[Bug 2581] New: Coverity patches from Fedora

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2581

            Bug ID: 2581
           Summary: Coverity patches from Fedora
           Product: Portable OpenSSH
           Version: 7.2p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Keywords: patch
          Severity: enhancement
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: jjelen at redhat.com

Created attachment 2822
  --> https://bugzilla.mindrot.org/attachment.cgi?id=2822&action=edit
Proposed patch for points 1 - 5

I dug up some old patches that are hanging around fedora openssh
package, that could be useful also for upstream. They were reported
probably long time ago by Coverity and for some reason didn't make it
to upstream yet.

1. "debug3: mm_answer_keyallowed: key %p is allowed" is always NULL,
because it is freed before calling the log function.

  There is a flaw in logic of this debug log, when the key pointer is
always null (it is ensured that it is freed before) the call.

2. mm_pty_allocate contains Dead code (if the second dup fails, it
can't be different than -1) and comparison of the return dup() return
value should be >=0 instead of >0 -- 0 is also valid FD.

3. process_server_config_line: sAuthorizedPrincipalsFile option handles
intptr, without any possible label (therefore always null), which is
dead code (probably copy-paste error from sHostKeyFile)

4. box variable for sandbox context is not freed in the child process
after calling ssh_sandbox_child(), which makes it memory leak.

5. server_accept_loop() allocates fdset variable, but does not free it
in the end.

These are the most obvious problems and it would be nice to have them
addressed in the next release.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.