From unknown Sun Aug 17 09:09:28 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#71535 <71535@debbugs.gnu.org> To: bug#71535 <71535@debbugs.gnu.org> Subject: Status: multiple defects found by covscan in diffutils-3.10 Reply-To: bug#71535 <71535@debbugs.gnu.org> Date: Sun, 17 Aug 2025 16:09:28 +0000 retitle 71535 multiple defects found by covscan in diffutils-3.10 reassign 71535 diffutils submitter 71535 Wasser Mai severity 71535 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Thu Jun 13 09:15:47 2024 Received: (at submit) by debbugs.gnu.org; 13 Jun 2024 13:15:47 +0000 Received: from localhost ([127.0.0.1]:51065 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sHkIs-0007z8-2m for submit@debbugs.gnu.org; Thu, 13 Jun 2024 09:15:47 -0400 Received: from lists.gnu.org ([209.51.188.17]:33330) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sHgr0-0001Ac-15 for submit@debbugs.gnu.org; Thu, 13 Jun 2024 05:34:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sHgqz-0007Ss-DT for bug-diffutils@gnu.org; Thu, 13 Jun 2024 05:34:45 -0400 Received: from mail-lf1-x12d.google.com ([2a00:1450:4864:20::12d]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sHgqx-0007KL-7g for bug-diffutils@gnu.org; Thu, 13 Jun 2024 05:34:45 -0400 Received: by mail-lf1-x12d.google.com with SMTP id 2adb3069b0e04-52bc29c79fdso1107889e87.1 for ; Thu, 13 Jun 2024 02:34:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1718271280; x=1718876080; darn=gnu.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=e0lygbVDqf37KUOM8n9lWzlcsZTbtV+wCRQ1o0CffBk=; b=J4WFYK66+vP0YYFLAKSLfdbS7r4b2GRAwNZoQysgb8MRjk3kXxI4DcytBRDrEptOQ9 UmHSjvSA3csjz+VhxIINvsgOHBzF/+1sSZCVkWzzOF0HfUbiGQNsl7ibLtlC6b5MaaN6 P/f3hkZ6+2FFEBAK52KrplDazXthpZuweiXJdHKOaZhrIT7brSuoP0Ol2Z/hZWF6ADVZ R43+QhnsHRcddxHjdfzv86XbqVSq7dyzk1s7irk8PvThdhYmrPR4syNR0TvvlfL/C50w QWPsYhNeAkgW9i8j/A8wPUqzOnX33qj8iRv9+SYB4TCbJJVMww8GGzNYu7JzSqSn9OAg kw2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718271280; x=1718876080; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=e0lygbVDqf37KUOM8n9lWzlcsZTbtV+wCRQ1o0CffBk=; b=Qx9yyfiGC8f2eA8d1ab/d4Of4aaraLiawsIwg9M2ZY91UoO4AJnH3DTKdngZs+Gv0L ZQMCcW2ygLVW4DPzTTJFnCU4pPSReDTlUwdulWukxHVvasLF6cI1QkxlI7pb1Ma+PjmQ unxTWiU9ztUk3Tl1yr4j/rwPioPtwIie43XHtocvpCMLDa+lVFZGBI2VGgBbuhl6hh0W 6eaMStkMN2C5hOeMHUx32je220K+g0JBvqEu/dlSdifJGIdtxphgpKh5EdFmODURZhIF RAAUZhP1nCInfKgUgCbtjOQz7sjm+IqAN4tTZepRs3Y8fIj6FCDtC5N8P5pQ5q6LeNnj zLkQ== X-Gm-Message-State: AOJu0Yy3vRyGWdRk72011At3JlTIcLqfynTDXoUshF/QNC/WUQQ5wO6K dAvN5yFOAzt5/xwFpYZfaetcxUbpaeLEUiT4uby/8LN0oBNJdKPqc1zo5pSYZItUs51CoVkA3Sy 9msFvrFDcHD4mVFNWjrBsFd5I80BACV3h X-Google-Smtp-Source: AGHT+IEFtGerobQsbRtrW6ZJVnfqYs/1wJftNxQ8Mt75Hqv5qxpEaQ4ICxKJKdNV4XepMztt+SSVz9yFHbAl6L0AqO8= X-Received: by 2002:a05:6512:1094:b0:52c:9b75:ac23 with SMTP id 2adb3069b0e04-52c9b75ad2fmr3605829e87.24.1718271279888; Thu, 13 Jun 2024 02:34:39 -0700 (PDT) MIME-Version: 1.0 From: Wasser Mai Date: Thu, 13 Jun 2024 11:34:27 +0200 Message-ID: Subject: multiple defects found by covscan in diffutils-3.10 To: bug-diffutils@gnu.org Content-Type: text/plain; charset="UTF-8" Received-SPF: pass client-ip=2a00:1450:4864:20::12d; envelope-from=wasser19641@gmail.com; helo=mail-lf1-x12d.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, WEIRD_QUOTING=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: -1.1 (-) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Thu, 13 Jun 2024 09:15:45 -0400 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -2.1 (--) There are multiple defects in opencryptoki-3.23.0 found by covscan. It could be that some of them are false positives. Thanks! Error: OVERRUN (CWE-119): diffutils-3.10/lib/nstrftime.c:689:17: assignment: Assigning: ""width"" = ""2147483647"". diffutils-3.10/lib/nstrftime.c:1009:11: alias: Assigning: ""bufp"" = ""buf + 23UL"". ""bufp"" now points to byte 23 of ""buf"" (which consists of 23 bytes). diffutils-3.10/lib/nstrftime.c:1019:15: ptr_decr: Decrementing ""bufp"". ""bufp"" now points to byte 22 of ""buf"" (which consists of 23 bytes). diffutils-3.10/lib/nstrftime.c:1048:17: decr: Decrementing ""width"". The value of ""width"" is now 2147483646. diffutils-3.10/lib/nstrftime.c:1051:13: assignment: Assigning: ""_w"" = ""(pad == 45 || width < 0) ? 0 : width"". The value of ""_w"" is now 2147483646. diffutils-3.10/lib/nstrftime.c:1051:13: cond_at_most: Checking ""_n < _w"" implies that ""_n"" may be up to 2147483645 on the true branch. diffutils-3.10/lib/nstrftime.c:1051:13: overrun-buffer-arg: Overrunning buffer pointed to by ""(void const *)bufp"" of 23 bytes by passing it to a function which accesses it at byte offset 2147483666 using argument ""_n"" (which evaluates to 2147483645). [Note: The source code implementation of the function has been overridden by a builtin model.] # 1049| } # 1050| # 1051|-> cpy (numlen, bufp); # 1052| } # 1053| break;" Error: UNINIT (CWE-457): diffutils-3.10/lib/time_rz.c:294:11: var_decl: Declaring variable ""tm_1"" without initializer. diffutils-3.10/lib/time_rz.c:310:15: uninit_use: Using uninitialized value ""tm_1"". Field ""tm_1.tm_gmtoff"" is uninitialized. # 308| if (revert_tz (old_tz) && ok) # 309| { # 310|-> *tm = tm_1; # 311| return t; # 312| }" Error: RESOURCE_LEAK (CWE-772): diffutils-3.10/lib/stdopen.c:51:11: open_fn: Returning handle opened by ""open"". [Note: The source code implementation of the function has been overridden by a user model.] diffutils-3.10/lib/stdopen.c:51:11: var_assign: Assigning: ""full_fd"" = handle returned from ""open(""/dev/full"", mode)"". diffutils-3.10/lib/stdopen.c:52:11: var_assign: Assigning: ""new_fd"" = ""full_fd"". diffutils-3.10/lib/stdopen.c:62:9: leaked_handle: Handle variable ""new_fd"" going out of scope leaks the handle. diffutils-3.10/lib/stdopen.c:62:9: leaked_handle: Handle variable ""full_fd"" going out of scope leaks the handle. # 60| return 0; # 61| } # 62|-> } # 63| } # 64|" Error: INTEGER_OVERFLOW (CWE-190): diffutils-3.10/lib/stackvma.c:198:23: tainted_data_return: Called function ""read(fd, rof->buffer + rof->filled, size - rof->filled)"", and a possible return value may be less than zero. diffutils-3.10/lib/stackvma.c:198:23: cast_overflow: An assign that casts to a different type, which might trigger an overflow. diffutils-3.10/lib/stackvma.c:213:23: overflow: The expression ""rof->filled"" is considered to have possibly overflowed. diffutils-3.10/lib/stackvma.c:198:23: overflow: The expression ""size - rof->filled"" is deemed overflowed because at least one of its arguments has overflowed. diffutils-3.10/lib/stackvma.c:198:23: overflow_sink: ""size - rof->filled"", which might have underflowed, is passed to ""read(fd, rof->buffer + rof->filled, size - rof->filled)"". [Note: The source code implementation of the function has been overridden by a builtin model.] # 196| for (;;) # 197| { # 198|-> n = read (fd, rof->buffer + rof->filled, size - rof->filled); # 199| if (n < 0 && errno == EINTR) # 200| goto retry;" Error: UNINIT (CWE-457): diffutils-3.10/src/sdiff.c:867:7: var_decl: Declaring variable ""cmd1"" without initializer. diffutils-3.10/src/sdiff.c:964:13: uninit_use: Using uninitialized value ""cmd1"". # 962| perror_fatal (tmpname); # 963| # 964|-> switch (cmd1) # 965| { # 966| case 'd':" Error: UNINIT (CWE-457): diffutils-3.10/lib/sigsegv.c:1460:5: var_decl: Declaring variable ""ss"" without initializer. diffutils-3.10/lib/sigsegv.c:1462:5: uninit_use_in_call: Using uninitialized value ""ss"". Field ""ss.ss_sp"" is uninitialized when calling ""sigaltstack"". # 1460| stack_t ss; # 1461| ss.ss_flags = SS_DISABLE; # 1462|-> if (sigaltstack (&ss, (stack_t *) 0) < 0) # 1463| perror (""gnulib sigsegv (stackoverflow_deinstall_handler)""); # 1464| }" Error: OVERRUN (CWE-119): diffutils-3.10/src/diff.c:426:6: strlen_assign: Setting variable ""alloc"" to the return value of strlen called with argument ""optarg"". diffutils-3.10/src/diff.c:432:6: alloc_strlen: Allocating insufficient memory for the terminating null of the string. [Note: The source code implementation of the function has been overridden by a builtin model.] # 430| &alloc)) # 431| xalloc_die (); # 432|-> char *b = xmalloc (alloc); # 433| char *base = b; # 434| int changes = 0;" Error: RESOURCE_LEAK (CWE-772): diffutils-3.10/src/diff3.c:786:3: alloc_fn: Storage is returned from allocation function ""create_diff3_block"". diffutils-3.10/src/diff3.c:786:3: var_assign: Assigning: ""result"" = storage returned from ""create_diff3_block(low[0], high[0], low[1], high[1], lowc, highc)"". diffutils-3.10/src/diff3.c:801:11: leaked_storage: Variable ""result"" going out of scope leaks the storage it points to. # 799| D_LENARRAY (result, FILEC) + result_offset, # 800| D_NUMLINES (ptr, FC))) # 801|-> return 0; # 802| } # 803|" Error: RESOURCE_LEAK (CWE-772): diffutils-3.10/src/util.c:687:3: alloc_fn: Storage is returned from allocation function ""xstrdup"". diffutils-3.10/src/util.c:687:3: var_assign: Assigning: ""color_buf"" = storage returned from ""xstrdup(p)"". diffutils-3.10/src/util.c:687:3: var_assign: Assigning: ""buf"" = ""color_buf"". diffutils-3.10/src/util.c:795:1: leaked_storage: Variable ""buf"" going out of scope leaks the storage it points to. diffutils-3.10/src/util.c:795:1: leaked_storage: Variable ""color_buf"" going out of scope leaks the storage it points to. # 793| colors_enabled = false; # 794| } # 795|-> } # 796| # 797| static void" Error: UNINIT (CWE-457): diffutils-3.10/lib/time_rz.c:294:11: var_decl: Declaring variable ""tm_1"" without initializer. diffutils-3.10/lib/time_rz.c:306:11: uninit_use_in_call: Using uninitialized value ""tm_1.tm_zone"" when calling ""save_abbr"". # 304| bool ok = 0 <= tm_1.tm_yday; # 305| #if HAVE_STRUCT_TM_TM_ZONE || HAVE_TZNAME # 306|-> ok = ok && save_abbr (tz, &tm_1); # 307| #endif # 308| if (revert_tz (old_tz) && ok)" Error: BAD_FREE (CWE-763): diffutils-3.10/src/analyze.c:692:11: offset_free: ""free"" frees address offset from ""cmp->file[f].linbuf"". # 690| { # 691| free (cmp->file[f].equivs); # 692|-> free (cmp->file[f].linbuf + cmp->file[f].linbuf_base); # 693| } # 694|" Error: OVERRUN (CWE-119): diffutils-3.10/lib/nstrftime.c:689:17: assignment: Assigning: ""width"" = ""2147483647"". diffutils-3.10/lib/nstrftime.c:885:15: assignment: Assigning: ""_w"" = ""(pad == 45 || width < 0) ? 0 : width"". The value of ""_w"" is now 2147483647. diffutils-3.10/lib/nstrftime.c:885:15: cond_between: Checking ""_n < _w"" implies that ""_n"" is between 0 and 2147483646 (inclusive) on the true branch. diffutils-3.10/lib/nstrftime.c:885:15: overrun-buffer-arg: Overrunning buffer pointed to by ""(void const *)(ubuf + 1)"" of 1024 bytes by passing it to a function which accesses it at byte offset 2147483646 using argument ""_n"" (which evaluates to 2147483646). [Note: The source code implementation of the function has been overridden by a builtin model.] # 883| len = strftime (ubuf, sizeof ubuf, ufmt, tp); # 884| if (len != 0) # 885|-> cpy (len - 1, ubuf + 1); # 886| } # 887| break;" Error: BAD_ALLOC_ARITHMETIC (CWE-131): diffutils-3.10/src/ifdef.c:364:28: bad_alloc_arithmetic: Adding an offset to the result of a call to ""__builtin_alloca"" might indicate an under-allocation. diffutils-3.10/src/ifdef.c:364:28: remediation: Did you intend for the size argument to be ""spec_prefix_len + pI_len + 2UL + 32UL - 1UL + 31UL""? # 362| size_t spec_prefix_len = f - spec - 2; # 363| size_t pI_len = sizeof pI - 1; # 364|-> char *format = xmalloca (spec_prefix_len + pI_len + 2); # 365| char *p = mempcpy (format, spec, spec_prefix_len); # 366| p = stpcpy (p, pI);" Error: UNINIT (CWE-457): diffutils-3.10/lib/diffseq.h:388:11: var_decl: Declaring variable ""bxbest"" without initializer. diffutils-3.10/lib/diffseq.h:436:15: uninit_use: Using uninitialized value ""bxbest"". # 434| else # 435| { # 436|-> part->xmid = bxbest; # 437| part->ymid = bxybest - bxbest; # 438| part->lo_minimal = false;" Error: UNINIT (CWE-457): diffutils-3.10/lib/diffseq.h:386:11: var_decl: Declaring variable ""fxbest"" without initializer. diffutils-3.10/lib/diffseq.h:429:15: uninit_use: Using uninitialized value ""fxbest"". # 427| if ((xlim + ylim) - bxybest < fxybest - (xoff + yoff)) # 428| { # 429|-> part->xmid = fxbest; # 430| part->ymid = fxybest - fxbest; # 431| part->lo_minimal = true;" Error: RESOURCE_LEAK (CWE-772): diffutils-3.10/src/diff3.c:786:3: alloc_fn: Storage is returned from allocation function ""create_diff3_block"". diffutils-3.10/src/diff3.c:786:3: var_assign: Assigning: ""result"" = storage returned from ""create_diff3_block(low[0], high[0], low[1], high[1], lowc, highc)"". diffutils-3.10/src/diff3.c:830:13: leaked_storage: Variable ""result"" going out of scope leaks the storage it points to. # 828| D_LENARRAY (result, FILE0 + d) + result_offset, # 829| D_NUMLINES (ptr, FO))) # 830|-> return 0; # 831| # 832| /* Catch the lines between here and the next diff */" From debbugs-submit-bounces@debbugs.gnu.org Thu Jun 13 20:13:27 2024 Received: (at 71535-done) by debbugs.gnu.org; 14 Jun 2024 00:13:27 +0000 Received: from localhost ([127.0.0.1]:39432 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sHuZK-0004J6-Nd for submit@debbugs.gnu.org; Thu, 13 Jun 2024 20:13:26 -0400 Received: from mail.cs.ucla.edu ([131.179.128.66]:52440) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sHuZJ-0004Iu-Bc for 71535-done@debbugs.gnu.org; Thu, 13 Jun 2024 20:13:26 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id 44EDD3C005151; Thu, 13 Jun 2024 17:13:19 -0700 (PDT) Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10032) with ESMTP id GhM9mpgDfcZ0; Thu, 13 Jun 2024 17:13:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id EBF993C00515C; Thu, 13 Jun 2024 17:13:18 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.cs.ucla.edu EBF993C00515C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.ucla.edu; s=9D0B346E-2AEB-11ED-9476-E14B719DCE6C; t=1718323999; bh=duiILUjFeV93JJFS2mgNYeiBKb+WHClBf6ZN66HPhf0=; h=Message-ID:Date:MIME-Version:To:From; b=N1Arv5V5zTnlQR1htYPfhhSmGiM77/CQPNkCowgT15lTLKxSnIQ0hAVEy04UZM/jl 3VCHb4k1q/PZP340l1+wDYEGTxqu4MizMGVnGwRstfXWKmOOayZJjRSes8KhyTsKO9 BQGhW6FxhKAQc+RgtcTcYHmuPSGJJN7Y1bELv6GCq+SCn+gDXAEARwcFy0Iozklywl JD8ZoM/2/xpTGdiIHmEyYe1XQdwRDwKK/w1mLnhGgdM/KXTZlc+M4gtwg/SnLBNUA4 dN+8x9rrniSVnHfbFlSI9YdOHDiYwOS3wuIzRJy3+VshSE0kXZMKuY8ZVu5pI5W8AX EsrmGo8h413sw== X-Virus-Scanned: amavis at mail.cs.ucla.edu Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10026) with ESMTP id G-vgz9lx3acD; Thu, 13 Jun 2024 17:13:18 -0700 (PDT) Received: from [131.179.64.200] (Penguin.CS.UCLA.EDU [131.179.64.200]) by mail.cs.ucla.edu (Postfix) with ESMTPSA id CE3E63C005151; Thu, 13 Jun 2024 17:13:18 -0700 (PDT) Message-ID: Date: Thu, 13 Jun 2024 17:13:17 -0700 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [bug-diffutils] bug#71535: multiple defects found by covscan in diffutils-3.10 To: Wasser Mai References: Content-Language: en-US From: Paul Eggert Autocrypt: addr=eggert@cs.ucla.edu; keydata= xsFNBEyAcmQBEADAAyH2xoTu7ppG5D3a8FMZEon74dCvc4+q1XA2J2tBy2pwaTqfhpxxdGA9 Jj50UJ3PD4bSUEgN8tLZ0san47l5XTAFLi2456ciSl5m8sKaHlGdt9XmAAtmXqeZVIYX/UFS 96fDzf4xhEmm/y7LbYEPQdUdxu47xA5KhTYp5bltF3WYDz1Ygd7gx07Auwp7iw7eNvnoDTAl KAl8KYDZzbDNCQGEbpY3efZIvPdeI+FWQN4W+kghy+P6au6PrIIhYraeua7XDdb2LS1en3Ss mE3QjqfRqI/A2ue8JMwsvXe/WK38Ezs6x74iTaqI3AFH6ilAhDqpMnd/msSESNFt76DiO1ZK QMr9amVPknjfPmJISqdhgB1DlEdw34sROf6V8mZw0xfqT6PKE46LcFefzs0kbg4GORf8vjG2 Sf1tk5eU8MBiyN/bZ03bKNjNYMpODDQQwuP84kYLkX2wBxxMAhBxwbDVZudzxDZJ1C2VXujC OJVxq2kljBM9ETYuUGqd75AW2LXrLw6+MuIsHFAYAgRr7+KcwDgBAfwhPBYX34nSSiHlmLC+ KaHLeCLF5ZI2vKm3HEeCTtlOg7xZEONgwzL+fdKo+D6SoC8RRxJKs8a3sVfI4t6CnrQzvJbB n6gxdgCu5i29J1QCYrCYvql2UyFPAK+do99/1jOXT4m2836j1wARAQABzSBQYXVsIEVnZ2Vy dCA8ZWdnZXJ0QGNzLnVjbGEuZWR1PsLBlQQTAQgAPwIbAwYLCQgHAwIGFQgCCQoLBBYCAwEC HgECF4AWIQR+N5Kp2Kz31jO8FYjtl+kOYqp+NAUCZiLOewUJHWQLDAAKCRDtl+kOYqp+NHGE D/9Wmbk+cAaQsYLPGBvyzIjZIRzo/V2p3ZwckVA1VEQivx5azu1cs86qDoVIe45AtwmKOvdV wTQd/QeglkZR6D2YPW7UR/7emajyJZZcy+etVTDKoaw1i6/hmd/CpGjUeUSvgoPs6nYR+1lo pSXTpaGrh1W0qQHalSkOOwCHG3HtGk9Ve2AERDUYxmcn8/eZHb7xpUJEJMBBI1bx/zcw1EtB rjsQ1R1faJ/r/7LPAyV36RLvnbX69PylHKQEbJoaY9aUb2Vpm63ni3FeTA7/3jpPvaSRWHJh vPYx6Fm2Ln8pI0Yf/W2B8QMiPTnF/LnH2kvUcf9VXm+1mQJ3fBFU25HZwBhuqZ24IeKymPEt BUMQAum97Dto0jSgR2OUvX7z+twhpQEgRGBzPHYwDi4SxF5Z4Q5Y7B7a++HP9tIxG6CVFIwI 4xVaZud18bPa0YBL+cISmMgxq7h7yoVXl6u3pm9Yiv+W6Lp9QGN8Rw1VuJMOoFCYuoxG8mXO TA5b1jvlQ32gHFFhqErDAhNJRsfgrpe9Gok4Ycp+rWljbvS5Wrl0uth5MP7FbaHN2kmTZibq KXAd//IqczhDyU6qnW6ao+h4iDBDgYgRbQjmToX/vmIdEMzvPGqWXKhe/q1TYMuOO+IfP+bI fyPFH29nVN/o9c4J7myeKvv3HKSXdSVjlh2V787BTQRMgHJkARAApoXrvxP3DIfjCNOtXU/P dwMShKdX/RlSs5PfunV1wbKP8herXHrvQdFVqECaTSxmlhzbk8X0PkY9gcVaU2O49T3qsOd1 cHeF52YFGEt0LhsBeMjgNX5uZ1V76r8gyeVlFpWWb0SIwJUBHrDXexF67upeRb2vdHBjYDNe ySn+0B7gFEqvVmZu+LadudDp6kQLjatFvHQHUSGNshBnkkcaTbiI9Pst0GCc2aiznBiPPA2W QxAPlPRh3OGTsn5THADmbjqY6FEMLasVX8DSCblMvLwNeO/8SxziBidhqLpJCqdQRWHku5Xx gIkGeKOz5OLDvXHWJyafrEYjjkS6Ak6B5z6svKliClWnjHQcjlPzyoFFgKTEfcqDxCj4RY0D 0DgtFD0NfyeOidrSB/SzTe2hwryQE3rpSiqo+0cGdzh4yAHKYJ+UrXZ4p93ZhjGfKD1xlrNY DlWyW9PGmbvqFuDmiIAQf9WD/wzEfICc+F+uDDI+uYkRxUFp92ykmdhDEFg1yjYsU8iGU69a Hyvhq36z4zctvbqhRNzOWB1bVJ/dIMDvsExGcXQVDIT7sDNXv0wE3jKSKpp7NDG1oXUXL+2+ SF99Kjy753AbQSAmH617fyBNwhJWvQYg+mUvPpiGOtses9EXUI3lS4v0MEaPG43flEs1UR+1 rpFQWVHo1y1OO+sAEQEAAcLBfAQYAQgAJgIbDBYhBH43kqnYrPfWM7wViO2X6Q5iqn40BQJm Is58BQkdZAsMAAoJEO2X6Q5iqn40Q68QAJ9GubS/ej30Vc4idoZdc0IyMcL7kQJbMohF+Tyn ZE+TGn9WvzP10yLyzoI0vNlcNfP92d2MS//pFjOuANb5mwyiEYA+rDZIdS4ZZpHxCs2sxMC4 afLCf3kv4aMnTeBvb9na403dlczz9cAacvsmniSFdpb1+BzMpYbybglU5oYMGhYT2nnCRjXN 6S2nKYt4mjJeeOuxHrdeqQQdVBNYeNfTcPePeqvZ2+bD6u9yxZtaV+wxdpqglosQvjqhOYz7 h50/ZTSq70/npoCq44TzdJKttaYvlW6ziRz0g4RRAqZyoxjYXiy5qj8r8zXJuB11ApZCGuKn /usbji9RYbflAhxFeh4LMmpDVi6BrF30b73Md59K7PuEKN1NxzlWiqqQHZZ9momN0GXLPcGq 4uyfq7yVEy7wP5PMOh6oqscKklE3gFQtq0P1Ki0xqdF6Fq5LPJc+0Db2CYkVIy7Xaa/f74I3 