[openssl-project] coverity defect release criteria (Fwd: New Defects reported by Coverity Scan for openssl/openssl)

Matt Caswell matt at openssl.org
Sun Sep 9 22:44:33 UTC 2018



On 09/09/18 19:31, Dr. Matthias St. Pierre wrote:
> I am currently occupied with other things, so I won't be able to look at it before later this evening or tomorrow.
> 
> I also had a quick look at CID 1423323 (see below) but I was unable to see why 'pkey' would be a NULL pointer
> when passed to 'EVP_PKEY_up_ref'. So I'm not sure yet whether this is a false positive.

It's because Coverity doesn't know that "type" will only ever be 0, 1 or
2. If it wasn't one of those then pkey would be NULL.

BTW, note that there is an oddity in the way we have Coverity set up.
It's my understanding that we filter out defect reports in the tests and
only worry about issues found in the main code base. If you look in the
Coverity tool itself you will never see any issues in the test suite (at
least I've never figured out how to see them if they are there).
Nonetheless it still reports them in the emails it sends out.

As far as the release criteria go we only count the ones shown in the
Coverity tool. That's not to say we shouldn't fix issues in the tests as
well (and actually I'd suggest we stop filtering out problems in the
tests if anyone knows how to do that...perhaps Tim?).

Matt


> 
> Matthias
> 
> 
>> -----Ursprüngliche Nachricht-----
>> Von: openssl-project <openssl-project-bounces at openssl.org> Im Auftrag von Benjamin Kaduk
>> Gesendet: Sonntag, 9. September 2018 18:04
>> An: openssl-project at openssl.org
>> Betreff: [openssl-project] coverity defect release criteria (Fwd: New Defects reported by Coverity Scan for openssl/openssl)
>>
>> I see that Matthias has opened pull requests for a couple of these already;
>> are you planning to work through the rest of them as well?
>>
>> -Ben
>>
>> On Sun, Sep 09, 2018 at 09:28:12AM +0000, scan-admin at coverity.com wrote:
>>> Hi,
>>>
>>> Please find the latest report on new defect(s) introduced to openssl/openssl found with Coverity Scan.
>>>
>>> 6 new defect(s) introduced to openssl/openssl found with Coverity Scan.
>>>
>>>
>>> New defect(s) Reported-by: Coverity Scan
>>> Showing 6 of 6 defect(s)
>>>
>>>
>>> ** CID 1439138:  Integer handling issues  (NEGATIVE_RETURNS)
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1439138:  Integer handling issues  (NEGATIVE_RETURNS)
>>> /crypto/rsa/rsa_pss.c: 247 in RSA_padding_add_PKCS1_PSS_mgf1()
>>> 241         EM[emLen - 1] = 0xbc;
>>> 242
>>> 243         ret = 1;
>>> 244
>>> 245      err:
>>> 246         EVP_MD_CTX_free(ctx);
>>>>>>     CID 1439138:  Integer handling issues  (NEGATIVE_RETURNS)
>>>>>>     "sLen" is passed to a parameter that cannot be negative.
>>> 247         OPENSSL_clear_free(salt, sLen);
>>> 248
>>> 249         return ret;
>>> 250
>>> 251     }
>>> 252
>>> 253     #if defined(_MSC_VER)
>>> 254     # pragma optimize("",on)
>>>
>>> ** CID 1439137:  Integer handling issues  (NEGATIVE_RETURNS)
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1439137:  Integer handling issues  (NEGATIVE_RETURNS)
>>> /crypto/sm2/sm2_pmeth.c: 277 in pkey_sm2_digest_custom()
>>> 271         }
>>> 272
>>> 273         /* get hashed prefix 'z' of tbs message */
>>> 274         if (!sm2_compute_z_digest(z, md, smctx->id, smctx->id_len, ec))
>>> 275             return 0;
>>> 276
>>>>>>     CID 1439137:  Integer handling issues  (NEGATIVE_RETURNS)
>>>>>>     "EVP_MD_size(md)" is passed to a parameter that cannot be negative.
>>> 277         return EVP_DigestUpdate(mctx, z, EVP_MD_size(md));
>>> 278     }
>>> 279
>>> 280     const EVP_PKEY_METHOD sm2_pkey_meth = {
>>> 281         EVP_PKEY_SM2,
>>> 282         0,
>>>
>>> ** CID 1439136:  Resource leaks  (RESOURCE_LEAK)
>>> /test/dhtest.c: 202 in dh_test()
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1439136:  Resource leaks  (RESOURCE_LEAK)
>>> /test/dhtest.c: 202 in dh_test()
>>> 196         BN_free(bp);
>>> 197         BN_free(bg);
>>> 198         BN_free(cpriv_key);
>>> 199         BN_GENCB_free(_cb);
>>> 200         DH_free(dh);
>>> 201
>>>>>>     CID 1439136:  Resource leaks  (RESOURCE_LEAK)
>>>>>>     Variable "priv_key" going out of scope leaks the storage it points to.
>>> 202         return ret;
>>> 203     }
>>> 204
>>> 205     static int cb(int p, int n, BN_GENCB *arg)
>>> 206     {
>>> 207         return 1;
>>>
>>> ** CID 1439135:  Memory - illegal accesses  (INCOMPATIBLE_CAST)
