Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Fix TAINTED_SCALAR Coverity issues for pkg_editor.c #277

Merged
merged 5 commits into from
Jul 10, 2023

Commits on May 3, 2023

  1. Add exceptions to files_same

    This commit adds exceptions to the `files_same` function in the pkg_editor unit tests.
    
    Previously, the tests would pass even if one of the files passed into `files_same` did not exist. By adding exceptions, we correctly error out if one of the files did not exist.
    IlanTruanovsky committed May 3, 2023
    Configuration menu
    Copy the full SHA
    9012ffe View commit details
    Browse the repository at this point in the history

Commits on May 4, 2023

  1. Add pkg_editor unit tests with random files of varying sizes

    This commit adds randomness to the pkg_editor unit tests that deal with packing and unpacking files. This ensures that we can cover all file sizes and all types of file contents and improves the robustness of our pkg_editor code.
    IlanTruanovsky committed May 4, 2023
    Configuration menu
    Copy the full SHA
    131983a View commit details
    Browse the repository at this point in the history
  2. Fixes A Coverity TAINTED_SCALAR issue regarding info.name_length

    The info.name_length variable was not being checked to see if it was less than the size of name when passed into read_data. This was a simple fix.
    
    Fixes:
    ```
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      Type: Untrusted value as argument (TAINTED_SCALAR)
    
    lib/pkg_editor/src/pkg_editor.c:1591:3: Tainted data flows to a taint sink
      1. path: Condition "buffer != NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1596:5:
      2. path: Condition "input != NULL", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1596:5:
      3. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1601:3:
      4. path: Condition "ret != 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      5. path: Condition "z_info.strm.avail_in > 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      6. path: Condition "input != NULL", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      7. path: Condition "!feof(input)", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      8. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      9. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      10. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      11. path: Condition "!read_data(name, info.name_length, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1642:5:
      12. path: Condition "out_dir_length + 2 > 12288UL /* 3 * 4096 */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1652:5:
      13. path: Condition "info.kind == PACK_DIR", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1654:5:
      14. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1711:3:
      15. path: Jumping back to the beginning of the loop.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      16. path: Condition "z_info.strm.avail_in > 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      17. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      18. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      19. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      20. path: Condition "!read_data(name, info.name_length, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1642:5:
      21. path: Condition "out_dir_length + 2 > 12288UL /* 3 * 4096 */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1652:5:
      22. path: Condition "info.kind == PACK_DIR", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1654:5:
      23. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1711:3:
      24. path: Jumping back to the beginning of the loop.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      25. path: Condition "z_info.strm.avail_in > 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      26. tainted_argument: Calling function "read_data" taints argument "info".
    lib/pkg_editor/src/pkg_editor.c:1530:3: Tainted data flows to a taint sink
      26.1. var_assign_parm: Assigning: "z_info->strm.next_out" = "data".
    lib/pkg_editor/src/pkg_editor.c:1534:5:
      26.2. path: Condition "z_info->strm.avail_in == 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      26.3. path: Condition "in_fd == NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      26.4. path: Condition "feof(in_fd)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1541:7:
      26.5. tainted_data_argument: Calling function "fread" taints parameter "*z_info->buffer". [Note: The source code implementation of the function has been overridden by a builtin model.]
    lib/pkg_editor/src/pkg_editor.c:1542:7:
      26.6. path: Condition "count < 1", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1547:7:
      26.7. var_assign_alias: Assigning: "z_info->strm.next_in" = "z_info->buffer", which taints "z_info->strm.next_in".
    lib/pkg_editor/src/pkg_editor.c:1550:5:
      26.8. tainted_data_transitive: Calling function "inflate" with tainted argument "*z_info->strm.next_in" taints "*z_info->strm.next_out".
    lib/pkg_editor/src/pkg_editor.c:1551:5:
      26.9. path: Condition "ret != -2", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1551:5:
      26.10. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1552:5:
      26.11. path: Condition "ret == 1", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1554:7:
      26.12. path: Condition "z_info->strm.avail_out == 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      27. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      28. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      29. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      30. tainted_data: Passing tainted expression "info.name_length" to "read_data", which uses it as an offset.
    lib/pkg_editor/src/pkg_editor.c:1531:3: Tainted data flows to a taint sink
      30.1. var_assign_parm: Assigning: "z_info->strm.avail_out" = "size", which taints "z_info->strm.avail_out".
    lib/pkg_editor/src/pkg_editor.c:1534:5:
      30.2. path: Condition "z_info->strm.avail_in == 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      30.3. path: Condition "in_fd == NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      30.4. path: Condition "feof(in_fd)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1542:7:
      30.5. path: Condition "count < 1", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1550:5:
      30.6. taint_sink_lv_call: Passing tainted expression "z_info->strm.avail_out" to taint sink "inflate".
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      31. remediation: Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.
    ```
    IlanTruanovsky committed May 4, 2023
    Configuration menu
    Copy the full SHA
    c1e4e55 View commit details
    Browse the repository at this point in the history
  3. Fixes A Coverity TAINTED_SCALAR issue regarding an unbounded malloc