sOfQfEeDylVXR5iDfUJEYv/0DYhOr7q5/0b1kh3M4wkrB4C5jVNHjIIj+RsAK90c3t38OhAl jiSN7Bkwy24Afy8eIu6wWzvhnsQGpZPB+IffmxT1wkTy8UxZKjUWV0C82iphVgCUUi2f9sDV Q/tNcwVWmOS+gdv9Wk6tdGeM+Ee+Qs6YG05jcSoajzF0TL07ajLcayRq2j1Os2CtQ8qu Organization: UCLA Computer Science Department In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 71535-done Cc: 71535-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Thanks. Yes, they're all false alarms with the possible exception of the stackvma.c which is a false alarm on every platform I know of but perhaps we can make it bulletproof for hypothetical platforms. If I have time I'll look into the stackvma.c thing, though that's in Gnulib. Closing the bug report for now. From debbugs-submit-bounces@debbugs.gnu.org Wed Jun 19 23:54:38 2024 Received: (at 71535) by debbugs.gnu.org; 20 Jun 2024 03:54:38 +0000 Received: from localhost ([127.0.0.1]:41861 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sK8sg-0006sx-2r for submit@debbugs.gnu.org; Wed, 19 Jun 2024 23:54:38 -0400 Received: from mail.cs.ucla.edu ([131.179.128.66]:34642) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sK8se-0006sg-4k for 71535@debbugs.gnu.org; Wed, 19 Jun 2024 23:54:37 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id 50E173C011BDA; Wed, 19 Jun 2024 20:54:26 -0700 (PDT) Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10032) with ESMTP id jbq2apKlDeTo; Wed, 19 Jun 2024 20:54:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id B658D3C01409E; Wed, 19 Jun 2024 20:54:25 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.cs.ucla.edu B658D3C01409E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.ucla.edu; s=9D0B346E-2AEB-11ED-9476-E14B719DCE6C; t=1718855665; bh=CqnIou2D90H4wbY+vgBVtaMIlA/1gBVbu6omSGMrGsI=; h=Message-ID:Date:MIME-Version:To:From; b=O9kweFIe61aCc0149dC8QVMVj9xfQKC4ohIiZJdGTeWozdYxBuNjl3wYbG1YS0PBV 7erI4CdfBxfhK0V0WaVqStZF8DRWgbYYp/1uPP+AsAXeTyTNAgki+Bq+3nZmS1FG29 RfQS3Q5ujN/IPFAarJeHYYdMQvteVo0dpbcWuiw+nHFOnz3WUb4IlP7z3zEbteSlPk N/i3UzSBEa1d4v2ec6PfZ8jVzpBNsZ3hqnBDvzT/tfGv1I77P8i8NgotiiuamdpKCh QV9Z8BK10ZoKRL2zQ+3xyjuvYxKP7Te5EVKmepmgmj7tandqhqvhyDGjWm2DeKo/b6 euh+CAhr5ml4Q== X-Virus-Scanned: amavis at mail.cs.ucla.edu Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10026) with ESMTP id e62Vbe-R6FPv; Wed, 19 Jun 2024 20:54:25 -0700 (PDT) Received: from [192.168.86.32] (unknown [24.50.15.102]) by mail.cs.ucla.edu (Postfix) with ESMTPSA id 234933C011BDA; Wed, 19 Jun 2024 20:54:25 -0700 (PDT) Content-Type: multipart/mixed; boundary="------------0a8qfw3a8mDkMS4KAetBEfi3" Message-ID: Date: Wed, 19 Jun 2024 23:54:23 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [bug-diffutils] bug#71535: multiple defects found by covscan in diffutils-3.10 To: Wasser Mai References: Content-Language: en-US From: Paul Eggert In-Reply-To: X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 71535 Cc: 71535@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) This is a multi-part message in MIME format. --------------0a8qfw3a8mDkMS4KAetBEfi3 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 6/18/24 17:33, Wasser Mai wrote: > diffutils-3.10/src/util.c:687:3: alloc_fn: Storage is returned from > allocation function ""xstrdup"". > diffutils-3.10/src/util.c:687:3: var_assign: Assigning: ""color_buf"" > = storage returned from ""xstrdup(p)"". > diffutils-3.10/src/util.c:687:3: var_assign: Assigning: ""buf"" = ""color_buf"". > diffutils-3.10/src/util.c:795:1: leaked_storage: Variable ""buf"" > going out of scope leaks the storage it points to. > diffutils-3.10/src/util.c:795:1: leaked_storage: Variable > ""color_buf"" going out of scope leaks the storage it points to. Yes I saw that too, but some of that storage might be addressed by the pointers in color_indicator; see the assignment "color_indicator[ind_no].string = buf". So that particular diagnostic is a false positive. In looking at this code in more detail, though, we should be able to pacify Coverity (and also fix a true memory leak nearby, which Coverity didn't notice) by reworking the code to not call malloc either directly or indirectly via xstrdup. I installed the attached patch to do that. None of this is a big deal, as hardly anybody uses the --color-palette option and the true memory leaks are small and rare even when --color-palette is used. --------------0a8qfw3a8mDkMS4KAetBEfi3 Content-Type: text/x-patch; charset=UTF-8; name="0001-diff-avoid-memory-leak-with-color-palette.patch" Content-Disposition: attachment; filename="0001-diff-avoid-memory-leak-with-color-palette.patch" Content-Transfer-Encoding: base64 RnJvbSBkYTBjMTVmMzgxZjU5ZTczZGZjNWU5ODQwM2NhZDg2ZmQ3MDdlZTU0IE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVjbGEuZWR1 PgpEYXRlOiBXZWQsIDE5IEp1biAyMDI0IDIzOjQxOjE5IC0wNDAwClN1YmplY3Q6IFtQQVRD SF0gZGlmZjogYXZvaWQgbWVtb3J5IGxlYWsgd2l0aCAtLWNvbG9yLXBhbGV0dGUKTUlNRS1W ZXJzaW9uOiAxLjAKQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluOyBjaGFyc2V0PVVURi04CkNv bnRlbnQtVHJhbnNmZXItRW5jb2Rpbmc6IDhiaXQKClByb2JsZW0gZm91bmQgaW5kaXJlY3Rs eSBieSBDb3Zlcml0eSwgcmVwb3J0ZWQgYnkgV2Fzc2VyIE1haQooQnVnIzcxNTM1KS4gIEFs dGhvdWdoIHRoZSBDb3Zlcml0eSByZXBvcnQgd2FzIHdyb25nLCB0aGVyZSB3YXMgYQpkaWZm ZXJlbnQgcG90ZW50aWFsIG1lbW9yeSBsZWFrIG5lYXJieS4gIEZpeCB0aGUgcHJvYmxlbSBi eQptb2RpZnlpbmcgdGhlIHN0cmluZyBpbiBwbGFjZSwgYXZvaWRpbmcgdGhlIG5lZWQgdG8g Y2FsbCBtYWxsb2MuCiogc3JjL3V0aWwuYyAoY29sb3JfZXh0X2xpc3QsIHN0cnVjdCBjb2xv cl9leHRfdHlwZSk6ClJlbW92ZS4gIE5vdCBuZWVkZWQsIGFzIHRoZSBsaXN0IHdhc27igJl0 IHVzZWQuCkFsbCB1c2VzIHJlbW92ZWQuCihnZXRfZnVua3lfc3RyaW5nKTogT21pdCBsYXN0 IGFyZ3VtZW50IG91dHB1dF9jb3VudCwgYXMgaXTigJlzCmVhc2lseSBjYWxjdWxhdGVkIGJ5 IGNhbGxlci4gIFRoaXMgbGV0cyB1cyBjYWxsIHRoaXMgZnVuY3Rpb24Kd2hlbiB3ZSBkb27i gJl0IGNhcmUgYWJvdXQgdGhlIGNvdW50LgooY29sb3JfcGFsZXR0ZSk6IE5vdyBjaGFyICos IG5vdCBjaGFyIGNvbnN0ICosIHNpbmNlIHdlCm5vdyB1cGRhdGUgdGhyb3VnaCBpdC4KKHNl dF9jb2xvcl9wYWxldHRlKTogTGlrZXdpc2UuCihwYXJzZV9kaWZmX2NvbG9yKTogUHJvY2Vz