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1439135:  Memory - illegal accesses  (INCOMPATIBLE_CAST)
>>> /apps/speed.c: 3105 in speed_main()
>>> 3099                 ERR_print_errors(bio_err);
>>> 3100                 rsa_count = 1;
>>> 3101             } else {
>>> 3102                 for (i = 0; i < loopargs_len; i++) {
>>> 3103                     /* Perform EdDSA signature test */
>>> 3104                     loopargs[i].siglen = test_ed_curves[testnum].siglen;
>>>>>>     CID 1439135:  Memory - illegal accesses  (INCOMPATIBLE_CAST)
>>>>>>     Pointer "&loopargs[i].siglen" points to an object whose effective type is "unsigned int" (32 bits, unsigned) but is dereferenced as a
>> wider "unsigned long" (64 bits, unsigned).  This may lead to memory corruption.
>>> 3105                     st = EVP_DigestSign(loopargs[i].eddsa_ctx[testnum],
>>> 3106                                         loopargs[i].buf2, (size_t *)&loopargs[i].siglen,
>>> 3107                                         loopargs[i].buf, 20);
>>> 3108                     if (st == 0)
>>> 3109                         break;
>>> 3110                 }
>>>
>>> ** CID 1423323:  Null pointer dereferences  (FORWARD_NULL)
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1423323:  Null pointer dereferences  (FORWARD_NULL)
>>> /test/evp_extra_test.c: 894 in test_EVP_PKEY_check()
>>> 888
>>> 889         if (!TEST_int_eq(EVP_PKEY_param_check(ctx), expected_param_check))
>>> 890             goto done;
>>> 891
>>> 892         ctx2 = EVP_PKEY_CTX_new_id(0xdefaced, NULL);
>>> 893         /* assign the pkey directly, as an internal test */
>>>>>>     CID 1423323:  Null pointer dereferences  (FORWARD_NULL)
>>>>>>     Passing null pointer "pkey" to "EVP_PKEY_up_ref", which dereferences it.
>>> 894         EVP_PKEY_up_ref(pkey);
>>> 895         ctx2->pkey = pkey;
>>> 896
>>> 897         if (!TEST_int_eq(EVP_PKEY_check(ctx2), 0xbeef))
>>> 898             goto done;
>>> 899
>>>
>>> ** CID 1201571:  Error handling issues  (CHECKED_RETURN)
>>> /crypto/pkcs12/p12_init.c: 25 in PKCS12_init()
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> *** CID 1201571:  Error handling issues  (CHECKED_RETURN)
>>> /crypto/pkcs12/p12_init.c: 25 in PKCS12_init()
>>> 19         PKCS12 *pkcs12;
>>> 20
>>> 21         if ((pkcs12 = PKCS12_new()) == NULL) {
>>> 22             PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE);
>>> 23             return NULL;
>>> 24         }
>>>>>>     CID 1201571:  Error handling issues  (CHECKED_RETURN)
>>>>>>     Calling "ASN1_INTEGER_set" without checking return value (as is done elsewhere 30 out of 37 times).
>>> 25         ASN1_INTEGER_set(pkcs12->version, 3);
>>> 26         pkcs12->authsafes->type = OBJ_nid2obj(mode);
>>> 27         switch (mode) {
>>> 28         case NID_pkcs7_data:
>>> 29             if ((pkcs12->authsafes->d.data = ASN1_OCTET_STRING_new()) == NULL) {
>>> 30                 PKCS12err(PKCS12_F_PKCS12_INIT, ERR_R_MALLOC_FAILURE);
>>>
>>>
>>> ________________________________________________________________________________________________________
>>> To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-
>> 2BfV0V05UPxvVjWch-2Bd2MGckcRakUl6QyjujEohY7rPpoYUE4H-2Fm-2BeoDOl8jw7bf4Z78hw-3D-3D_bpOft2V4l9NXEcTx5CnNFJqpP-
>> 2F8a09dz6vsuNilvAJgBy9hWgnGhTAFGZnkvhcJuSQocoiCV36Dw66FwvViDOF-2BGQbzbMH8LM1tsnputryXt7SEgZZ-
>> 2FmpoWsuVr91UzOFBmmlL0bipzCjL7WfoT7QvLLnFuGxTjboshY44ftCBEhW8TAZR-2B1c1y7JdbYkdSXw-2B7Vmts-2F-
>> 2BitkvIjISgebBlgXuThX1DnzutpYSf00XD0-3D
>>>
>>>   To manage Coverity Scan email notifications for "kaduk-github at mit.edu", click
>> https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-
>> 2FA8y06Nq414hC6p-2BsqBEViFMJYotwSt4SYNeSzd6tPCdCHgDzpHIBW-2Fr0I0sQJCop-2Fx5Lu2ueYFxYqLmFh7APZbTTED-
>> 2B53KXZ2qVo0Y2q2bUC-2BpL2TzE-3D_bpOft2V4l9NXEcTx5CnNFJqpP-2F8a09dz6vsuNilvAJgBy9hWgnGhTAFGZnkvhcJu7xxYKPr1HkiPh-
>> 2BL3MaUbhQMZae3MPjv9c6bU6U4uhOZEhiS1P-2BwpukQ4-2BcSzk5FouA75ij0odEEgZcWTB05BKimz0wg0Y8JsC1Izz20-
>> 2FpfRp2kjWD47vvs4NmxuDPkNqvS3qoLRQ0vIXW8CFF339G-2B7jGolZ214Wxo3Gh6Hc0HY-3D
>>>
>> _______________________________________________
>> openssl-project mailing list
>> openssl-project at openssl.org
>> https://mta.openssl.org/mailman/listinfo/openssl-project
> _______________________________________________
> openssl-project mailing list
> openssl-project at openssl.org
> https://mta.openssl.org/mailman/listinfo/openssl-project
> 


More information about the openssl-project mailing list