NULL) {
|
||
|
|
KRL_DBG(("revoked by key SHA1"));
|
||
|
|
return SSH_ERR_KEY_REVOKED;
|
||
|
|
@@ -1271,6 +1273,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
||
|
|
return r;
|
||
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha256s, &rb);
|
||
|
|
free(rb.blob);
|
||
|
|
+ rb.blob = NULL; /* make coverity happy */
|
||
|
|
if (erb != NULL) {
|
||
|
|
KRL_DBG(("revoked by key SHA256"));
|
||
|
|
return SSH_ERR_KEY_REVOKED;
|
||
|
|
@@ -1282,6 +1285,7 @@ is_key_revoked(struct ssh_krl *krl, cons
|
||
|
|
return r;
|
||
|
|
erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
|
||
|
|
free(rb.blob);
|
||
|
|
+ rb.blob = NULL; /* make coverity happy */
|
||
|
|
if (erb != NULL) {
|
||
|
|
KRL_DBG(("revoked by explicit key"));
|
||
|
|
return SSH_ERR_KEY_REVOKED;
|
||
|
|
diff -up openssh-8.5p1/loginrec.c.coverity openssh-8.5p1/loginrec.c
|
||
|
|
--- openssh-8.5p1/loginrec.c.coverity 2021-03-24 13:18:53.793225885 +0100
|
||
|
|
+++ openssh-8.5p1/loginrec.c 2021-03-24 13:21:27.948404751 +0100
|
||
|
|
@@ -690,9 +690,11 @@ construct_utmp(struct logininfo *li,
|
||
|
|
*/
|
||
|
|
|
||
|
|
/* Use strncpy because we don't necessarily want null termination */
|
||
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
||
|
|
strncpy(ut->ut_name, li->username,
|
||
|
|
MIN_SIZEOF(ut->ut_name, li->username));
|
||
|
|
# ifdef HAVE_HOST_IN_UTMP
|
||
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
||
|
|
strncpy(ut->ut_host, li->hostname,
|
||
|
|
MIN_SIZEOF(ut->ut_host, li->hostname));
|
||
|
|
# endif
|
||
|
|
@@ -1690,6 +1692,7 @@ record_failed_login(struct ssh *ssh, con
|
||
|
|
|
||
|
|
memset(&ut, 0, sizeof(ut));
|
||
|
|
/* strncpy because we don't necessarily want nul termination */
|
||
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
||
|
|
strncpy(ut.ut_user, username, sizeof(ut.ut_user));
|
||
|
|
strlcpy(ut.ut_line, "ssh:notty", sizeof(ut.ut_line));
|
||
|
|
|
||
|
|
@@ -1699,6 +1702,7 @@ record_failed_login(struct ssh *ssh, con
|
||
|
|
ut.ut_pid = getpid();
|
||
|
|
|
||
|
|
/* strncpy because we don't necessarily want nul termination */
|
||
|
|
+ /* coverity[buffer_size_warning : FALSE] */
|
||
|
|
strncpy(ut.ut_host, hostname, sizeof(ut.ut_host));
|
||
|
|
|
||
|
|
if (ssh_packet_connection_is_on_socket(ssh) &&
|
||
|
|
diff -up openssh-8.5p1/misc.c.coverity openssh-8.5p1/misc.c
|
||
|
|
--- openssh-8.5p1/misc.c.coverity 2021-03-24 12:03:33.745967902 +0100
|
||
|
|
+++ openssh-8.5p1/misc.c 2021-03-24 13:31:47.037079617 +0100
|
||
|
|
@@ -1425,6 +1425,8 @@ sanitise_stdfd(void)
|
||
|
|
}
|
||
|
|
if (nullfd > STDERR_FILENO)
|
||
|
|
close(nullfd);
|
||
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
||
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
||
|
|
}
|
||
|
|
|
||
|
|
char *
|
||
|
|
@@ -2511,6 +2513,7 @@ stdfd_devnull(int do_stdin, int do_stdou
|
||
|
|
}
|
||
|
|
if (devnull > STDERR_FILENO)
|
||
|
|
close(devnull);
|
||
|
|
+ /* coverity[leaked_handle : FALSE]*/
|
||
|
|
return ret;
|
||
|
|
}
|
||
|
|
|
||
|
|
diff -up openssh-7.4p1/monitor.c.coverity openssh-7.4p1/monitor.c
|
||
|
|
--- openssh-7.4p1/monitor.c.coverity 2016-12-23 16:40:26.888788688 +0100