cyBjb2xvciBwYWxldHRlIGludG8gaXRzZWxmLCB0byBhdm9pZAp1bm5lY2Vzc2FyeSBtYWxs b2MgYW5kIGZyZWUgY2FsbHMuICBUaGlzIHBhY2lmaWVzIENvdmVyaXR5LCBzYXZlcwphIGJp dCBvZiBzcGFjZSBpbiB0aGUgbm9ybWFsIGNhc2UsIGFuZCBhdm9pZHMgYSBtZW1vcnkgbGVh ayBpbgpzb21lIGNhc2VzLiAgRG8gbm90IHByb2Nlc3MgdGhlIHBhbGV0dGUgdHdpY2UsIGFz IGl0cyBtZW1vcnkKaGFzIGJlZW4gbW9kaWZpZWQgYW5kIHRoaXMgZnVuY3Rpb24gaGFkIG5v IGVmZmVjdCBvbiB0aGUKY29sb3IgaW5kaWNhdG9ycyB0aGUgc2Vjb25kIHRpbWUuCi0tLQog c3JjL2RpZmYuaCB8ICAyICstCiBzcmMvdXRpbC5jIHwgODkgKysrKysrKysrKysrKysrLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiAyIGZpbGVzIGNoYW5nZWQs IDI2IGluc2VydGlvbnMoKyksIDY1IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL3NyYy9k aWZmLmggYi9zcmMvZGlmZi5oCmluZGV4IGYwNzIzZmYuLjZhOTcwNTcgMTAwNjQ0Ci0tLSBh L3NyYy9kaWZmLmgKKysrIGIvc3JjL2RpZmYuaApAQCAtNDcyLDYgKzQ3Miw2IEBAIGVudW0g Y29sb3JfY29udGV4dAogZXh0ZXJuIGJvb2wgcHJlc3VtZV9vdXRwdXRfdHR5OwogCiBleHRl cm4gdm9pZCBzZXRfY29sb3JfY29udGV4dCAoZW51bSBjb2xvcl9jb250ZXh0IGNvbG9yX2Nv bnRleHQpOwotZXh0ZXJuIHZvaWQgc2V0X2NvbG9yX3BhbGV0dGUgKGNoYXIgY29uc3QgKnBh bGV0dGUpOworZXh0ZXJuIHZvaWQgc2V0X2NvbG9yX3BhbGV0dGUgKGNoYXIgKnBhbGV0dGUp OwogCiBfR0xfSU5MSU5FX0hFQURFUl9FTkQKZGlmZiAtLWdpdCBhL3NyYy91dGlsLmMgYi9z cmMvdXRpbC5jCmluZGV4IDM4MDdiMDcuLjZjNjU5OTEgMTAwNjQ0Ci0tLSBhL3NyYy91dGls LmMKKysrIGIvc3JjL3V0aWwuYwpAQCAtNDExLDM3ICs0MTEsMjkgQEAgc3RhdGljIGNoYXIg Y29uc3QgKmN1cnJlbnRfbmFtZVsyXTsKIHN0YXRpYyBib29sIGN1cnJlbnRseV9yZWN1cnNp dmU7CiBzdGF0aWMgYm9vbCBjb2xvcnNfZW5hYmxlZDsKIAotc3RhdGljIHN0cnVjdCBjb2xv cl9leHRfdHlwZSAqY29sb3JfZXh0X2xpc3QgPSBudWxscHRyOwotCiBzdHJ1Y3QgYmluX3N0 cgogICB7CiAgICAgaWR4X3QgbGVuOwkJCS8qIE51bWJlciBvZiBieXRlcyAqLwogICAgIGNv bnN0IGNoYXIgKnN0cmluZzsJCS8qIFBvaW50ZXIgdG8gdGhlIHNhbWUgKi8KICAgfTsKIAot c3RydWN0IGNvbG9yX2V4dF90eXBlCi0gIHsKLSAgICBzdHJ1Y3QgYmluX3N0ciBleHQ7CQkv KiBUaGUgZXh0ZW5zaW9uIHdlJ3JlIGxvb2tpbmcgZm9yICovCi0gICAgc3RydWN0IGJpbl9z dHIgc2VxOwkJLyogVGhlIHNlcXVlbmNlIHRvIG91dHB1dCB3aGVuIHdlIGRvICovCi0gICAg c3RydWN0IGNvbG9yX2V4dF90eXBlICpuZXh0OwkvKiBOZXh0IGluIGxpc3QgKi8KLSAgfTsK LQogLyogUGFyc2UgYSBzdHJpbmcgYXMgcGFydCBvZiB0aGUgLS1wYWxldHRlIGFyZ3VtZW50 OyB0aGlzIG1heSBpbnZvbHZlCiAgICBkZWNvZGluZyBhbGwga2luZHMgb2YgZXNjYXBlIGNo YXJhY3RlcnMuICBJZiBlcXVhbHNfZW5kIGlzIHNldCBhbgogICAgdW5lc2NhcGVkIGVxdWFs IHNpZ24gZW5kcyB0aGUgc3RyaW5nLCBvdGhlcndpc2Ugb25seSBhIDogb3IgXDAKLSAgIGRv ZXMuICBTZXQgKk9VVFBVVF9DT1VOVCB0byB0aGUgbnVtYmVyIG9mIGJ5dGVzIG91dHB1dC4g IFJldHVybgotICAgdHJ1ZSBpZiBzdWNjZXNzZnVsLgorICAgZG9lcy4gIFJldHVybiB0cnVl IGlmIHN1Y2Nlc3NmdWwuCiAKICAgIFRoZSByZXN1bHRpbmcgc3RyaW5nIGlzICpub3QqIG51 bGwtdGVybWluYXRlZCwgYnV0IG1heSBjb250YWluCiAgICBlbWJlZGRlZCBudWxscy4KIAor ICAgKmRlc3QgYW5kICpzcmMgbWF5IHBvaW50IGludG8gdGhlIHNhbWUgc3RyaW5nLCBpbiB3 aGljaCBjYXNlICpkZXN0CisgICBtdXN0IG5vdCBleGNlZWQgKnNyYyBhbmQgdGhlIHN0cmlu ZyBpcyBtb2RpZmllZCBpbiBwbGFjZS4KKwogICAgTm90ZSB0aGF0IGJvdGggZGVzdCBhbmQg c3JjIGFyZSBjaGFyICoqOyBvbiByZXR1cm4gdGhleSBwb2ludCB0bwogICAgdGhlIGZpcnN0 IGZyZWUgYnl0ZSBhZnRlciB0aGUgYXJyYXkgYW5kIHRoZSBjaGFyYWN0ZXIgdGhhdCBlbmRl ZAogICAgdGhlIGlucHV0IHN0cmluZywgcmVzcGVjdGl2ZWx5LiAgKi8KIAogc3RhdGljIGJv b2wKLWdldF9mdW5reV9zdHJpbmcgKGNoYXIgKipkZXN0LCBjb25zdCBjaGFyICoqc3JjLCBi b29sIGVxdWFsc19lbmQsCi0gICAgICAgICAgICAgICAgICBpZHhfdCAqb3V0cHV0X2NvdW50 KQorZ2V0X2Z1bmt5X3N0cmluZyAoY2hhciAqKmRlc3QsIGNvbnN0IGNoYXIgKipzcmMsIGJv b2wgZXF1YWxzX2VuZCkKIHsKICAgZW51bSB7CiAgICAgU1RfR05ELCBTVF9CQUNLU0xBU0gs IFNUX09DVEFMLCBTVF9IRVgsIFNUX0NBUkVULCBTVF9FTkQsIFNUX0VSUk9SCkBAIC00NTAs NyArNDQyLDYgQEAgZ2V0X2Z1bmt5X3N0cmluZyAoY2hhciAqKmRlc3QsIGNvbnN0IGNoYXIg KipzcmMsIGJvb2wgZXF1YWxzX2VuZCwKICAgY2hhciBjb25zdCAqcCA9ICpzcmM7CQkvKiBX ZSBkb24ndCB3YW50IHRvIGRvdWJsZS1pbmRpcmVjdCAqLwogICBjaGFyICpxID0gKmRlc3Q7 CQkvKiB0aGUgd2hvbGUgZGFybiB0aW1lLiAgKi8KIAotICBpZHhfdCBjb3VudCA9IDA7CQkv KiBObyBjaGFyYWN0ZXJzIGNvdW50ZWQgaW4geWV0LiAgKi8KICAgY2hhciBudW0gPSAwOwkJ CS8qIEZvciBudW1lcmljYWwgY29kZXMuICAqLwogCiAgIHdoaWxlIChzdGF0ZSA8IFNUX0VO RCkKQEAgLTQ4MSw3ICs0NzIsNiBAQCBnZXRfZnVua3lfc3RyaW5nIChjaGFyICoqZGVzdCwg Y29uc3QgY2hhciAqKnNyYywgYm9vbCBlcXVhbHNfZW5kLAogICAgICAgICAgICAgICBGQUxM VEhST1VHSDsKICAgICAgICAgICAgIGRlZmF1bHQ6CiAgICAgICAgICAgICAgICoocSsrKSA9 ICoocCsrKTsKLSAgICAgICAgICAgICAgKytjb3VudDsKICAgICAgICAgICAgICAgYnJlYWs7 CiAgICAgICAgICAgICB9CiAgICAgICAgICAgYnJlYWs7CkBAIC01NDUsNyArNTM1LDYgQEAg Z2V0X2Z1bmt5X3N0cmluZyAoY2hhciAqKmRlc3QsIGNvbnN0IGNoYXIgKipzcmMsIGJvb2wg ZXF1YWxzX2VuZCwKICAgICAgICAgICBpZiAoc3RhdGUgPT0gU1RfQkFDS1NMQVNIKQogICAg ICAgICAgICAgewogICAgICAgICAgICAgICAqKHErKykgPSBudW07Ci0gICAgICAgICAgICAg ICsrY291bnQ7CiAgICAgICAgICAgICAgIHN0YXRlID0gU1RfR05EOwogICAgICAgICAgICAg fQogICAgICAgICAgICsrcDsKQEAgLTU1NSw3ICs1NDQsNiBAQCBnZXRfZnVua3lfc3RyaW5n IChjaGFyICoqZGVzdCwgY29uc3QgY2hhciAqKnNyYywgYm9vbCBlcXVhbHNfZW5kLAogICAg ICAgICAgIGlmICgqcCA8ICcwJyB8fCAqcCA+ICc3JykKICAgICAgICAgICAgIHsKICAgICAg ICAgICAgICAgKihxKyspID0gbnVtOwotICAgICAgICAgICAgICArK2NvdW50OwogICAgICAg ICAgICAgICBzdGF0ZSA9IFNUX0dORDsKICAgICAgICAgICAgIH0KICAgICAgICAgICBlbHNl CkBAIC01OTUsNyArNTgzLDYgQEAgZ2V0X2Z1bmt5X3N0cmluZyAoY2hhciAqKmRlc3QsIGNv bnN0IGNoYXIgKipzcmMsIGJvb2wgZXF1YWxzX2VuZCwKICAgICAgICAgICAgICAgYnJlYWs7 CiAgICAgICAgICAgICBkZWZhdWx0OgogICAgICAgICAgICAgICAqKHErKykgPSBudW07Ci0g ICAgICAgICAgICAgICsrY291bnQ7CiAgICAgICAgICAgICAgIHN0YXRlID0gU1RfR05EOwog ICAgICAgICAgICAgICBicmVhazsKICAgICAgICAgICAgIH0KQEAgLTYwNiwxMiArNTkzLDEw IEBAIGdldF9mdW5reV9zdHJpbmcgKGNoYXIgKipkZXN0LCBjb25zdCBjaGFyICoqc3JjLCBi b29sIGVxdWFsc19lbmQsCiAgICAgICAgICAgaWYgKCpwID49ICdAJyAmJiAqcCA8PSAnficp CiAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICoocSsrKSA9ICoocCsrKSAmIDAzNzsK LSAgICAgICAgICAgICAgKytjb3VudDsKICAgICAgICAgICAgIH0KICAgICAgICAgICBlbHNl IGlmICgqcCA9PSAnPycpCiAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICoocSsrKSA9 IDEyNzsKLSAgICAgICAgICAgICAgKytjb3VudDsKICAgICAgICAgICAgIH0KICAgICAgICAg ICBlbHNlCiAgICAgICAgICAgICBzdGF0ZSA9IFNUX0VSUk9SOwpAQCAtNjI0LDcgKzYwOSw2 IEBAIGdldF9mdW5reV9zdHJpbmcgKGNoYXIgKipkZXN0LCBjb25zdCBjaGFyICoqc3JjLCBi b29sIGVxdWFsc19lbmQsCiAKICAgKmRlc3QgPSBxOwogICAqc3JjID0gcDsKLSAgKm91dHB1 dF9jb3VudCA9IGNvdW50OwogCiAgIHJldHVybiBzdGF0ZSAhPSBTVF9FUlJPUjsKIH0KQEAg