coverity scan failed for the last couple month (since Nov 20th) without me noticing, I plan on running it again nightly for the Git project. Anyway, here are issues that piled up (in origin/pu) since then. Stefan ---------- Forwarded message ---------- From: <scan-admin@xxxxxxxxxxxx> Date: Mon, Mar 26, 2018 at 4:24 PM Subject: New Defects reported by Coverity Scan for git To: sbeller@xxxxxxxxxx Hi, Please find the latest report on new defect(s) introduced to git found with Coverity Scan. 44 new defect(s) introduced to git found with Coverity Scan. 32 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 44 defect(s) ** CID 1433546: Resource leaks (RESOURCE_LEAK) /t/helper/test-path-utils.c: 236 in cmd__path_utils() ________________________________________________________________________________________________________ *** CID 1433546: Resource leaks (RESOURCE_LEAK) /t/helper/test-path-utils.c: 236 in cmd__path_utils() 230 if (argc >= 4 && !strcmp(argv[1], "prefix_path")) { 231 const char *prefix = argv[2]; 232 int prefix_len = strlen(prefix); 233 int nongit_ok; 234 setup_git_directory_gently(&nongit_ok); 235 while (argc > 3) { >>> CID 1433546: Resource leaks (RESOURCE_LEAK) >>> Failing to save or free storage allocated by "prefix_path(prefix, prefix_len, argv[3])" leaks it. 236 puts(prefix_path(prefix, prefix_len, argv[3])); 237 argc--; 238 argv++; 239 } 240 return 0; 241 } ** CID 1433545: Security best practices violations (STRING_OVERFLOW) /merge-recursive.c: 1955 in check_dir_renamed() ________________________________________________________________________________________________________ *** CID 1433545: Security best practices violations (STRING_OVERFLOW) /merge-recursive.c: 1955 in check_dir_renamed() 1949 struct hashmap *dir_renames) 1950 { 1951 char temp[PATH_MAX]; 1952 char *end; 1953 struct dir_rename_entry *entry; 1954 >>> CID 1433545: Security best practices violations (STRING_OVERFLOW) >>> You might overrun the 4096-character fixed-size string "temp" by copying "path" without checking the length. 1955 strcpy(temp, path); 1956 while ((end = strrchr(temp, '/'))) { 1957 *end = '\0'; 1958 entry = dir_rename_find_entry(dir_renames, temp); 1959 if (entry) 1960 return entry; ** CID 1433544: Resource leaks (RESOURCE_LEAK) /builtin/submodule--helper.c: 66 in print_default_remote() ________________________________________________________________________________________________________ *** CID 1433544: Resource leaks (RESOURCE_LEAK) /builtin/submodule--helper.c: 66 in print_default_remote() 60 die(_("submodule--helper print-default-remote takes no arguments")); 61 62 remote = get_default_remote(); 63 if (remote) 64 printf("%s\n", remote); 65 >>> CID 1433544: Resource leaks (RESOURCE_LEAK) >>> Variable "remote" going out of scope leaks the storage it points to. 66 return 0; 67 } 68 69 static int starts_with_dot_slash(const char *str) 70 { 71 return str[0] == '.' && is_dir_sep(str[1]); ** CID 1433543: Null pointer dereferences (NULL_RETURNS) /merge-recursive.c: 812 in was_dirty() ________________________________________________________________________________________________________ *** CID 1433543: Null pointer dereferences (NULL_RETURNS) /merge-recursive.c: 812 in was_dirty() 806 int dirty = 1; 807 808 if (o->call_depth || !was_tracked(path)) 809 return !dirty; 810 811 ce = cache_file_exists(path, strlen(path), ignore_case); >>> CID 1433543: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "ce". 