Re: [PATCH] crypto/x509-utils: Check for error from gnutls_x509_crt_init()

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Jul 10, 2025 at 03:44:17PM +0100, Peter Maydell wrote:
> Coverity notes that in qcrypto_get_x509_cert_fingerprint() we
> call gnutls_x509_crt_init() but don't check for an error return.
> Add the missing check.
> 
> Coverity: CID 1593155
> Fixes: 10a1d34fc0d ("crypto: Introduce x509 utils")
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  crypto/x509-utils.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

> diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c
> index 8bad00a51b8..39bb6d4d8c3 100644
> --- a/crypto/x509-utils.c
> +++ b/crypto/x509-utils.c
> @@ -46,7 +46,11 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
>          return -1;
>      }
>  
> -    gnutls_x509_crt_init(&crt);
> +    if (gnutls_x509_crt_init(&crt) < 0) {
> +        error_setg(errp, "Unable to initialize certificate: %s",
> +                   gnutls_strerror(ret));
> +        return -1;
> +    }
>  
>      if (gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM) != 0) {
>          error_setg(errp, "Failed to import certificate");
> -- 
> 2.43.0
> 

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|