Hi Peter,
How to see the full coverity report? In
https://gitlab.com/qemu-project/qemu/-/artifacts, I see only job.log
Do you expect to fix these errors for the 9.1 release?
Best Regards,
Konstantin Kostiuk.
On Thu, Jul 25, 2024 at 1:12 PM Peter Maydell <peter.mayd...@linaro.org>
wrote:
> On Tue, 23 Jul 2024 at 08:03, Konstantin Kostiuk <kkost...@redhat.com>
> wrote:
> >
> > From: Dehan Meng <dem...@redhat.com>
> >
> > The Route information of the Linux VM needs to be used
> > by administrators and users when debugging network problems
> > and troubleshooting.
> >
> > Signed-off-by: Dehan Meng <dem...@redhat.com>
> > Reviewed-by: Konstantin Kostiuk <kkost...@redhat.com>
> > Message-ID: <20240613092802.346246-2-dem...@redhat.com>
> > Signed-off-by: Konstantin Kostiuk <kkost...@redhat.com>
>
> Hi; Coverity points out some potential issues with this commit:
>
> > +static char *hexToIPAddress(const void *hexValue, int is_ipv6)
> > +{
> > + if (is_ipv6) {
> > + char addr[INET6_ADDRSTRLEN];
> > + struct in6_addr in6;
> > + const char *hexStr = (const char *)hexValue;
> > + int i;
> > +
> > + for (i = 0; i < 16; i++) {
> > + sscanf(&hexStr[i * 2], "%02hhx", &in6.s6_addr[i]);
>
> We don't check the sscanf() return value here. (CID 1558558)
>
> > + }
> > + inet_ntop(AF_INET6, &in6, addr, INET6_ADDRSTRLEN);
> > +
> > + return g_strdup(addr);
> > + } else {
> > + unsigned int hexInt = *(unsigned int *)hexValue;
> > + unsigned int byte1 = (hexInt >> 24) & 0xFF;
> > + unsigned int byte2 = (hexInt >> 16) & 0xFF;
> > + unsigned int byte3 = (hexInt >> 8) & 0xFF;
> > + unsigned int byte4 = hexInt & 0xFF;
> > +
> > + return g_strdup_printf("%u.%u.%u.%u", byte4, byte3, byte2,
> byte1);
> > + }
> > +}
> > +
> > +GuestNetworkRouteList *qmp_guest_network_get_route(Error **errp)
> > +{
> > + GuestNetworkRouteList *head = NULL, **tail = &head;
> > + const char *routeFiles[] = {"/proc/net/route",
> "/proc/net/ipv6_route"};
> > + FILE *fp;
> > + size_t n;
> > + char *line = NULL;
> > + int firstLine;
> > + int is_ipv6;
> > + int i;
>
> The handling of the getline() buffer in this function doesn't
> seem to be correct (CID 1558559).
>
> Firstly, the manpage says that to get the initial "allocate me
> a buffer", line must be NULL and also n must be 0, but we don't
> initialize n here.
>
> > + for (i = 0; i < 2; i++) {
> > + firstLine = 1;
> > + is_ipv6 = (i == 1);
> > + fp = fopen(routeFiles[i], "r");
> > + if (fp == NULL) {
> > + error_setg_errno(errp, errno, "open(\"%s\")",
> routeFiles[i]);
> > + free(line);
>
> Here we free() line, but we continue the for() loop. So next
> time around the loop (assuming the second fopen succeeds)
> we'll pass line to getline() and it will be a non-NULL
> pointer to freed memory.
>
> Is this error case supposed to exit the for() loop entirely
> instead of continuing?
>
> Either way, it shouldn't free(line) here I think.
>
> > + continue;
> > + }
> > +
> > + while (getline(&line, &n, fp) != -1) {
> > + if (firstLine && !is_ipv6) {
> > + firstLine = 0;
> > + continue;
> > + }
> > + GuestNetworkRoute *route = NULL;
> > + GuestNetworkRoute *networkroute;
> > + char Iface[IFNAMSIZ];
>
> Our coding style says you shouldn't declare variables in the
> middle of a block. Coding style also says variable names are
> lowercase with underscores, not CamelCase. (CamelCase is for
> typenames.)
>
> > + if (is_ipv6) {
> > + char Destination[33], Source[33], NextHop[33];
> > + int DesPrefixlen, SrcPrefixlen, Metric, RefCnt, Use,
> Flags;
> > +
> > + /* Parse the line and extract the values */
> > + if (sscanf(line, "%32s %x %32s %x %32s %x %x %x %x %s",
> > + Destination, &DesPrefixlen, Source,
> > + &SrcPrefixlen, NextHop, &Metric, &RefCnt,
> > + &Use, &Flags, Iface) != 10) {
> > + continue;
> > + }
> > +
> > + route = g_new0(GuestNetworkRoute, 1);
> > + networkroute = route;
>
> Why do we have separate "route" and "networkroute" variables
> here? As far as I can see they are identical and can be merged.
>
> > + networkroute->iface = g_strdup(Iface);
> > + networkroute->destination = hexToIPAddress(Destination,
> 1);
> > + networkroute->metric = Metric;
> > + networkroute->source = hexToIPAddress(Source, 1);
> > + networkroute->desprefixlen = g_strdup_printf(
> > + "%d", DesPrefixlen
> > + );
> > + networkroute->srcprefixlen = g_strdup_printf(
> > + "%d", SrcPrefixlen
> > + );
> > + networkroute->nexthop = hexToIPAddress(NextHop, 1);
> > + networkroute->has_flags = true;
> > + networkroute->flags = Flags;
> > + networkroute->has_refcnt = true;
> > + networkroute->refcnt = RefCnt;
> > + networkroute->has_use = true;
> > + networkroute->use = Use;
> > + networkroute->version = 6;
> > + } else {
> > + unsigned int Destination, Gateway, Mask, Flags;
> > + int RefCnt, Use, Metric, MTU, Window, IRTT;
> > +
> > + /* Parse the line and extract the values */
> > + if (sscanf(line, "%s %X %X %x %d %d %d %X %d %d %d",
> > + Iface, &Destination, &Gateway, &Flags,
> &RefCnt,
> > + &Use, &Metric, &Mask, &MTU, &Window, &IRTT)
> != 11) {
> > + continue;
> > + }
> > +
> > + route = g_new0(GuestNetworkRoute, 1);
> > + networkroute = route;
> > + networkroute->iface = g_strdup(Iface);
> > + networkroute->destination =
> hexToIPAddress(&Destination, 0);
> > + networkroute->gateway = hexToIPAddress(&Gateway, 0);
> > + networkroute->mask = hexToIPAddress(&Mask, 0);
> > + networkroute->metric = Metric;
> > + networkroute->has_flags = true;
> > + networkroute->flags = Flags;
> > + networkroute->has_refcnt = true;
> > + networkroute->refcnt = RefCnt;
> > + networkroute->has_use = true;
> > + networkroute->use = Use;
> > + networkroute->has_mtu = true;
> > + networkroute->mtu = MTU;
> > + networkroute->has_window = true;
> > + networkroute->window = Window;
> > + networkroute->has_irtt = true;
> > + networkroute->irtt = IRTT;
> > + networkroute->version = 4;
> > + }
> > +
> > + QAPI_LIST_APPEND(tail, route);
> > + }
> > +
> > + free(line);
>
> Similarly here we free(line) but next time around the for()
> loop we'll pass it to getline anyway.
>
> > + fclose(fp);
> > + }
>
> Since getline() will reallocate the buffer as needed, we don't
> need to free it anywhere except right before we exit the
> function, here.
>
> > +
> > + return head;
> > +}
>
> thanks
> -- PMM
>
>