812 dirty = (ce->ce_stat_data.sd_mtime.sec > 0 && 813 verify_uptodate(ce, &o->unpack_opts) != 0); 814 return dirty; 815 } 816 817 static int make_room_for_path(struct merge_options *o, const char *path) ** CID 1433542: Error handling issues (CHECKED_RETURN) /merge-recursive.c: 2162 in apply_directory_rename_modifications() ________________________________________________________________________________________________________ *** CID 1433542: Error handling issues (CHECKED_RETURN) /merge-recursive.c: 2162 in apply_directory_rename_modifications() 2156 * "NOTE" in update_stages(), doing so will modify the current 2157 * in-memory index which will break calls to would_lose_untracked() 2158 * that we need to make. Instead, we need to just make sure that 2159 * the various conflict_rename_*() functions update the index 2160 * explicitly rather than relying on unpack_trees() to have done it. 2161 */ >>> CID 1433542: Error handling issues (CHECKED_RETURN) >>> Calling "get_tree_entry" without checking return value (as is done elsewhere 13 out of 16 times). 2162 get_tree_entry(&tree->object.oid, 2163 pair->two->path, 2164 &re->dst_entry->stages[stage].oid, 2165 &re->dst_entry->stages[stage].mode); 2166 2167 /* Update pair status */ ** CID 1433541: Resource leaks (RESOURCE_LEAK) /t/helper/test-path-utils.c: 246 in cmd__path_utils() ________________________________________________________________________________________________________ *** CID 1433541: Resource leaks (RESOURCE_LEAK) /t/helper/test-path-utils.c: 246 in cmd__path_utils() 240 return 0; 241 } 242 243 if (argc == 4 && !strcmp(argv[1], "strip_path_suffix")) { 244 char *prefix = strip_path_suffix(argv[2], argv[3]); 245 printf("%s\n", prefix ? prefix : "(null)"); >>> CID 1433541: Resource leaks (RESOURCE_LEAK) >>> Variable "prefix" going out of scope leaks the storage it points to. 246 return 0; 247 } 248 249 if (argc == 3 && !strcmp(argv[1], "print_path")) { 250 puts(argv[2]); 251 return 0; ** CID 1433540: Null pointer dereferences (REVERSE_INULL) /upload-pack.c: 834 in process_deepen_since() ________________________________________________________________________________________________________ *** CID 1433540: Null pointer dereferences (REVERSE_INULL) /upload-pack.c: 834 in process_deepen_since() 828 static int process_deepen_since(const char *line, timestamp_t *deepen_since, int *deepen_rev_list) 829 { 830 const char *arg; 831 if (skip_prefix(line, "deepen-since ", &arg)) { 832 char *end = NULL; 833 *deepen_since = parse_timestamp(arg, &end, 0); >>> CID 1433540: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "deepen_since" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 834 if (!end || *end || !deepen_since || 835 /* revisions.c's max_age -1 is special */ 836 *deepen_since == -1) 837 die("Invalid deepen-since: %s", line); 838 *deepen_rev_list = 1; 839 return 1; ** CID 1433539: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1433539: Null pointer dereferences (FORWARD_NULL) /t/helper/test-json-writer.c: 278 in scripted() 272 struct json_writer jw = JSON_WRITER_INIT; 273 int k; 274 275 if (!strcmp(argv[0], "@object")) 276 jw_object_begin(&jw); 277 else if (!strcmp(argv[0], "@array")) >>> CID 1433539: Null pointer dereferences (FORWARD_NULL) >>> Passing "&jw" to "jw_array_begin", which dereferences null "jw.levels". 278 jw_array_begin(&jw); 279 else 280 die("first script term must be '@object' or '@array': '%s'", argv[0]); 281 282 for (k = 1; k < argc; k++) { 283 const char *a_k = argv[k]; ** CID 1433538: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1433538: Null pointer dereferences (FORWARD_NULL) /t/helper/test-sha1-array.c: 23 in cmd__sha1_array() 17 const char *arg; 18 struct object_id oid; 19 20 if (skip_prefix(line.buf, "append ", &arg)) { 21 if (get_oid_hex(arg, &oid)) 22 die("not a hexadecimal SHA1: %s", arg); >>> CID 1433538: Null pointer dereferences (FORWARD_NULL) >>> Passing "&array" to "oid_array_append", which dereferences null "array.oid". 23 oid_array_append(&array, &oid); 24 } else if (skip_prefix(line.buf, "lookup ", &arg)) { 25 if (get_oid_hex(arg, &oid)) 26 die("not a hexadecimal SHA1: %s", arg); 27 printf("%d\n", oid_array_lookup(&array, &oid)); 28 } else if (!strcmp(line.buf, "clear")) ** CID 1433537: (FORWARD_NULL) /merge-recursive.c: 1796 in handle_directory_level_conflicts() /merge-recursive.c: 1791 in handle_directory_level_conflicts() ________________________________________________________________________________________________________ *** CID 1433537: (FORWARD_NULL) /merge-recursive.c: 1796 in handle_directory_level_conflicts() 1790 strbuf_release(&head_ent->new_dir); 1791 string_list_append(&remove_from_merge, 1792 merge_ent->dir)->util = merge_ent; 1793 strbuf_release(&merge_ent->new_dir); 1794 } else if (tree_has_path(head, head_ent->dir)) { 1795 /* 2. This wasn't a directory rename after all */ >>> CID 1433537: (FORWARD_NULL) >>> Dereferencing null pointer "string_list_append(&remove_from_head, head_ent->dir)". 1796 string_list_append(&remove_from_head, 1797 head_ent->dir)->util = head_ent; 1798 strbuf_release(&head_ent->new_dir); 1799 } 1800 } 1801 /merge-recursive.c: 1791 in handle_directory_level_conflicts() 1785 !merge_ent->non_unique_new_dir && 1786 !strbuf_cmp(&head_ent->new_dir, &merge_ent->new_dir)) { 1787 /* 1. Renamed identically; remove it from both sides */ 1788 string_list_append(&remove_from_head, 1789 head_ent->dir)->util = head_ent; 1790 strbuf_release(&head_ent->new_dir); >>> CID 1433537: (FORWARD_NULL) >>> Dereferencing null pointer "string_list_append(&remove_from_merge, merge_ent->dir)". 1791 string_list_append(&remove_from_merge, 1792 merge_ent->dir)->util = merge_ent; 1793 strbuf_release(&merge_ent->new_dir); 1794 } else if (tree_has_path(head, head_ent->dir)) { 1795 /* 2. This wasn't a directory rename after all */ 1796 string_list_append(&remove_from_head, ** CID 1433536: (RESOURCE_LEAK) /t/helper/test-delta.c: 34 in cmd__delta() /t/helper/test-delta.c: 48 in cmd__delta() /t/helper/test-delta.c: 75 in cmd__delta() /t/helper/test-delta.c: 78 in cmd__delta() ________________________________________________________________________________________________________ *** CID 1433536: (RESOURCE_LEAK) /t/helper/test-delta.c: 34 in cmd__delta() 28 return 1; 29 } 30 31 fd = open(argv[2], O_RDONLY); 32 if (fd < 0 || fstat(fd, &st)) { 33 perror(argv[2]); >>> CID 1433536: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 34 return 1; 35 } 36 from_size = st.st_size; 37 from_buf = mmap(NULL, from_size, PROT_READ, MAP_PRIVATE, fd, 0); 38 if (from_buf == MAP_FAILED) { 39 perror(argv[2]); /t/helper/test-delta.c: 48 in cmd__delta() 42 } 43 close(fd); 44 45 fd = open(argv[3], O_RDONLY); 46 if (fd < 0 || fstat(fd, &st)) { 47 perror(argv[3]); >>> CID 1433536: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 48 return 1; 49 } 50 data_size = st.st_size; 51 data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0); 52 if (data_buf == MAP_FAILED) { 53 perror(argv[3]); /t/helper/test-delta.c: 75 in cmd__delta() 69 return 1; 70 } 71 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); >>> CID 1433536: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 75 return 1; 76 } 77 78 return 0; /t/helper/test-delta.c: 78 in cmd__delta() 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); 75 return 1; 76 } 77 >>> CID 1433536: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 78 return 0; ** CID 1433535: Error handling issues (CHECKED_RETURN) /builtin/grep.c: 491 in grep_cache() ________________________________________________________________________________________________________ *** CID 1433535: Error handling issues (CHECKED_RETURN) /builtin/grep.c: 491 in grep_cache() 485 int name_base_len = 0; 486 if (repo->submodule_prefix) { 487 name_base_len = strlen(repo->submodule_prefix); 488 strbuf_addstr(&name, repo->submodule_prefix); 489 } 490 >>> CID 1433535: Error handling issues (CHECKED_RETURN) >>> Calling "repo_read_index" without checking return value (as is done elsewhere 4 out of 5 times). 491 repo_read_index(repo); 492 493 for (nr = 0; nr < repo->index->cache_nr; nr++) { 494 const struct cache_entry *ce = repo->index->cache[nr]; 495 strbuf_setlen(&name, name_base_len); 496 strbuf_addstr(&name, ce->name); ** CID 1433534: Resource leaks (RESOURCE_LEAK) /t/helper/test-mktemp.c: 12 in cmd__mktemp() ________________________________________________________________________________________________________ *** CID 1433534: Resource leaks (RESOURCE_LEAK) /t/helper/test-mktemp.c: 12 in cmd__mktemp() 6 7 int cmd__mktemp(int argc, const char **argv) 8 { 9 if (argc != 2) 10 usage("Expected 1 parameter defining the temporary file template"); 11 >>> CID 1433534: Resource leaks (RESOURCE_LEAK) >>> Failing to save or free storage allocated by "xstrdup(argv[1])" leaks it. 12 xmkstemp(xstrdup(argv[1])); 13 14 return 0; ** CID 1433533: (RESOURCE_LEAK) /t/helper/test-delta.c: 48 in cmd__delta() /t/helper/test-delta.c: 55 in cmd__delta() /t/helper/test-delta.c: 69 in cmd__delta() /t/helper/test-delta.c: 75 in cmd__delta() /t/helper/test-delta.c: 78 in cmd__delta() ________________________________________________________________________________________________________ *** CID 1433533: (RESOURCE_LEAK) /t/helper/test-delta.c: 48 in cmd__delta() 42 } 43 close(fd); 44 45 fd = open(argv[3], O_RDONLY); 46 if (fd < 0 || fstat(fd, &st)) { 47 perror(argv[3]); >>> CID 1433533: (RESOURCE_LEAK) >>> Variable "from_buf" going out of scope leaks the storage it points to. 48 return 1; 49 } 50 data_size = st.st_size; 51 data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0); 52 if (data_buf == MAP_FAILED) { 53 perror(argv[3]); /t/helper/test-delta.c: 55 in cmd__delta() 49 } 50 data_size = st.st_size; 51 data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0); 52 if (data_buf == MAP_FAILED) { 53 perror(argv[3]); 54 close(fd); >>> CID 1433533: (RESOURCE_LEAK) >>> Variable "from_buf" going out of scope leaks the storage it points to. 55 return 1; 56 } 57 close(fd); 58 59 if (argv[1][1] == 'd') 60 out_buf = diff_delta(from_buf, from_size, /t/helper/test-delta.c: 69 in cmd__delta() 63 else 64 out_buf = patch_delta(from_buf, from_size, 65 data_buf, data_size, 66 &out_size); 67 if (!out_buf) { 68 fprintf(stderr, "delta operation failed (returned NULL)\n"); >>> CID 1433533: (RESOURCE_LEAK) >>> Variable "from_buf" going out of scope leaks the storage it points to. 69 return 1; 70 } 71 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); /t/helper/test-delta.c: 75 in cmd__delta() 69 return 1; 70 } 71 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); >>> CID 1433533: (RESOURCE_LEAK) >>> Variable "from_buf" going out of scope leaks the storage it points to. 75 return 1; 76 } 77 78 return 0; /t/helper/test-delta.c: 78 in cmd__delta() 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); 75 return 1; 76 } 77 >>> CID 1433533: (RESOURCE_LEAK) >>> Variable "from_buf" going out of scope leaks the storage it points to. 78 return 0; ** CID 1433532: (RESOURCE_LEAK) /t/helper/test-delta.c: 75 in cmd__delta() /t/helper/test-delta.c: 78 in cmd__delta() /t/helper/test-delta.c: 75 in cmd__delta() ________________________________________________________________________________________________________ *** CID 1433532: (RESOURCE_LEAK) /t/helper/test-delta.c: 75 in cmd__delta() 69 return 1; 70 } 71 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); >>> CID 1433532: (RESOURCE_LEAK) >>> Variable "out_buf" going out of scope leaks the storage it points to. 75 return 1; 76 } 77 78 return 0; /t/helper/test-delta.c: 78 in cmd__delta() 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); 75 return 1; 76 } 77 >>> CID 1433532: (RESOURCE_LEAK) >>> Variable "out_buf" going out of scope leaks the storage it points to. 78 return 0; /t/helper/test-delta.c: 75 in cmd__delta() 69 return 1; 70 } 71 72 fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666); 73 if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) { 74 perror(argv[4]); >>> CID 1433532: (RESOURCE_LEAK) >>> Variable "out_buf" going out of scope leaks the storage it points to. 75 return 1; 76 } 77 78 return 0; ** CID 1433531: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1433531: Null pointer dereferences (FORWARD_NULL) /builtin/submodule--helper.c: 1045 in module_deinit() 1039 module_deinit_options); 1040 } 1041 1042 if (!argc && !all) 1043 die(_("Use '--all' if you really want to deinitialize all submodules")); 1044 >>> CID 1433531: Null pointer dereferences (FORWARD_NULL) >>> Passing "&list" to "module_list_compute", which dereferences null "list.entries". 1045 if (module_list_compute(argc, argv, prefix, &pathspec, &list) < 0) 1046 BUG("module_list_compute should not choke on empty pathspec"); 1047 1048 info.prefix = prefix; 1049 if (quiet) 1050 info.flags |= OPT_QUIET; ** CID 1433530: (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1433530: (FORWARD_NULL) /run-command.c: 574 in trace_add_env() 568 for (e = deltaenv; e && *e; e++) { 569 struct strbuf key = STRBUF_INIT; 570 char *equals = strchr(*e, '='); 571 572 if (equals) { 573 strbuf_add(&key, *e, equals - *e); >>> CID 1433530: (FORWARD_NULL) >>> Passing "&envs" to "string_list_insert", which dereferences null "envs.items". 574 string_list_insert(&envs, key.buf)->util = equals + 1; 575 } else { 576 string_list_insert(&envs, *e)->util = NULL; 577 } 578 strbuf_release(&key); 579 } /run-command.c: 576 in trace_add_env() 570 char *equals = strchr(*e, '='); 571 572 if (equals) { 573 strbuf_add(&key, *e, equals - *e); 574 string_list_insert(&envs, key.buf)->util = equals + 1; 575 } else { >>> CID 1433530: (FORWARD_NULL) >>> Passing "&envs" to "string_list_insert", which dereferences null "envs.items". 576 string_list_insert(&envs, *e)->util = NULL; 577 } 578 strbuf_release(&key); 579 } 580 581 /* "unset X Y...;" */ ** CID 1433529: Control flow issues (DEADCODE) /upload-pack.c: 1419 in upload_pack_v2() ________________________________________________________________________________________________________ *** CID 1433529: Control flow issues (DEADCODE) /upload-pack.c: 1419 in upload_pack_v2() 1413 send_shallow_info(&data); 1414 1415 packet_write_fmt(1, "packfile\n"); 1416 create_pack_file(); 1417 state = FETCH_DONE; 1418 break; >>> CID 1433529: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "case FETCH_DONE:". 1419 case FETCH_DONE: 1420 continue; 1421 } 1422 } 1423 1424 upload_pack_data_clear(&data); ** CID 1433528: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1433528: Null pointer dereferences (FORWARD_NULL) /convert.c: 411 in encode_to_git() 405 * the content. Let's answer with "yes", since an encoding was 406 * specified. 407 */ 408 if (!buf && !src) 409 return 1; 410 >>> CID 1433528: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "src" to "validate_encoding", which dereferences it. 411 if (validate_encoding(path, enc, src, src_len, die_on_error)) 412 return 0; 413 414 trace_encoding("source", path, enc, src, src_len); 415 dst = reencode_string_len(src, src_len, default_encoding, enc, 416 &dst_len); ** CID 1433527: Control flow issues (DEADCODE) /fetch-pack.c: 1396 in do_fetch_pack_v2() ________________________________________________________________________________________________________ *** CID 1433527: Control flow issues (DEADCODE) /fetch-pack.c: 1396 in do_fetch_pack_v2() 1390 process_section_header(&reader, "packfile", 0); 1391 if (get_pack(args, fd, pack_lockfile)) 1392 die(_("git fetch-pack: fetch failed.")); 1393 1394 state = FETCH_DONE; 1395 break; >>> CID 1433527: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "case FETCH_DONE:". 1396 case FETCH_DONE: 1397 continue; 1398 } 1399 } 1400 1401 oidset_clear(&common); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRb8HAP5hlBzHe8sORKm64S-2F81GsNbRdSrOteP-2FXoviMkw-3D-3D_PwiGIFugGOKqSZ6DZhASdI2SvWKInry4kHBXrJUc9pmXl6RPFKKio5QDumyeOncb-2B03DyHottfRb-2BR0vAZZ-2BouFuqkpeG83Y-2BMRBesAVhj5GrGot1mbZe20ytg0ii7TqV60O843zCVEbFTCr2Fj7-2Byv7sYi9qWRfEPYF5wF-2BAudpsWONlHafz3S2f-2F0Lk0mNQz1ZEGGEFx2qj7TNc4JugAxaJzb7JKTcIW0OPzH-2BQxU-3D