Calysto v1.5 reports on ssh v4.6p1

[Peter Stuge]

On Sun, Aug 12, 2007 at 11:19:56AM +1000, Darren Tucker wrote:
> > choose_dh (dh.c:111) calls fopen twice (@120). If the first call
> > to fopen fails (returns NULL), but the second one succeeds, fgets
> > (@129) is called with f==NULL.
> 
> I don't follow. If the second call to fopen succeeds, f is a valid
> FILE pointer returned by the second fopen call, not NULL.  If both
> fail, the function logs a warning,returns DH group 14 and never
> reaches the fgets.
> 
> 120  if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
> 121      (f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
> 122          logit("WARNING: %s does not exist, using fixed modulus",

I guess the analyzer is concerned with compilers that generate code
to evaluate both statements even though the first one fails. If the
second statement succeeds then it seems to be at least an fd leak.

I don't know what the rules are for C - apparently GCC stops
evaluating once the complete statement is impossible, but is it
good form to rely on that behavior?


//Peter