linux-ext4 - Re: e2fsprogs coverity patch <cid-02.diff>

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20070318140421.GB14519@thunk.org>
Date:	Sun, 18 Mar 2007 10:04:21 -0400
From:	Theodore Tso <tytso@....edu>
To:	"Brian D. Behlendorf" <behlendorf1@...l.gov>
Cc:	linux-ext4@...r.kernel.org, adilger@...sterfs.com,
	wartens2@...l.gov
Subject: Re: e2fsprogs coverity patch <cid-02.diff>

On Fri, Feb 09, 2007 at 06:11:17PM -0800, Brian D. Behlendorf wrote:
> Looks like ss_current_request is a macro that will set code to 0. This test
> will always be false. I will remove this error case.

The ss library is pretty stable, yes, but it's a bad idea to remove an
error check which is mandated by the interface defintion; what if the
implementation changes in the future?

Probably the better way to shut up coverity in this case is to replace
the current implementation of ss_current_request with a C version
which checks to make sure sci_idx is valid (as opposed to blindly
indexing off the array and potentially causing a seg fault), and
returning EINVAL if sci_idx is invalid.

I will NOT do this fixup now, but I will queue it in a future
(low-priority) TODO list.  Fixes to do this are welcome.

					- Ted
-
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html