    Fixes:
    ```
    lib/pkg_editor/src/pkg_editor.c:1681:11:
      Type: Untrusted allocation size (TAINTED_SCALAR)
    
    lib/pkg_editor/src/pkg_editor.c:1591:3: Tainted data flows to a taint sink
      1. path: Condition "buffer != NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1596:5:
      2. path: Condition "input != NULL", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1596:5:
      3. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1601:3:
      4. path: Condition "ret != 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      5. path: Condition "z_info.strm.avail_in > 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      6. path: Condition "input != NULL", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      7. path: Condition "!feof(input)", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      8. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      9. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      10. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      11. path: Condition "!read_data(name, info.name_length, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1642:5:
      12. path: Condition "out_dir_length + 2 > 12288UL /* 3 * 4096 */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1652:5:
      13. path: Condition "info.kind == PACK_DIR", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1654:5:
      14. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1711:3:
      15. path: Jumping back to the beginning of the loop.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      16. path: Condition "z_info.strm.avail_in > 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      17. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      18. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      19. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      20. path: Condition "!read_data(name, info.name_length, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1642:5:
      21. path: Condition "out_dir_length + 2 > 12288UL /* 3 * 4096 */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1652:5:
      22. path: Condition "info.kind == PACK_DIR", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1654:5:
      23. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1711:3:
      24. path: Jumping back to the beginning of the loop.
    lib/pkg_editor/src/pkg_editor.c:1612:3:
      25. path: Condition "z_info.strm.avail_in > 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      26. tainted_argument: Calling function "read_data" taints argument "info".
    lib/pkg_editor/src/pkg_editor.c:1530:3: Tainted data flows to a taint sink
      26.1. var_assign_parm: Assigning: "z_info->strm.next_out" = "data".
    lib/pkg_editor/src/pkg_editor.c:1534:5:
      26.2. path: Condition "z_info->strm.avail_in == 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      26.3. path: Condition "in_fd == NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1537:7:
      26.4. path: Condition "feof(in_fd)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1541:7:
      26.5. tainted_data_argument: Calling function "fread" taints parameter "*z_info->buffer". [Note: The source code implementation of the function has been overridden by a builtin model.]
    lib/pkg_editor/src/pkg_editor.c:1542:7:
      26.6. path: Condition "count < 1", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1547:7:
      26.7. var_assign_alias: Assigning: "z_info->strm.next_in" = "z_info->buffer", which taints "z_info->strm.next_in".
    lib/pkg_editor/src/pkg_editor.c:1550:5:
      26.8. tainted_data_transitive: Calling function "inflate" with tainted argument "*z_info->strm.next_in" taints "*z_info->strm.next_out".
    lib/pkg_editor/src/pkg_editor.c:1551:5:
      26.9. path: Condition "ret != -2", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1551:5:
      26.10. path: Falling through to end of if statement.
    lib/pkg_editor/src/pkg_editor.c:1552:5:
      26.11. path: Condition "ret == 1", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1554:7:
      26.12. path: Condition "z_info->strm.avail_out == 0", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1614:5:
      27. path: Condition "!read_data(&info, 20UL /* sizeof (info) */, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1619:5:
      28. path: Condition "info.magic != 3203399403U", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1627:5:
      29. path: Condition "info.kind == PACK_END", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1632:5:
      30. path: Condition "!read_data(name, info.name_length, &z_info, input)", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1642:5:
      31. path: Condition "out_dir_length + 2 > 12288UL /* 3 * 4096 */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1652:5:
      32. path: Condition "info.kind == PACK_DIR", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1657:7:
      33. path: Condition "out_file == NULL", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1663:7:
      34. path: Condition "info.file_length > 0", taking true branch.
    lib/pkg_editor/src/pkg_editor.c:1663:7:
      35. lower_bounds: Checking lower bounds of unsigned scalar "info.file_length" by taking the true branch of "info.file_length > 0U".
    lib/pkg_editor/src/pkg_editor.c:1665:9:
      36. path: Condition "info.file_length < 65536UL /* sizeof (buf) */", taking false branch.
    lib/pkg_editor/src/pkg_editor.c:1665:9:
      37. lower_bounds: Checking lower bounds of unsigned scalar "info.file_length" by taking the false branch of "info.file_length < 65536UL".
    lib/pkg_editor/src/pkg_editor.c:1681:11:
      38. tainted_data: Passing tainted expression "info.file_length" to "malloc", which uses it as an allocation size.
    lib/pkg_editor/src/pkg_editor.c:1681:11:
      39. remediation: Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.
    ```
    IlanTruanovsky committed May 4, 2023
    Configuration menu
    Copy the full SHA
    84328d8 View commit details
    Browse the repository at this point in the history

Commits on May 11, 2023

  1. Configuration menu
    Copy the full SHA
    71ef9ea View commit details
    Browse the repository at this point in the history