base/SOURCES/0004-bug-fixes-found-by-coverity.patch

From 62b5ab4f78de027021bb5557568e607270314f82 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:22:59 +0100
Subject: [PATCH 1/7] core: fix uninialized boolean variable in
 reset_autoconnect_all()

It's not critical, because at worst we get a false-positive that
something changed.

Found by coverity.

Fixes: 4e7b05de7981c28eba6db48eb16476372594fed2
(cherry picked from commit fbc6008260f58b625e3a6bd26129c66b51904012)
(cherry picked from commit 387377d8fce937de4ed583fdf631d6dcf35edf93)
---
 src/nm-policy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nm-policy.c b/src/nm-policy.c
index 8dfb0ab00..4d0ef91a1 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -1409,7 +1409,7 @@ reset_autoconnect_all (NMPolicy *self,
	NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (self);
	NMSettingsConnection *const*connections = NULL;
	guint i;
-	gboolean changed;
+	gboolean changed = FALSE;

	_LOGD (LOGD_DEVICE, "re-enabling autoconnect for all connections%s%s%s",
	       device ? " on " : "",
--
2.14.3


From 3b3e530fedfceafb694a961482e22e64c0a76348 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:27:51 +0100
Subject: [PATCH 2/7] core: avoid dereferencing NULL in
 nm_utils_resolve_conf_parse()

Found by coverity.

Fixes: 8f1ef161f4dd5ac197b622ac681d55d64c176797
(cherry picked from commit a7087b1f0539d43783c67c36ba9ed2165f81cb77)
(cherry picked from commit 1bb6b3a79f1e8cf2790aca1f78ccafad8ef7d56c)
---
 src/nm-core-utils.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c
index 40a0c352a..f6b33a149 100644
--- a/src/nm-core-utils.c
+++ b/src/nm-core-utils.c
@@ -1960,8 +1960,7 @@ nm_utils_resolve_conf_parse (int addr_family,
				gsize i_tokens;

				tokens = nm_utils_strsplit_set (s, " \t");
-				nm_assert (tokens);
-				for (i_tokens = 0; tokens[i_tokens]; i_tokens++) {
+				for (i_tokens = 0; tokens && tokens[i_tokens]; i_tokens++) {
					gs_free char *t = g_strstrip (g_strdup (tokens[i_tokens]));

					if (   _nm_utils_dns_option_validate (t, NULL, NULL,
--
2.14.3


From f67c30627b7c8369b957909abb84be27011ee2aa Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:31:01 +0100
Subject: [PATCH 3/7] libnm: fix checking argument in
 nm_team_link_watcher_new_arp_ping()

Found by coverity.

Fixes: 6c93e32212f9901e882d5a9ca221d037162bc740
(cherry picked from commit fb2da4b26c86a1916ad52cba00d6e6c725e74f4c)
(cherry picked from commit ccdfe9d3e500d0b695de2f528745924583c81c27)
---
 libnm-core/nm-setting-team.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c
index d36882783..88008e422 100644
--- a/libnm-core/nm-setting-team.c
+++ b/libnm-core/nm-setting-team.c
@@ -249,7 +249,7 @@ nm_team_link_watcher_new_arp_ping (gint init_wait,
		return NULL;
	}

-	if (strpbrk (target_host, " \\/\t=\"\'")) {
+	if (strpbrk (source_host, " \\/\t=\"\'")) {
		g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_FAILED,
		             _("source-host '%s' contains invalid characters"), source_host);
		return NULL;
--
2.14.3


From fbf92a9d6e73a9b47a149fd451a6d4edfbe00c05 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:37:59 +0100
Subject: [PATCH 4/7] platform: fix crash hashing NMPlatformTfilter and
 NMPlatformQdisc

@kind might be NULL. There are 3 forms of the hash-update functions for
string: str(), str0(), and strarr().

- str0() is when the string might be NULL.
- str() does not allow the string to be NULL
- strarr() is like str(), except it adds a G_STATIC_ASSERT()
  that the argument is a C array.

The reason why a difference between str() and str0() exists, is
because str0() hashes NULL different from a "" or any other string.
This has an overhead, because it effectively must hash another bit
of information that tells whether a string was passed or not.

The reason is, that hashing a tupple of two strings should always
yield a different hash value, even for "aa",""; "a","a"; "","aa",
where naive concatentation would yield identical hash values in all
three cases.

Fixes: e75fc8279becce29e688551930d85e59e1280c89
(cherry picked from commit 27e8fffdb833748dfeb6648b8768c4ef48822841)
(cherry picked from commit 99eef7a2ea3e7f79e2f449a04d7a3c78ba05f427)
---
 src/platform/nm-platform.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index 2ca379e4e..70675579f 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -5320,7 +5320,7 @@ nm_platform_qdisc_to_string (const NMPlatformQdisc *qdisc, char *buf, gsize len)
 void
 nm_platform_qdisc_hash_update (const NMPlatformQdisc *obj, NMHashState *h)
 {
-	nm_hash_update_str (h, obj->kind);
+	nm_hash_update_str0 (h, obj->kind);
	nm_hash_update_vals (h,
	                     obj->ifindex,
	                     obj->addr_family,
@@ -5387,17 +5387,17 @@ nm_platform_tfilter_to_string (const NMPlatformTfilter *tfilter, char *buf, gsiz
 void
 nm_platform_tfilter_hash_update (const NMPlatformTfilter *obj, NMHashState *h)
 {
-	nm_hash_update_str (h, obj->kind);
+	nm_hash_update_str0 (h, obj->kind);
	nm_hash_update_vals (h,
	                     obj->ifindex,
	                     obj->addr_family,
	                     obj->handle,
	                     obj->parent,
	                     obj->info);
-	nm_hash_update_str (h, obj->action.kind);
	if (obj->action.kind) {
+		nm_hash_update_str (h, obj->action.kind);
		if (nm_streq (obj->action.kind, NM_PLATFORM_ACTION_KIND_SIMPLE))
-			nm_hash_update_str (h, obj->action.simple.sdata);
+			nm_hash_update_strarr (h, obj->action.simple.sdata);
	}
 }

--
2.14.3


From 55a7ac49eb196937bc76db4a292832b266df5398 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:49:09 +0100
Subject: [PATCH 5/7] platform: assert() for valid item in
 nm_platform_link_get_all()

Coverity thinks that item might be NULL, but actually it
cannot. Unclear how to avoid the false positive.

(cherry picked from commit 62d4dba74bac791c06ba70547f81b78eab5b9dc5)
(cherry picked from commit 490911c6fa368692b4a6dfefdc2a1e253b40f7df)
---
 src/platform/nm-platform.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c
index 70675579f..c7ed90e3f 100644
--- a/src/platform/nm-platform.c
+++ b/src/platform/nm-platform.c
@@ -667,6 +667,7 @@ skip:
			/* There is a loop, pop the first (remaining) element from the list.
			 * This can happen for veth pairs where each peer is parent of the other end. */
			item = NMP_OBJECT_CAST_LINK (links->pdata[first_idx]);
+			nm_assert (item);
			g_hash_table_remove (unseen, GINT_TO_POINTER (item->ifindex));
			g_ptr_array_add (result, links->pdata[first_idx]);
			links->pdata[first_idx] = NULL;
--
2.14.3


From 954ae22f4219db60aeee641a3026d37fe7b71614 Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 10:59:26 +0100
Subject: [PATCH 6/7] cli: avoid out-of-bounds-read for show_device_info()

Probably not critical, because it will still include
the terminating NULL, and just continue to fill the
temporary buffer with static addresses.

Found by coverity.

Fixes: bfb9fd0d2f3d602a69537fe7776426ee9202ce9e
(cherry picked from commit c274b565a66e0c2932377554ce4d33a4772602e4)
(cherry picked from commit 7fb865947cd131d34703f0dc7ce153fb2e6676fc)
---
 clients/cli/devices.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/clients/cli/devices.c b/clients/cli/devices.c
index 467ce427d..da969fbe7 100644
--- a/clients/cli/devices.c
+++ b/clients/cli/devices.c
@@ -1116,8 +1116,8 @@ show_device_info (NMDevice *device, NmCli *nmc)
		                                   (const NMMetaAbstractInfo *const*) nmc_fields_dev_show_general,
		                                   FALSE, NULL, NULL);

-		row = g_new0 (NmcOutputField, _NM_META_SETTING_TYPE_NUM + 1);
-		for (i = 0; i < _NM_META_SETTING_TYPE_NUM; i++)
+		row = g_new0 (NmcOutputField, G_N_ELEMENTS (nmc_fields_dev_show_general));
+		for (i = 0; i < G_N_ELEMENTS (nmc_fields_dev_show_general); i++)
			row[i].info = (const NMMetaAbstractInfo *) &nmc_fields_dev_show_general[i];

		print_required_fields (&nmc->nmc_config, NMC_OF_FLAG_MAIN_HEADER_ONLY,
--
2.14.3


From 187d0038f5e929b338a005804386851d3d5c7e8b Mon Sep 17 00:00:00 2001
From: Thomas Haller <thaller@redhat.com>
Date: Tue, 12 Dec 2017 11:05:52 +0100
Subject: [PATCH 7/7] core: avoid leaks parsing team link-watcher

Found by coverity.

(cherry picked from commit f44f21c87e157c84ab865334f115e9fecd302465)
(cherry picked from commit 7673a3badc475998fc8f4169d0e2831d1625f1f9)
---
 libnm-core/nm-utils.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c
index 6cc92ec8d..9aafdd914 100644
--- a/libnm-core/nm-utils.c
+++ b/libnm-core/nm-utils.c
@@ -5185,13 +5185,16 @@ _nm_utils_team_link_watcher_from_json (json_t *json_element)
	g_return_val_if_fail (json_element, NULL);

	json_object_foreach (json_element, j_key, j_val) {
-		if (nm_streq (j_key, "name"))
+		if (nm_streq (j_key, "name")) {
+			g_free (name);
			name = strdup (json_string_value (j_val));
-		else if (nm_streq (j_key, "target_host"))
+		} else if (nm_streq (j_key, "target_host")) {
+			g_free (target_host);
			target_host = strdup (json_string_value (j_val));
-		else if (nm_streq (j_key, "source_host"))
+		} else if (nm_streq (j_key, "source_host")) {
+			g_free (source_host);
			source_host = strdup (json_string_value (j_val));
-		else if (NM_IN_STRSET (j_key, "delay_up", "init_wait"))
+		} else if (NM_IN_STRSET (j_key, "delay_up", "init_wait"))
			val1 = json_integer_value (j_val);
		else if (NM_IN_STRSET (j_key, "delay_down", "interval"))
			val2 = json_integer_value (j_val);
--
2.14.3