|
||
|
|
+++ openssh-7.4p1/monitor.c 2016-12-23 16:40:26.900788691 +0100
|
||
|
|
@@ -411,7 +411,7 @@ monitor_child_preauth(Authctxt *_authctx
|
||
|
|
mm_get_keystate(ssh, pmonitor);
|
||
|
|
|
||
|
|
/* Drain any buffered messages from the child */
|
||
|
|
- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
|
||
|
|
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
|
||
|
|
;
|
||
|
|
|
||
|
|
if (pmonitor->m_recvfd >= 0)
|
||
|
|
@@ -1678,7 +1678,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
|
||
|
|
s->ptymaster = s->ptyfd;
|
||
|
|
|
||
|
|
debug3_f("tty %s ptyfd %d", s->tty, s->ttyfd);
|
||
|
|
-
|
||
|
|
+ /* coverity[leaked_handle : FALSE] */
|
||
|
|
return (0);
|
||
|
|
|
||
|
|
error:
|
||
|
|
diff -up openssh-7.4p1/openbsd-compat/bindresvport.c.coverity openssh-7.4p1/openbsd-compat/bindresvport.c
|
||
|
|
--- openssh-7.4p1/openbsd-compat/bindresvport.c.coverity 2016-12-19 05:59:41.000000000 +0100
|
||
|
|
+++ openssh-7.4p1/openbsd-compat/bindresvport.c 2016-12-23 16:40:26.901788691 +0100
|
||
|
|
@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
|
||
|
|
struct sockaddr_in6 *in6;
|
||
|
|
u_int16_t *portp;
|
||
|
|
u_int16_t port;
|
||
|
|
- socklen_t salen;
|
||
|
|
+ socklen_t salen = sizeof(struct sockaddr_storage);
|
||
|
|
int i;
|
||
|
|
|
||
|
|
if (sa == NULL) {
|
||
|
|
diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openbsd-compat/bsd-pselect.c
|
||
|
|
--- openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity 2021-08-30 16:36:11.357288009 +0200
|
||
|
|
+++ openssh-8.7p1/openbsd-compat/bsd-pselect.c 2021-08-30 16:37:21.791897976 +0200
|
||
|
|
@@ -113,13 +113,13 @@ pselect_notify_setup(void)
|
||
|
|
static void
|
||
|
|
pselect_notify_parent(void)
|
||
|
|
{
|
||
|
|
- if (notify_pipe[1] != -1)
|
||
|
|
+ if (notify_pipe[1] >= 0)
|
||
|
|
(void)write(notify_pipe[1], "", 1);
|
||
|
|
}
|
||
|
|
static void
|
||
|
|
pselect_notify_prepare(fd_set *readset)
|
||
|
|
{
|
||
|
|
- if (notify_pipe[0] != -1)
|
||
|
|
+ if (notify_pipe[0] >= 0)
|
||
|
|
FD_SET(notify_pipe[0], readset);
|
||
|
|
}
|
||
|
|
static void
|
||
|
|
@@ -127,8 +127,8 @@ pselect_notify_done(fd_set *readset)
|
||
|
|
{
|
||
|
|
char c;
|
||
|
|
|
||
|
|
- if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset)) {
|
||
|
|
- while (read(notify_pipe[0], &c, 1) != -1)
|
||
|
|
+ if (notify_pipe[0] >= 0 && FD_ISSET(notify_pipe[0], readset)) {
|
||
|
|
+ while (read(notify_pipe[0], &c, 1) >= 0)
|
||
|
|
debug2_f("reading");
|
||
|
|
FD_CLR(notify_pipe[0], readset);
|
||
|
|
}
|
||
|
|
diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
|
||
|
|
--- openssh-8.5p1/readconf.c.coverity 2021-03-24 12:03:33.778968131 +0100
|
||
|
|
+++ openssh-8.5p1/readconf.c 2021-03-24 12:03:33.785968180 +0100
|
||
|
|
@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
|
||
|
|
} else if (r != 0) {
|
||
|
|
error("%.200s line %d: glob failed for %s.",
|
||
|
|
filename, linenum, arg2);
|
||
|
|
+ free(arg2);
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
free(arg2);
|
||
|
|
diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
|
||
|
|
--- openssh-7.4p1/servconf.c.coverity 2016-12-23 16:40:26.896788690 +0100
|
||
|
|
+++ openssh-7.4p1/servconf.c 2016-12-23 16:40:26.901788691 +0100
|
||
|
|
@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
|
||
|
|
if (*activep && *charptr == NULL) {
|
||
|
|
*charptr = tilde_expand_filename(arg, getuid());
|
||
|
|
/* increase optional counter */
|
||
|
|
- if (intptr != NULL)
|
||
|
|
- *intptr = *intptr + 1;
|
||
|
|
+ /* DEAD CODE intptr is still NULL ;)
|
||
|
|
+ if (intptr != NULL)
|
||
|
|
+ *intptr = *intptr + 1; */
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
|
||
|
|
diff -up openssh-8.7p1/serverloop.c.coverity openssh-8.7p1/serverloop.c
|
||
|
|
--- openssh-8.7p1/serverloop.c.coverity 2021-08-20 06:03:49.000000000 +0200
|
||
|
|
+++ openssh-8.7p1/serverloop.c 2021-08-30 16:28:22.416226981 +0200
|
||
|
|
@@ -547,7 +547,7 @@ server_request_tun(struct ssh *ssh)
|
||
|
|
debug_f("invalid tun");
|
||
|
|
goto done;
|
||
|
|
}
|
||
|
|
- if (auth_opts->force_tun_device != -1) {
|
||
|
|
+ if (auth_opts->force_tun_device >= 0) {
|
||
|
|
if (tun != SSH_TUNID_ANY &&
|
||
|
|
auth_opts->force_tun_device != (int)tun)
|
||
|
|
goto done;
|
||
|
|
diff -up openssh-7.4p1/ssh-agent.c.coverity openssh-7.4p1/ssh-agent.c
|
||
|
|
--- openssh-7.4p1/ssh-agent.c.coverity 2016-12-19 05:59:41.000000000 +0100
|
||
|
|
+++ openssh-7.4p1/ssh-agent.c 2016-12-23 16:40:26.903788691 +0100
|
||
|
|
@@ -869,6 +869,7 @@ sanitize_pkcs11_provider(const char *pro
|
||
|
|
|
||
|
|
if (pkcs11_uri_parse(provider, uri) != 0) {
|
||
|
|
error("Failed to parse PKCS#11 URI");
|
||
|
|
+ pkcs11_uri_cleanup(uri);
|
||
|
|
return NULL;
|
||
|
|
}
|
||
|
|
/* validate also provider from URI */
|
||
|
|
diff -up openssh-7.4p1/sshd-session.c.coverity openssh-7.4p1/sshd-session.c
|
||
|
|
--- openssh-7.4p1/sshd-session.c.coverity 2016-12-23 16:40:26.897788690 +0100
|
||
|
|
+++ openssh-7.4p1/sshd-session.c 2016-12-23 16:40:26.904788692 +0100
|
||
|
|
@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
|
||
|
|
|
||
|
|
privsep_preauth_child(ssh);
|
||
|
|
setproctitle("%s", "[net]");
|
||
|
|
- if (box != NULL)
|
||
|
|
+ if (box != NULL) {
|
||
|
|
ssh_sandbox_child(box);
|
||
|
|
+ free(box);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
@@ -2519,8 +2524,11 @@ do_ssh2_kex(struct ssh *ssh)
|
||
|
|
|
||
|
|
if (newstr)
|
||
|
|
myproposal[PROPOSAL_KEX_ALGS] = newstr;
|
||
|
|
- else
|
||
|
|
+ else {
|
||
|
|
fatal("No supported key exchange algorithms");
|
||
|
|
+ free(gss);
|
||
|
|
+ }
|
||
|
|
+ /* coverity[leaked_storage: FALSE]*/
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
|
||
|
|
--- openssh-8.5p1/ssh-keygen.c.coverity 2021-03-24 12:03:33.780968145 +0100
|
||
|
|
+++ openssh-8.5p1/ssh-keygen.c 2021-03-24 12:03:33.787968194 +0100
|
||
|
|
@@ -2332,6 +2332,9 @@ update_krl_from_file(struct passwd *pw,
|
||
|
|
r = ssh_krl_revoke_key_sha256(krl, blob, blen);
|
||
|
|
if (r != 0)
|
||
|
|
fatal_fr(r, "revoke key failed");
|
||
|
|
+ freezero(blob, blen);
|
||
|
|
+ blob = NULL;
|
||
|
|
+ blen = 0;
|
||
|
|
} else {
|
||
|
|
if (strncasecmp(cp, "key:", 4) == 0) {
|
||
|
|
cp += 4;
|