LTY1OSwxMCArNjQzLDEyIEBAIHN0YXRpYyBjb25zdCBjaGFyICpjb25zdCBpbmRpY2F0b3Jf bmFtZVtdID0KICAgfTsKIEFSR01BVENIX1ZFUklGWSAoaW5kaWNhdG9yX25hbWUsIGNvbG9y X2luZGljYXRvcik7CiAKLXN0YXRpYyBjaGFyIGNvbnN0ICpjb2xvcl9wYWxldHRlOworc3Rh dGljIGNoYXIgKmNvbG9yX3BhbGV0dGU7CiAKKy8qIFNldCB0aGUgY29sb3IgcGFsZXR0ZSB0 byBQQUxFVFRFLCBhIHN0cmluZyB0aGF0IHNldF9jb2xvcl9jb250ZXh0CisgICBjYW4gbW9k aWZ5IGxhdGVyLiAgKi8KIHZvaWQKLXNldF9jb2xvcl9wYWxldHRlIChjaGFyIGNvbnN0ICpw YWxldHRlKQorc2V0X2NvbG9yX3BhbGV0dGUgKGNoYXIgKnBhbGV0dGUpCiB7CiAgIGNvbG9y X3BhbGV0dGUgPSBwYWxldHRlOwogfQpAQCAtNjcwLDE5ICs2NTYsMTYgQEAgc2V0X2NvbG9y X3BhbGV0dGUgKGNoYXIgY29uc3QgKnBhbGV0dGUpCiBzdGF0aWMgdm9pZAogcGFyc2VfZGlm Zl9jb2xvciAodm9pZCkKIHsKLSAgY2hhciBjb25zdCAqcCA9IGNvbG9yX3BhbGV0dGU7Cisg IC8qIFByb2Nlc3MgY29sb3JfcGFsZXR0ZSBpbnRvIGl0c2VsZi4gIFRoaXMgc2F2ZXMgYSBi aXQgb2YgbWVtb3J5LAorICAgICBhbmQgcGFjaWZpZXMgQ292ZXJpdHkuICBUaGUgb3V0cHV0 IGlzIG5vIGxhcmdlciB0aGFuIHRoZSBpbnB1dC4gICovCisgIGNoYXIgKmJ1ZiA9IGNvbG9y X3BhbGV0dGU7CisgIGNoYXIgY29uc3QgKnAgPSBidWY7CiAgIGlmIChwID09IG51bGxwdHIg fHwgKnAgPT0gJ1wwJykKICAgICByZXR1cm47CisgIC8qIERvIG5vdCBwcm9jZXNzIHRoZSBj b2xvciBwYWxldHRlIHR3aWNlLiAgKi8KKyAgY29sb3JfcGFsZXR0ZSA9IG51bGxwdHI7CiAK ICAgY2hhciBsYWJlbFtdID0gIj8/IjsJCS8qIEluZGljYXRvciBsYWJlbCAqLwotICBzdHJ1 Y3QgY29sb3JfZXh0X3R5cGUgKmV4dCA9IG51bGxwdHI7CS8qIEV4dGVuc2lvbiB3ZSBhcmUg d29ya2luZyBvbiAqLwotCi0gIC8qIFRoaXMgaXMgYW4gb3Zlcmx5IGNvbnNlcnZhdGl2ZSBl c3RpbWF0ZSwgYnV0IGFueSBwb3NzaWJsZQotICAgICAtLXBhbGV0dGUgc3RyaW5nIHdpbGwg Km5vdCogZ2VuZXJhdGUgYSBjb2xvcl9idWYgbG9uZ2VyIHRoYW4KLSAgICAgaXRzZWxmLCBz byBpdCBpcyBhIHNhZmUgd2F5IG9mIGFsbG9jYXRpbmcgYSBidWZmZXIgaW4KLSAgICAgYWR2 YW5jZS4gICovCi0gIGNoYXIgKmNvbG9yX2J1ZiA9IHhzdHJkdXAgKHApOwotICBjaGFyICpi dWYgPSBjb2xvcl9idWY7CiAKICAgZW51bSBwYXJzZV9zdGF0ZSBzdGF0ZSA9IFBTX1NUQVJU OwogICB3aGlsZSAodHJ1ZSkKQEAgLTY5NywyMCArNjgwLDggQEAgcGFyc2VfZGlmZl9jb2xv ciAodm9pZCkKICAgICAgICAgICAgICAgYnJlYWs7CiAKICAgICAgICAgICAgIGNhc2UgJyon OgotICAgICAgICAgICAgICAvKiBBbGxvY2F0ZSBuZXcgZXh0ZW5zaW9uIGJsb2NrIGFuZCBh ZGQgdG8gaGVhZCBvZgotICAgICAgICAgICAgICAgICBsaW5rZWQgbGlzdCAodGhpcyB3YXkg YSBsYXRlciBkZWZpbml0aW9uIHdpbGwKLSAgICAgICAgICAgICAgICAgb3ZlcnJpZGUgYW4g ZWFybGllciBvbmUsIHdoaWNoIGNhbiBiZSB1c2VmdWwgZm9yCi0gICAgICAgICAgICAgICAg IGhhdmluZyB0ZXJtaW5hbC1zcGVjaWZpYyBkZWZzIG92ZXJyaWRlIGdsb2JhbCkuICAqLwot Ci0gICAgICAgICAgICAgIGV4dCA9IHhtYWxsb2MgKHNpemVvZiAqZXh0KTsKLSAgICAgICAg ICAgICAgZXh0LT5uZXh0ID0gY29sb3JfZXh0X2xpc3Q7Ci0gICAgICAgICAgICAgIGNvbG9y X2V4dF9saXN0ID0gZXh0OwotCiAgICAgICAgICAgICAgICsrcDsKLSAgICAgICAgICAgICAg ZXh0LT5leHQuc3RyaW5nID0gYnVmOwotCi0gICAgICAgICAgICAgIHN0YXRlID0gKGdldF9m dW5reV9zdHJpbmcgKCZidWYsICZwLCB0cnVlLCAmZXh0LT5leHQubGVuKQotICAgICAgICAg ICAgICAgICAgICAgICA/IFBTXzQgOiBQU19GQUlMKTsKKwkgICAgICBzdGF0ZSA9IGdldF9m dW5reV9zdHJpbmcgKCZidWYsICZwLCB0cnVlKSA/IFBTXzQgOiBQU19GQUlMOwogICAgICAg ICAgICAgICBicmVhazsKIAogICAgICAgICAgICAgY2FzZSAnXDAnOgpAQCAtNzQyLDEwICs3 MTMsMTMgQEAgcGFyc2VfZGlmZl9jb2xvciAodm9pZCkKICAgICAgICAgICAgICAgICB7CiAg ICAgICAgICAgICAgICAgICBpZiAoU1RSRVEgKGxhYmVsLCBpbmRpY2F0b3JfbmFtZVtpbmRf bm9dKSkKICAgICAgICAgICAgICAgICAgICAgewotICAgICAgICAgICAgICAgICAgICAgIGNv bG9yX2luZGljYXRvcltpbmRfbm9dLnN0cmluZyA9IGJ1ZjsKLSAgICAgICAgICAgICAgICAg ICAgICBzdGF0ZSA9IChnZXRfZnVua3lfc3RyaW5nICgmYnVmLCAmcCwgZmFsc2UsCi0gICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJmNvbG9yX2lu ZGljYXRvcltpbmRfbm9dLmxlbikKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA/ IFBTX1NUQVJUIDogUFNfRkFJTCk7CisJCSAgICAgIGNoYXIgKnN0ciA9IGJ1ZjsKKwkJICAg ICAgaWYgKGdldF9mdW5reV9zdHJpbmcgKCZidWYsICZwLCBmYWxzZSkpCisJCQl7CisJCQkg IGNvbG9yX2luZGljYXRvcltpbmRfbm9dLnN0cmluZyA9IHN0cjsKKwkJCSAgY29sb3JfaW5k aWNhdG9yW2luZF9ub10ubGVuID0gYnVmIC0gc3RyOworCQkJICBzdGF0ZSA9IFBTX1NUQVJU OworCQkJfQogICAgICAgICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgICAg ICAgICB9CiAgICAgICAgICAgICAgICAgfQpAQCAtNzU1LDE0ICs3MjksOCBAQCBwYXJzZV9k aWZmX2NvbG9yICh2b2lkKQogICAgICAgICAgIGJyZWFrOwogCiAgICAgICAgIGNhc2UgUFNf NDoJCS8qIEVxdWFsIHNpZ24gYWZ0ZXIgKi5leHQgKi8KLSAgICAgICAgICBpZiAoKihwKysp ID09ICc9JykKLSAgICAgICAgICAgIHsKLSAgICAgICAgICAgICAgZXh0LT5zZXEuc3RyaW5n ID0gYnVmOwotICAgICAgICAgICAgICBzdGF0ZSA9IChnZXRfZnVua3lfc3RyaW5nICgmYnVm LCAmcCwgZmFsc2UsICZleHQtPnNlcS5sZW4pCi0gICAgICAgICAgICAgICAgICAgICAgID8g UFNfU1RBUlQgOiBQU19GQUlMKTsKLSAgICAgICAgICAgIH0KLSAgICAgICAgICBlbHNlCi0g ICAgICAgICAgICBzdGF0ZSA9IFBTX0ZBSUw7CisJICBzdGF0ZSA9ICgqcCsrID09ICc9JyAm JiBnZXRfZnVua3lfc3RyaW5nICgmYnVmLCAmcCwgZmFsc2UpCisJCSAgID8gUFNfU1RBUlQg OiBQU19GQUlMKTsKICAgICAgICAgICBicmVhazsKIAogICAgICAgICBjYXNlIFBTX0ZBSUw6 CkBAIC03NzgsMTMgKzc0Niw2IEBAIHBhcnNlX2RpZmZfY29sb3IgKHZvaWQpCiAgICAgewog ICAgICAgZXJyb3IgKDAsIDAsCiAgICAgICAgICAgICAgXygidW5wYXJzYWJsZSB2YWx1ZSBm b3IgLS1wYWxldHRlIikpOwotICAgICAgZnJlZSAoY29sb3JfYnVmKTsKLSAgICAgIGZvciAo c3RydWN0IGNvbG9yX2V4dF90eXBlICplID0gY29sb3JfZXh0X2xpc3Q7IGUgIT0gbnVsbHB0 cjsgKQotICAgICAgICB7Ci0gICAgICAgICAgc3RydWN0IGNvbG9yX2V4dF90eXBlICpuZXh0 ID0gZS0+bmV4dDsKLSAgICAgICAgICBmcmVlIChlKTsKLSAgICAgICAgICBlID0gbmV4dDsK LSAgICAgICAgfQogICAgICAgY29sb3JzX2VuYWJsZWQgPSBmYWxzZTsKICAgICB9CiB9Ci0t IAoyLjM0LjEKCg== --------------0a8qfw3a8mDkMS4KAetBEfi3-- From debbugs-submit-bounces@debbugs.gnu.org Thu Jun 20 00:30:44 2024 Received: (at 71535-done) by debbugs.gnu.org; 20 Jun 2024 04:30:44 +0000 Received: from localhost ([127.0.0.1]:42702 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sK9Rb-0007zj-Kj for submit@debbugs.gnu.org; Thu, 20 Jun 2024 00:30:44 -0400 Received: from mail.cs.ucla.edu ([131.179.128.66]:59900) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sK9RY-0007zO-MM for 71535-done@debbugs.gnu.org; Thu, 20 Jun 2024 00:30:42 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id 3AEB93C011BDA; Wed, 19 Jun 2024 21:30:31 -0700 (PDT) Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10032) with ESMTP id c75JjabyLweJ; Wed, 19 Jun 2024 21:30:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.cs.ucla.edu (Postfix) with ESMTP id A5D193C01409E; Wed, 19 Jun 2024 21:30:30 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.10.3 mail.cs.ucla.edu