Possible bugs in nfs-utils

[Michael Halcrow <mhalcrow@us.ibm.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2600 bytes --]

I ran nfs-utils through the Coverity source code scanner, and the
following items were flagged that I thought might merit a second
glance (source from util-linux-2.13-pre7.tar.bz2). Those with a more
intimate knowledge of the code base can probably help out in
determining whether some of these really are problematic:

---
support/nfs/svc_socket.c::svc_socket():

If ret == 0 and rpcp == NULL, then servp is checked for non-NULL
status before it is initialized.
---

---
utils/rquotad/rquota_server.c::getquotainfo():

qfpathname may be leaked.
---

---
utils/statd/notlist.c::nlist_new():

new may be leaked here:
        if (!(NL_MY_NAME(new) = xstrdup(my_name))
                        || !(NL_MON_NAME(new) = xstrdup(mon_name)))
                return NULL;
---

---
tools/rpcgen/rpc_parse.c::get_definition():

defp may be leaked on tok.kind == TOK_EOF.
---

---
utils/idmapd/cfg.c::conf_get_tag_list():

node may be leaked here:
        if (!node->field)
          goto cleanup;
...
 cleanup:
  if (list)
    conf_free_list (list);
  return 0;

Same issue in conf_get_list().
---

---
support/misc/mountpoint.c::is_mountpoint():

No check for NULL result from malloc here:
        dotdot = malloc(strlen(path)+4);
        strcat(strcpy(dotdot, path), "/..");

dotdot not freed prior to return.
---

---
utils/idmapd/cfg.c::conf_remove():

Dereference NULL pointer:
  node = conf_trans_node (transaction, CONF_REMOVE);
  if (!node)
    goto fail;
...
 fail:
  if (node->section)
    free (node->section);
---

---
tools/rpcgen/rpc_parse.c::def_const():

Dead code here:
    flag=0;
    if(peekscan(TOK_CASE,&tok))
      {

        do
          {
            scan2(TOK_IDENT, TOK_CHARCONST, &tok);
            cases->contflag=1;  /* continued case statement */
            *tailp = cases;
            tailp = &cases->next;
            cases = ALLOC(case_list);
            cases->case_name = tok.str;
            scan(TOK_COLON, &tok);

          }while(peekscan(TOK_CASE,&tok));
      }
    else
      if(flag)
        {

          *tailp = cases;
          tailp = &cases->next;
          cases = ALLOC(case_list);
        };

It looks like flag will always be 0 at the if(flag) check.
---

---
utils/idmapd/idmapd.c::mydaemon():

tempfd not checked (not likely to be a problem for /dev/null, but just
in case):
                tempfd = open("/dev/null", O_RDWR);
                dup2(tempfd, 0);
---

---
support/nfs/cacheio.c::cache_flush():

Return value not checked:
stat(_PATH_ETAB, &stb);
---

---
tools/rpcgen/rpc_scan.c::docppline():

Return without freeing storage.
---

Thanks,
Mike

[-- Attachment #1.2: Digital signature --]
[-- Type: application/pgp-signature, Size: 481 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



[-- Attachment #3: Type: text/plain, Size: 140 bytes --]

_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs