From: Jonathan McDowell Date: Thu, 14 Sep 2023 06:53:41 +0000 (+0530) Subject: Fix issues found by llvm scan-build static analysis X-Git-Tag: onak-0.6.3~23 X-Git-Url: https://the.earth.li/gitweb/?a=commitdiff_plain;h=c0fee41b459cc3822d890bac98882a6c9696c033;p=onak.git Fix issues found by llvm scan-build static analysis A mixture of fixes: a number of uses of getenv into functions that don't like NULL, a couple of potential double-setting of config file details resulting in a brief memory leak, and a true, but not an issue, report of setting without using of our offset within a packet. --- diff --git a/cgi/hashquery.c b/cgi/hashquery.c index 5c056a2..a8ca3d0 100644 --- a/cgi/hashquery.c +++ b/cgi/hashquery.c @@ -42,7 +42,7 @@ void doerror(char *error) int main(int argc, char *argv[]) { - char *request_method; + char *request_method, *env; int count, found, i; uint8_t **hashes; struct buffer_ctx cgipostbuf; @@ -57,7 +57,8 @@ int main(int argc, char *argv[]) doerror("hashquery must be a HTTP POST request.\n"); } - if (!(cgipostbuf.size = atoi(getenv("CONTENT_LENGTH")))) { + env = getenv("CONTENT_LENGTH"); + if ((env == NULL) || !(cgipostbuf.size = atoi(env))) { doerror("Must provide a content length.\n"); } diff --git a/getcgi.c b/getcgi.c index c6f60c8..7c06560 100644 --- a/getcgi.c +++ b/getcgi.c @@ -139,7 +139,7 @@ void unescape_url(char *url) char **getcgivars(int argc, char *argv[]) { int i; - char *request_method; + char *request_method, *env; int content_length, paircount; char *cgiinput = NULL; char **cgivars = NULL; @@ -161,27 +161,31 @@ char **getcgivars(int argc, char *argv[]) return NULL; } else if (!strcmp(request_method, "GET") || !strcmp(request_method, "HEAD")) { - cgiinput=strdup(getenv("QUERY_STRING")); + env = getenv("QUERY_STRING"); + if (env != NULL) { + cgiinput = strdup(env); + } } else if (!strcmp(request_method, "POST")) { - if (getenv("CONTENT_TYPE") != NULL && - strcasecmp(getenv("CONTENT_TYPE"), - "application/x-www-form-urlencoded")) { + env = getenv("CONTENT_TYPE"); + if ((env != NULL) && strcasecmp(env, + "application/x-www-form-urlencoded")) { printf("getcgivars(): Unsupported Content-Type.\n"); exit(1); } - - if (!(content_length = atoi(getenv("CONTENT_LENGTH")))) { + + env = getenv("CONTENT_LENGTH"); + if ((env == NULL) || !(content_length = atoi(env))) { printf("getcgivars(): No Content-Length was sent with" " the POST request.\n"); exit(1); } - - if (!(cgiinput= (char *) malloc(content_length+1))) { + + if (!(cgiinput = (char *) malloc(content_length+1))) { printf("getcgivars(): Could not malloc for " "cgiinput.\n"); exit(1); } - + if (!fread(cgiinput, content_length, 1, stdin)) { printf("Couldn't read CGI input from STDIN.\n"); exit(1); @@ -194,6 +198,11 @@ char **getcgivars(int argc, char *argv[]) exit(1); } + /* If we didn't get any cgiinput info, nothing to return */ + if (cgiinput == NULL) { + return NULL; + } + /* Change all plusses back to spaces */ for(i=0; cgiinput[i]; i++) if (cgiinput[i]=='+') cgiinput[i] = ' '; diff --git a/onak.c b/onak.c index a27ff98..d21ce7a 100644 --- a/onak.c +++ b/onak.c @@ -187,6 +187,9 @@ int main(int argc, char *argv[]) binary = true; break; case 'c': + if (configfile != NULL) { + free(configfile); + } configfile = strdup(optarg); break; case 'e': diff --git a/sigcheck.c b/sigcheck.c index 29ab652..2c1fc4c 100644 --- a/sigcheck.c +++ b/sigcheck.c @@ -263,6 +263,12 @@ static onak_status_t onak_parse_key_material(struct openpgp_packet *pk, return ONAK_E_UNSUPPORTED_FEATURE; } + /* + * Keep scan-build happy; we bump this in MPI_TO_MPZ and then don't use + * it again the last time we do so. + */ + (void)ofs; + key->type = pk->data[5]; if (ret != ONAK_E_OK) { @@ -311,7 +317,7 @@ onak_status_t onak_check_hash_sig(struct openpgp_publickey *sigkey, } /* Skip to the signature material */ - ofs += 19; + ofs = 19; sigkeytype = sig->data[15]; } else if (sig->data[0] >= 4) { /* Skip the hashed data */ diff --git a/wotsap.c b/wotsap.c index 8996c9b..0a9f9df 100644 --- a/wotsap.c +++ b/wotsap.c @@ -197,6 +197,9 @@ int main(int argc, char *argv[]) while ((optchar = getopt(argc, argv, "c:")) != -1 ) { switch (optchar) { case 'c': + if (configfile != NULL) { + free(configfile); + } configfile = strdup(optarg); break; }