A5D193C01409E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.ucla.edu; s=9D0B346E-2AEB-11ED-9476-E14B719DCE6C; t=1718857830; bh=ATKcLo+mJLOW7CcSkB/KmrW4FItTmc5Oc8g0hIPWxBo=; h=Message-ID:Date:MIME-Version:To:From; b=ByhyLjtOwUKUObqmKV1lUqqkQ9JmXEO+96oGrE4UiaGWHNaPHvkFu4VSeyK/0/Cs8 gYvKzH5BiXwTLNdxCnOkEverbRidgnAQYYphFciYTztZ1h9UktqQjASQwY2u2m+IXO 3TebPdB6sq583HNDb25+5y4qKwIPUS2RlOmmaTuhvs2gSrhNk5+NVqXm4tYY5oFxND MKX1GN10Y+sqNihzibVR2WaPgpwBF5SHFlj7DrzsxlA2B0M+PKbxOocdAj8dc/Y6vW UmI8qb3nh8CMfOjPan9frYFCboO8K2Kh7mbvLJqmMG8gwE/YTSCKsH4DIaup3yGlA3 vVlAstH4esqAQ== X-Virus-Scanned: amavis at mail.cs.ucla.edu Received: from mail.cs.ucla.edu ([127.0.0.1]) by localhost (mail.cs.ucla.edu [127.0.0.1]) (amavis, port 10026) with ESMTP id ZNcJa5TLKyJU; Wed, 19 Jun 2024 21:30:30 -0700 (PDT) Received: from [192.168.86.32] (unknown [24.50.15.102]) by mail.cs.ucla.edu (Postfix) with ESMTPSA id 2EE5B3C011BDA; Wed, 19 Jun 2024 21:30:30 -0700 (PDT) Content-Type: multipart/mixed; boundary="------------lkyc5IYJW1Ph1jVAOoTixgLn" Message-ID: <83019b8d-f8d3-45f0-9f45-bb473166bc57@cs.ucla.edu> Date: Thu, 20 Jun 2024 00:30:29 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [bug-diffutils] bug#71535: multiple defects found by covscan in diffutils-3.10 To: Wasser Mai References: Content-Language: en-US From: Paul Eggert In-Reply-To: X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 71535-done Cc: 71535-done@debbugs.gnu.org, Gnulib bug reports X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) This is a multi-part message in MIME format. --------------lkyc5IYJW1Ph1jVAOoTixgLn Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 6/13/24 05:34, Wasser Mai wrote: > Error: INTEGER_OVERFLOW (CWE-190): > diffutils-3.10/lib/stackvma.c:198:23: tainted_data_return: Called > function ""read(fd, rof->buffer + rof->filled, size - rof->filled)"", > and a possible return value may be less than zero. > diffutils-3.10/lib/stackvma.c:198:23: cast_overflow: An assign that > casts to a different type, which might trigger an overflow. > diffutils-3.10/lib/stackvma.c:213:23: overflow: The expression > ""rof->filled"" is considered to have possibly overflowed. > diffutils-3.10/lib/stackvma.c:198:23: overflow: The expression ""size > - rof->filled"" is deemed overflowed because at least one of its > arguments has overflowed. > diffutils-3.10/lib/stackvma.c:198:23: overflow_sink: ""size - > rof->filled"", which might have underflowed, is passed to ""read(fd, > rof->buffer + rof->filled, size - rof->filled)"". [Note: The source > code implementation of the function has been overridden by a builtin > model.] > # 196| for (;;) > # 197| { > # 198|-> n = read (fd, rof->buffer + > rof->filled, size - rof->filled); > # 199| if (n < 0 && errno == EINTR) > # 200| goto retry;" As near as I can make out, this was the only defect report by Coverity that was not a false alarm. I installed the attached patch into Gnulib to fix the bug, which appears to be so unlikely that it's not worth losing sleep over. Marking the diffutils bug as done since the other defect reports were false alarms. --------------lkyc5IYJW1Ph1jVAOoTixgLn Content-Type: text/x-patch; charset=UTF-8; name="0001-sigsegv-avoid-unlikely-undefined-behavior.patch" Content-Disposition: attachment; filename="0001-sigsegv-avoid-unlikely-undefined-behavior.patch" Content-Transfer-Encoding: base64 RnJvbSA0NTlkYTA2NmIzYjRmY2UyZGM2Y2RmYTA5ODQwNTA4ZDVkZTcyOWQ4IE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVjbGEuZWR1 PgpEYXRlOiBUaHUsIDIwIEp1biAyMDI0IDAwOjE5OjQyIC0wNDAwClN1YmplY3Q6IFtQQVRD SF0gc2lnc2VndjogYXZvaWQgdW5saWtlbHkgdW5kZWZpbmVkIGJlaGF2aW9yCk1JTUUtVmVy c2lvbjogMS4wCkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpbjsgY2hhcnNldD1VVEYtOApDb250 ZW50LVRyYW5zZmVyLUVuY29kaW5nOiA4Yml0CgpQcm9ibGVtIGZvdW5kIGJ5IENvdmVyaXR5 IGZvciBkaWZmdXRpbHMgYW5kIHJlcG9ydGVkIGJ5IFdhc3NlciBNYWkgaW46Cmh0dHBzOi8v YnVncy5nbnUub3JnLzcxNTM1CiogbGliL3N0YWNrdm1hLmMgKHJvZl9vcGVuKSBbX19saW51 eF9fIHx8IF9fRnJlZUJTRF9fIHx8IGV0Y106CkRvbuKAmXQgYXNzdW1lIHJlc3VsdCBvZiDi gJhyZWFk4oCZIGZpdHMgaW4gaW50LgpBdm9pZCB1bmRlZmluZWQgYmVoYXZpb3IgaWYg4oCY biArIE1JTl9MRUZUT1ZFUuKAmSB3b3VsZCBvdmVyZmxvdy4KQWxzbywgbW92ZSBhIHRlc3Qg dG8gYmUgYWZ0ZXIgYW4gKG4gPT0gMCkgdGVzdCwgdG8gaGVscCB0aGUgY29tcGlsZXIuCi0t LQogQ2hhbmdlTG9nICAgICAgfCAxMCArKysrKysrKysrCiBsaWIvc3RhY2t2bWEuYyB8IDEw ICsrKysrLS0tLS0KIDIgZmlsZXMgY2hhbmdlZCwgMTUgaW5zZXJ0aW9ucygrKSwgNSBkZWxl dGlvbnMoLSkKCmRpZmYgLS1naXQgYS9DaGFuZ2VMb2cgYi9DaGFuZ2VMb2cKaW5kZXggMWMx NTZiNzkxZS4uZWRiZjA2NzEzNiAxMDA2NDQKLS0tIGEvQ2hhbmdlTG9nCisrKyBiL0NoYW5n ZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDI0LTA2LTIwICBQYXVsIEVnZ2VydCAgPGVnZ2Vy dEByZT4KKworCXNpZ3NlZ3Y6IGF2b2lkIHVubGlrZWx5IHVuZGVmaW5lZCBiZWhhdmlvcgor CVByb2JsZW0gZm91bmQgYnkgQ292ZXJpdHkgZm9yIGRpZmZ1dGlscyBhbmQgcmVwb3J0ZWQg YnkgV2Fzc2VyIE1haSBpbjoKKwlodHRwczovL2J1Z3MuZ251Lm9yZy83MTUzNQorCSogbGli L3N0YWNrdm1hLmMgKHJvZl9vcGVuKSBbX19saW51eF9fIHx8IF9fRnJlZUJTRF9fIHx8IGV0 Y106CisJRG9u4oCZdCBhc3N1bWUgcmVzdWx0IG9mIOKAmHJlYWTigJkgZml0cyBpbiBpbnQu CisJQXZvaWQgdW5kZWZpbmVkIGJlaGF2aW9yIGlmIOKAmG4gKyBNSU5fTEVGVE9WRVLigJkg d291bGQgb3ZlcmZsb3cuCisJQWxzbywgbW92ZSBhIHRlc3QgdG8gYmUgYWZ0ZXIgYW4gKG4g PT0gMCkgdGVzdCwgdG8gaGVscCB0aGUgY29tcGlsZXIuCisKIDIwMjQtMDYtMTkgIEJydW5v IEhhaWJsZSAgPGJydW5vQGNsaXNwLm9yZz4KIAogCXZhc25wcmludGYsIHUqLWFzbnByaW50 ZiB0ZXN0czogQWRkIHRlc3Qgb2YgaHVnZSAlbHMgYXJndW1lbnRzLgpkaWZmIC0tZ2l0IGEv bGliL3N0YWNrdm1hLmMgYi9saWIvc3RhY2t2bWEuYwppbmRleCBlOTNmOTM5NTU2Li40NDI0 YzZmNThjIDEwMDY0NAotLS0gYS9saWIvc3RhY2t2bWEuYworKysgYi9saWIvc3RhY2t2bWEu YwpAQCAtMTc2LDcgKzE3Niw3IEBAIHJvZl9vcGVuIChzdHJ1Y3Qgcm9maWxlICpyb2YsIGNv bnN0IGNoYXIgKmZpbGVuYW1lKQogICAgICAgLyogQXR0ZW1wdCB0byByZWFkIHRoZSBjb250 ZW50cyBpbiBhIHNpbmdsZSBzeXN0ZW0gY2FsbC4gICovCiAgICAgICBpZiAoc2l6ZSA+IE1J Tl9MRUZUT1ZFUikKICAgICAgICAgewotICAgICAgICAgIGludCBuID0gcmVhZCAoZmQsIHJv Zi0+YnVmZmVyLCBzaXplKTsKKyAgICAgICAgICBzc2l6ZV90IG4gPSByZWFkIChmZCwgcm9m LT5idWZmZXIsIHNpemUpOwogICAgICAgICAgIGlmIChuIDwgMCAmJiBlcnJubyA9PSBFSU5U