On 05/04/2012 05:54 AM, Stefan Berger wrote:
> Error: STRING_NULL:
> /libvirt/src/util/uuid.c:273:
> string_null_argument: Function "getDMISystemUUID" does not terminate string "*dmiuuid".
> /libvirt/src/util/uuid.c:241:
Maybe not, but...
> string_null_argument: Function "saferead" fills array "*uuid" with a non-terminated string.
> /libvirt/src/util/util.c:101:
> string_null_argument: Function "read" fills array "*buf" with a non-terminated string.
> /libvirt/src/util/uuid.c:274:
> string_null: Passing unterminated string "dmiuuid" to a function expecting a null-terminated string.
> /libvirt/src/util/uuid.c:138:
> var_assign_parm: Assigning: "cur" = "uuidstr". They now point to the same thing.
> /libvirt/src/util/uuid.c:164:
> string_null_sink_loop: Searching for null termination in an unterminated array "cur".
>
> ---
> src/util/uuid.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> Index: libvirt-acl/src/util/uuid.c
> ===================================================================
> --- libvirt-acl.orig/src/util/uuid.c
> +++ libvirt-acl/src/util/uuid.c
> @@ -269,8 +269,9 @@ virSetHostUUIDStr(const char *uuid)
> return EEXIST;
>
> if (!uuid) {
> - memset(dmiuuid, 0, sizeof(dmiuuid));
This pre-populates the entire array with NUL bytes,
> - if (!getDMISystemUUID(dmiuuid, sizeof(dmiuuid) - 1)) {
and this guarantees that getDMISystemUUID will not touch the last byte,
therefore we are guaranteed to have a NUL-terminated string.
Coverity has a false positive.
I'm not sure I like this patch; I'm debating if there is a better way to
shut Coverity up.
> + rc = getDMISystemUUID(dmiuuid, sizeof(dmiuuid) - 1);
This is working around the issue in the caller; wouldn't a better fix be
to actually alter getDMISystemUUID to guarantee NUL termination in the
first place, so that we don't have to audit all callers?
> + dmiuuid[VIR_UUID_STRING_BUFLEN - 1] = '\0';
> + if (!rc) {
> if (!virUUIDParse(dmiuuid, host_uuid))
> return 0;
> }
>
>
>
--
Eric Blake eblake@xxxxxxxxxx +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list