From 62b5ab4f78de027021bb5557568e607270314f82 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:22:59 +0100 Subject: [PATCH 1/7] core: fix uninialized boolean variable in reset_autoconnect_all() It's not critical, because at worst we get a false-positive that something changed. Found by coverity. Fixes: 4e7b05de7981c28eba6db48eb16476372594fed2 (cherry picked from commit fbc6008260f58b625e3a6bd26129c66b51904012) (cherry picked from commit 387377d8fce937de4ed583fdf631d6dcf35edf93) --- src/nm-policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nm-policy.c b/src/nm-policy.c index 8dfb0ab00..4d0ef91a1 100644 --- a/src/nm-policy.c +++ b/src/nm-policy.c @@ -1409,7 +1409,7 @@ reset_autoconnect_all (NMPolicy *self, NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (self); NMSettingsConnection *const*connections = NULL; guint i; - gboolean changed; + gboolean changed = FALSE; _LOGD (LOGD_DEVICE, "re-enabling autoconnect for all connections%s%s%s", device ? " on " : "", -- 2.14.3 From 3b3e530fedfceafb694a961482e22e64c0a76348 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:27:51 +0100 Subject: [PATCH 2/7] core: avoid dereferencing NULL in nm_utils_resolve_conf_parse() Found by coverity. Fixes: 8f1ef161f4dd5ac197b622ac681d55d64c176797 (cherry picked from commit a7087b1f0539d43783c67c36ba9ed2165f81cb77) (cherry picked from commit 1bb6b3a79f1e8cf2790aca1f78ccafad8ef7d56c) --- src/nm-core-utils.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/nm-core-utils.c b/src/nm-core-utils.c index 40a0c352a..f6b33a149 100644 --- a/src/nm-core-utils.c +++ b/src/nm-core-utils.c @@ -1960,8 +1960,7 @@ nm_utils_resolve_conf_parse (int addr_family, gsize i_tokens; tokens = nm_utils_strsplit_set (s, " \t"); - nm_assert (tokens); - for (i_tokens = 0; tokens[i_tokens]; i_tokens++) { + for (i_tokens = 0; tokens && tokens[i_tokens]; i_tokens++) { gs_free char *t = g_strstrip (g_strdup (tokens[i_tokens])); if ( _nm_utils_dns_option_validate (t, NULL, NULL, -- 2.14.3 From f67c30627b7c8369b957909abb84be27011ee2aa Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:31:01 +0100 Subject: [PATCH 3/7] libnm: fix checking argument in nm_team_link_watcher_new_arp_ping() Found by coverity. Fixes: 6c93e32212f9901e882d5a9ca221d037162bc740 (cherry picked from commit fb2da4b26c86a1916ad52cba00d6e6c725e74f4c) (cherry picked from commit ccdfe9d3e500d0b695de2f528745924583c81c27) --- libnm-core/nm-setting-team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libnm-core/nm-setting-team.c b/libnm-core/nm-setting-team.c index d36882783..88008e422 100644 --- a/libnm-core/nm-setting-team.c +++ b/libnm-core/nm-setting-team.c @@ -249,7 +249,7 @@ nm_team_link_watcher_new_arp_ping (gint init_wait, return NULL; } - if (strpbrk (target_host, " \\/\t=\"\'")) { + if (strpbrk (source_host, " \\/\t=\"\'")) { g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_FAILED, _("source-host '%s' contains invalid characters"), source_host); return NULL; -- 2.14.3 From fbf92a9d6e73a9b47a149fd451a6d4edfbe00c05 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:37:59 +0100 Subject: [PATCH 4/7] platform: fix crash hashing NMPlatformTfilter and NMPlatformQdisc @kind might be NULL. There are 3 forms of the hash-update functions for string: str(), str0(), and strarr(). - str0() is when the string might be NULL. - str() does not allow the string to be NULL - strarr() is like str(), except it adds a G_STATIC_ASSERT() that the argument is a C array. The reason why a difference between str() and str0() exists, is because str0() hashes NULL different from a "" or any other string. This has an overhead, because it effectively must hash another bit of information that tells whether a string was passed or not. The reason is, that hashing a tupple of two strings should always yield a different hash value, even for "aa",""; "a","a"; "","aa", where naive concatentation would yield identical hash values in all three cases. Fixes: e75fc8279becce29e688551930d85e59e1280c89 (cherry picked from commit 27e8fffdb833748dfeb6648b8768c4ef48822841) (cherry picked from commit 99eef7a2ea3e7f79e2f449a04d7a3c78ba05f427) --- src/platform/nm-platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c index 2ca379e4e..70675579f 100644 --- a/src/platform/nm-platform.c +++ b/src/platform/nm-platform.c @@ -5320,7 +5320,7 @@ nm_platform_qdisc_to_string (const NMPlatformQdisc *qdisc, char *buf, gsize len) void nm_platform_qdisc_hash_update (const NMPlatformQdisc *obj, NMHashState *h) { - nm_hash_update_str (h, obj->kind); + nm_hash_update_str0 (h, obj->kind); nm_hash_update_vals (h, obj->ifindex, obj->addr_family, @@ -5387,17 +5387,17 @@ nm_platform_tfilter_to_string (const NMPlatformTfilter *tfilter, char *buf, gsiz void nm_platform_tfilter_hash_update (const NMPlatformTfilter *obj, NMHashState *h) { - nm_hash_update_str (h, obj->kind); + nm_hash_update_str0 (h, obj->kind); nm_hash_update_vals (h, obj->ifindex, obj->addr_family, obj->handle, obj->parent, obj->info); - nm_hash_update_str (h, obj->action.kind); if (obj->action.kind) { + nm_hash_update_str (h, obj->action.kind); if (nm_streq (obj->action.kind, NM_PLATFORM_ACTION_KIND_SIMPLE)) - nm_hash_update_str (h, obj->action.simple.sdata); + nm_hash_update_strarr (h, obj->action.simple.sdata); } } -- 2.14.3 From 55a7ac49eb196937bc76db4a292832b266df5398 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:49:09 +0100 Subject: [PATCH 5/7] platform: assert() for valid item in nm_platform_link_get_all() Coverity thinks that item might be NULL, but actually it cannot. Unclear how to avoid the false positive. (cherry picked from commit 62d4dba74bac791c06ba70547f81b78eab5b9dc5) (cherry picked from commit 490911c6fa368692b4a6dfefdc2a1e253b40f7df) --- src/platform/nm-platform.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/platform/nm-platform.c b/src/platform/nm-platform.c index 70675579f..c7ed90e3f 100644 --- a/src/platform/nm-platform.c +++ b/src/platform/nm-platform.c @@ -667,6 +667,7 @@ skip: /* There is a loop, pop the first (remaining) element from the list. * This can happen for veth pairs where each peer is parent of the other end. */ item = NMP_OBJECT_CAST_LINK (links->pdata[first_idx]); + nm_assert (item); g_hash_table_remove (unseen, GINT_TO_POINTER (item->ifindex)); g_ptr_array_add (result, links->pdata[first_idx]); links->pdata[first_idx] = NULL; -- 2.14.3 From 954ae22f4219db60aeee641a3026d37fe7b71614 Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 10:59:26 +0100 Subject: [PATCH 6/7] cli: avoid out-of-bounds-read for show_device_info() Probably not critical, because it will still include the terminating NULL, and just continue to fill the temporary buffer with static addresses. Found by coverity. Fixes: bfb9fd0d2f3d602a69537fe7776426ee9202ce9e (cherry picked from commit c274b565a66e0c2932377554ce4d33a4772602e4) (cherry picked from commit 7fb865947cd131d34703f0dc7ce153fb2e6676fc) --- clients/cli/devices.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/clients/cli/devices.c b/clients/cli/devices.c index 467ce427d..da969fbe7 100644 --- a/clients/cli/devices.c +++ b/clients/cli/devices.c @@ -1116,8 +1116,8 @@ show_device_info (NMDevice *device, NmCli *nmc) (const NMMetaAbstractInfo *const*) nmc_fields_dev_show_general, FALSE, NULL, NULL); - row = g_new0 (NmcOutputField, _NM_META_SETTING_TYPE_NUM + 1); - for (i = 0; i < _NM_META_SETTING_TYPE_NUM; i++) + row = g_new0 (NmcOutputField, G_N_ELEMENTS (nmc_fields_dev_show_general)); + for (i = 0; i < G_N_ELEMENTS (nmc_fields_dev_show_general); i++) row[i].info = (const NMMetaAbstractInfo *) &nmc_fields_dev_show_general[i]; print_required_fields (&nmc->nmc_config, NMC_OF_FLAG_MAIN_HEADER_ONLY, -- 2.14.3 From 187d0038f5e929b338a005804386851d3d5c7e8b Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Tue, 12 Dec 2017 11:05:52 +0100 Subject: [PATCH 7/7] core: avoid leaks parsing team link-watcher Found by coverity. (cherry picked from commit f44f21c87e157c84ab865334f115e9fecd302465) (cherry picked from commit 7673a3badc475998fc8f4169d0e2831d1625f1f9) --- libnm-core/nm-utils.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/libnm-core/nm-utils.c b/libnm-core/nm-utils.c index 6cc92ec8d..9aafdd914 100644 --- a/libnm-core/nm-utils.c +++ b/libnm-core/nm-utils.c @@ -5185,13 +5185,16 @@ _nm_utils_team_link_watcher_from_json (json_t *json_element) g_return_val_if_fail (json_element, NULL); json_object_foreach (json_element, j_key, j_val) { - if (nm_streq (j_key, "name")) + if (nm_streq (j_key, "name")) { + g_free (name); name = strdup (json_string_value (j_val)); - else if (nm_streq (j_key, "target_host")) + } else if (nm_streq (j_key, "target_host")) { + g_free (target_host); target_host = strdup (json_string_value (j_val)); - else if (nm_streq (j_key, "source_host")) + } else if (nm_streq (j_key, "source_host")) { + g_free (source_host); source_host = strdup (json_string_value (j_val)); - else if (NM_IN_STRSET (j_key, "delay_up", "init_wait")) + } else if (NM_IN_STRSET (j_key, "delay_up", "init_wait")) val1 = json_integer_value (j_val); else if (NM_IN_STRSET (j_key, "delay_down", "interval")) val2 = json_integer_value (j_val); -- 2.14.3