mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tcp, tcp_splice: False "Negative array index read" positives, CWE-129

Browse source 
A flag or event bit is always set by callers. Reported by Coverity.

Signed-by-off: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2022-04-05 12:51:00 +02:00
parent 264d68edcf
commit 2a3b8dad33
2 changed files with 24 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
tcp.c
View file

@ -868,16 +868,20 @@ static void conn_flag_do(const struct ctx *c, struct tcp_conn *conn,
return;
conn->flags &= flag;
if (fls(~flag) >= 0) {
debug("TCP: index %li: %s dropped", conn - tc,
tcp_flag_str[fls(~flag)]);
}
} else {
if (conn->flags & flag)
return;
conn->flags |= flag;
if (fls(flag) >= 0) {
debug("TCP: index %li: %s", conn - tc,
tcp_flag_str[fls(flag)]);
}
}
if (flag == STALLED || flag == ~STALLED)
tcp_epoll_ctl(c, conn);

8
tcp_splice.c
View file

@ -170,16 +170,20 @@ static void conn_flag_do(const struct ctx *c, struct tcp_splice_conn *conn,
return;
conn->flags &= flag;
if (fls(~flag) >= 0) {
debug("TCP (spliced): index %li: %s dropped", conn - tc,
tcp_splice_flag_str[fls(~flag)]);
}
} else {
if (conn->flags & flag)
return;
conn->flags |= flag;
if (fls(flag) >= 0) {
debug("TCP (spliced): index %li: %s", conn - tc,
tcp_splice_flag_str[fls(flag)]);
}
}
if (flag == CLOSING)
tcp_splice_epoll_ctl(c, conn);
@ -250,16 +254,20 @@ static void conn_event_do(const struct ctx *c, struct tcp_splice_conn *conn,
return;
conn->events &= event;
if (fls(~event) >= 0) {
debug("TCP (spliced): index %li, ~%s", conn - tc,
tcp_splice_event_str[fls(~event)]);
}
} else {
if (conn->events & event)
return;
conn->events |= event;
if (fls(event) >= 0) {
debug("TCP (spliced): index %li, %s", conn - tc,
tcp_splice_event_str[fls(event)]);
}
}
if (tcp_splice_epoll_ctl(c, conn))
conn_flag(c, conn, CLOSING);