UikKICAgICAgICAgICAgIGdvdG8gcmV0cnk7CiAjIGlmIGRlZmluZWQgX19EcmFnb25GbHlf XwpAQCAtMTg2LDcgKzE4Niw3IEBAIHJvZl9vcGVuIChzdHJ1Y3Qgcm9maWxlICpyb2YsIGNv bnN0IGNoYXIgKmZpbGVuYW1lKQogICAgICAgICAgICAgICBpZiAobiA8PSAwKQogICAgICAg ICAgICAgICAgIC8qIEVtcHR5IGZpbGUuICAqLwogICAgICAgICAgICAgICAgIGdvdG8gZmFp bDE7Ci0gICAgICAgICAgICAgIGlmIChuICsgTUlOX0xFRlRPVkVSIDw9IHNpemUpCisgICAg ICAgICAgICAgIGlmIChNSU5fTEVGVE9WRVIgPD0gc2l6ZSAtIG4pCiAgICAgICAgICAgICAg ICAgewogICAgICAgICAgICAgICAgICAgLyogVGhlIGJ1ZmZlciB3YXMgc3VmZmljaWVudGx5 IGxhcmdlLiAgKi8KICAgICAgICAgICAgICAgICAgIHJvZi0+ZmlsbGVkID0gbjsKQEAgLTIw MSwxNSArMjAxLDE1IEBAIHJvZl9vcGVuIChzdHJ1Y3Qgcm9maWxlICpyb2YsIGNvbnN0IGNo YXIgKmZpbGVuYW1lKQogICAgICAgICAgICAgICAgICAgICAgIGlmIChuIDwgMCkKICAgICAg ICAgICAgICAgICAgICAgICAgIC8qIFNvbWUgZXJyb3IuICAqLwogICAgICAgICAgICAgICAg ICAgICAgICAgZ290byBmYWlsMTsKLSAgICAgICAgICAgICAgICAgICAgICBpZiAobiArIE1J Tl9MRUZUT1ZFUiA+IHNpemUgLSByb2YtPmZpbGxlZCkKLSAgICAgICAgICAgICAgICAgICAg ICAgIC8qIEFsbG9jYXRlIGEgbGFyZ2VyIGJ1ZmZlci4gICovCi0gICAgICAgICAgICAgICAg ICAgICAgICBicmVhazsKICAgICAgICAgICAgICAgICAgICAgICBpZiAobiA9PSAwKQogICAg ICAgICAgICAgICAgICAgICAgICAgewogICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBS ZWFjaGVkIHRoZSBlbmQgb2YgZmlsZS4gICovCiAgICAgICAgICAgICAgICAgICAgICAgICAg IGNsb3NlIChmZCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHVybiAwOwogICAg ICAgICAgICAgICAgICAgICAgICAgfQorICAgICAgICAgICAgICAgICAgICAgIGlmIChzaXpl IC0gcm9mLT5maWxsZWQgLSBuIDwgTUlOX0xFRlRPVkVSKQorICAgICAgICAgICAgICAgICAg ICAgICAgLyogQWxsb2NhdGUgYSBsYXJnZXIgYnVmZmVyLiAgKi8KKyAgICAgICAgICAgICAg ICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgICAgICAgICAgIHJvZi0+ZmlsbGVkICs9 IG47CiAgICAgICAgICAgICAgICAgICAgIH0KICMgZWxzZQotLSAKMi4zNC4xCgo= --------------lkyc5IYJW1Ph1jVAOoTixgLn-- From debbugs-submit-bounces@debbugs.gnu.org Thu Jun 20 02:10:19 2024 Received: (at 71535-done) by debbugs.gnu.org; 20 Jun 2024 06:10:19 +0000 Received: from localhost ([127.0.0.1]:44977 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sKAzz-0002rr-0c for submit@debbugs.gnu.org; Thu, 20 Jun 2024 02:10:19 -0400 Received: from mo4-p00-ob.smtp.rzone.de ([81.169.146.163]:46559) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1sKAzw-0002rf-2q for 71535-done@debbugs.gnu.org; Thu, 20 Jun 2024 02:10:17 -0400 ARC-Seal: i=1; a=rsa-sha256; t=1718863809; cv=none; d=strato.com; s=strato-dkim-0002; b=dDBs8ZYmK8bVtoEkqj8audKfO4cbCrB4bBYqCD66gb8c4FPkCNUH9Ou4eLvffoZ2AU 3YRczWJYXakO0N4EGdq5PHAjUqIooefE+JeLOk5vCGwuzPK9bArrKPodkgaQ9OyM5xSY DenKQw0qw/Ba9yNQz4dVqzQkAAr4IeUzNfLpW5G8Lzt7w6CvCQ6uQM0SN/FIVqoL0T6O 2bduk1LgQP+YUOVSNSVtt2nfWSTMa/9MqNP7in2YhDr0u+YrNZrd5pfbh0ZiwbmMrVei LsXQjkT6Ubxcsm307sPW+3aDqNfvcboHGTEJ/ywqye26EiAC3CX7jS+rhIwVY2Xb0yT6 KaCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; t=1718863809; s=strato-dkim-0002; d=strato.com; h=References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Cc:Date: From:Subject:Sender; bh=MPkTqw6u9gnvd7ImaGl2S6w3S6I/63vyC4WQNmUkQO0=; b=rPBv1VUkMmjMSDJjlx4xGHB925xzNz8evsE463QT3hhi7eGHC0JRSU+GpDpL1Ip/Hc jbw3KLfHS9oCCK3QBtQDQOsbtlIv2KVs3IJC2xrLzS8Wex4LzhvIACuKCPJsGB2CjTCH ukfC5fBZaeQLf4AwiSxoLTPnNbso4k3TVu0OqYwxpU79VGMyGGGXjktoF9JiU9IVCuKF he747lzYEOamvEfGR3tU1ouksq6Ru7n7BY3cXdCO4+xn4BoVQ3iI0H9yVybqv7VpnSUa E+GMI7hftWOD18TGQdC0gyvBINGf7XVyod8TSMgdmvvTiQ+P+IfcBhl8ze6roHTMVtd+ HOmA== ARC-Authentication-Results: i=1; strato.com; arc=none; dkim=none X-RZG-CLASS-ID: mo00 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1718863809; s=strato-dkim-0002; d=clisp.org; h=References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Cc:Date: From:Subject:Sender; bh=MPkTqw6u9gnvd7ImaGl2S6w3S6I/63vyC4WQNmUkQO0=; b=o0llSeFExdMMgCBKJ2dWHE7VeYNrKKcoJgOUvWUi8lRG3hin9HjkacrdOSjBaErPQN obzf/gyAhf72Lok6qDgRzrp7+CZKFh6VbX3FmfIrK/kp0ik8DWJB4GHdQwNM4VoIW02E KFmEa6u4leq1N/6Ar7wY9yA1AAcnw56c3Gj6RmfQm1+QhYdNzXNFuh6MvjiZGRbJR2QD xnuZUdvVxKDtOIbMdNobs2jVhbfgoW/RQE/o0n1SIGApQUbpTO315FyAq8fow2ZDk4ux Wt1pwy3+dzgeZRRahVDNagpVLlAqP/i0TNZgTzCEu3Yq/4N68Zk4eepf83c5e4ZtQLpU cKCg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; t=1718863809; s=strato-dkim-0003; d=clisp.org; h=References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From:Cc:Date: From:Subject:Sender; bh=MPkTqw6u9gnvd7ImaGl2S6w3S6I/63vyC4WQNmUkQO0=; b=CgWOLm35q92G+CRFxdVoDPcPp9ifMTqtwGj5A3/oQH15+t5zB/OiERfji6P9s60APp 10WaEsaisO6vIXzlWeBg== X-RZG-AUTH: ":Ln4Re0+Ic/6oZXR1YgKryK8brlshOcZlIWs+iCP5vnk6shH0WWb0LN8XZoH94zq68+3cfpOX2v1k8hvNt5sn+u0dHlHf2GunUQ==" Received: from nimes.localnet by smtp.strato.de (RZmta 50.5.0 AUTH) with ESMTPSA id N0957e05K6A8HCd (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256 bits)) (Client did not present a certificate); Thu, 20 Jun 2024 08:10:08 +0200 (CEST) From: Bruno Haible To: bug-gnulib@gnu.org, Paul Eggert Subject: Re: [bug-diffutils] bug#71535: multiple defects found by covscan in diffutils-3.10 Date: Thu, 20 Jun 2024 08:10:08 +0200 Message-ID: <31953564.gRfpFWEtPU@nimes> In-Reply-To: <83019b8d-f8d3-45f0-9f45-bb473166bc57@cs.ucla.edu> References: <83019b8d-f8d3-45f0-9f45-bb473166bc57@cs.ucla.edu> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 71535-done Cc: 71535-done@debbugs.gnu.org, Wasser Mai X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Hi Paul, > I installed the attached patch into Gnulib > to fix the bug, which appears to be so unlikely that it's not worth > losing sleep over. Thanks! I've propagated it to GNU libsigsegv. > As near as I can make out, this was the only defect report by Coverity > that was not a false alarm. Well, from my point of view, since the file being read is from the /proc file system, I assume that such synthetic files constructed by the kernel are small (in the range of < 16 KB). Anyway, if it helps avoid an alarm from static code analysis tools, the better. Bruno From unknown Sun Aug 17 09:09:28 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Thu, 18 Jul 2024 11:24:07 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator