Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

conf: check if returned size is larger than buffer #523

Merged
merged 1 commit into from
Sep 16, 2022
Merged

Conversation

alfredh
Copy link
Contributor

@alfredh alfredh commented Sep 16, 2022

it looks like Coverity scan is complaining that we are not checking the number of bytes returned.

   	6. tainted_data_transitive: Call to function mbuf_write_mem with tainted argument buf transitively taints *mb->buf. [[show details](https://scan8.scan.coverity.com/eventId=12365060-8&modelId=12365060-0&fileInstanceId=62023522&filePath=%2Fsrc%2Fmbuf%2Fmbuf.c&fileStart=207&fileEnd=232)]
   	
CID 93696 (#1 of 1): Untrusted value as argument (TAINTED_SCALAR)
11. tainted_data: Passing tainted expression *mb->buf to mbuf_write_mem, which uses it as an offset. [[show details](https://scan8.scan.coverity.com/eventId=12365060-26&modelId=12365060-1&fileInstanceId=62023522&filePath=%2Fsrc%2Fmbuf%2Fmbuf.c&fileStart=207&fileEnd=232)]
   	Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.
 56                err |= mbuf_write_mem(mb, buf, n);
   	7. Jumping back to the beginning of the loop.
 57        }
 58

@sreimers sreimers merged commit 416a585 into main Sep 16, 2022
@sreimers sreimers deleted the conf_coverity_fix branch September 16, 2022 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants