[Tarantool-patches] Fwd: New Defects reported by Coverity Scan for tarantool/tarantool

Cyrill Gorcunov gorcunov at gmail.com
Mon Oct 5 16:18:58 MSK 2020


Hi! Here is a report for latest master 2.6.0-136-g2711797be worth to take
a look and fix/triage.

----- Forwarded message from scan-admin at coverity.com -----

> Please find the latest report on new defect(s) introduced to tarantool/tarantool found with Coverity Scan.
> 
> 150 new defect(s) introduced to tarantool/tarantool found with Coverity Scan.
> 40 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
> 
> New defect(s) Reported-by: Coverity Scan
> Showing 20 of 150 defect(s)
> 
> 
> ** CID 1497676:    (FORWARD_NULL)
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497676:    (FORWARD_NULL)
> /projects/tarantool/tarantool.git/src/box/sql/legacy.c: 160 in sql_exec()
> 154     		azCols = 0;
> 155     	}
> 156     
> 157      exec_out:
> 158     	if (pStmt)
> 159     		sqlVdbeFinalize((Vdbe *) pStmt);
> >>>     CID 1497676:    (FORWARD_NULL)
> >>>     Passing null pointer "azCols" to "sqlDbFree", which dereferences it.
> 160     	sqlDbFree(db, azCols);
> 161     
> 162     	assert(rc == 0);
> 163     	return rc;
> /projects/tarantool/tarantool.git/src/box/sql/legacy.c: 160 in sql_exec()
> 154     		azCols = 0;
> 155     	}
> 156     
> 157      exec_out:
> 158     	if (pStmt)
> 159     		sqlVdbeFinalize((Vdbe *) pStmt);
> >>>     CID 1497676:    (FORWARD_NULL)
> >>>     Passing null pointer "azCols" to "sqlDbFree", which dereferences it.
> 160     	sqlDbFree(db, azCols);
> 161     
> 162     	assert(rc == 0);
> 163     	return rc;
> /projects/tarantool/tarantool.git/src/box/sql/legacy.c: 160 in sql_exec()
> 154     		azCols = 0;
> 155     	}
> 156     
> 157      exec_out:
> 158     	if (pStmt)
> 159     		sqlVdbeFinalize((Vdbe *) pStmt);
> >>>     CID 1497676:    (FORWARD_NULL)
> >>>     Passing null pointer "azCols" to "sqlDbFree", which dereferences it.
> 160     	sqlDbFree(db, azCols);
> 161     
> 162     	assert(rc == 0);
> 163     	return rc;
> /projects/tarantool/tarantool.git/src/box/sql/legacy.c: 153 in sql_exec()
> 147     				while (sqlIsspace(zSql[0]))
> 148     					zSql++;
> 149     				break;
> 150     			}
> 151     		}
> 152     
> >>>     CID 1497676:    (FORWARD_NULL)
> >>>     Passing null pointer "azCols" to "sqlDbFree", which dereferences it.
> 153     		sqlDbFree(db, azCols);
> 154     		azCols = 0;
> 155     	}
> 156     
> 157      exec_out:
> 158     	if (pStmt)
> 
> ** CID 1497675:  Security best practices violations  (TOCTOU)
> /projects/tarantool/tarantool.git/src/box/func.c: 291 in module_load()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497675:  Security best practices violations  (TOCTOU)
> /projects/tarantool/tarantool.git/src/box/func.c: 291 in module_load()
> 285     	if (rc < 0 || (size_t) rc >= sizeof(dir_name)) {
> 286     		diag_set(SystemError, "failed to generate path to DSO");
> 287     		goto error;
> 288     	}
> 289     
> 290     	struct stat st;
> >>>     CID 1497675:  Security best practices violations  (TOCTOU)
> >>>     Calling function "stat" to perform check on "path".
> 291     	if (stat(path, &st) < 0) {
> 292     		diag_set(SystemError, "failed to stat() module %s", path);
> 293     		goto error;
> 294     	}
> 295     
> 296     	int source_fd = open(path, O_RDONLY);
> 
> ** CID 1497674:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/vinyl.c: 4034 in vy_build_recover_stmt()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497674:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/vinyl.c: 4034 in vy_build_recover_stmt()
> 4028     		if (insert == NULL)
> 4029     			return -1;
> 4030     	} else if (type == IPROTO_UPSERT) {
> 4031     		struct tuple *new_tuple = vy_apply_upsert(mem_stmt, old_tuple,
> 4032     							  pk->cmp_def, true);
> 4033     		if (new_tuple == NULL)
> >>>     CID 1497674:  Resource leaks  (RESOURCE_LEAK)
> >>>     Variable "delete" going out of scope leaks the storage it points to.
> 4034     			return -1;
> 4035     		uint32_t data_len;
> 4036     		const char *data = tuple_data_range(new_tuple, &data_len);
> 4037     		insert = vy_stmt_new_insert(lsm->mem_format,
> 4038     					    data, data + data_len);
> 4039     		tuple_unref(new_tuple);
> 
> ** CID 1497673:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/test/unit/ratelimit.c: 70 in main()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497673:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/test/unit/ratelimit.c: 70 in main()
> 64     	for (int i = 0; i < count; i++) {
> 65     		if (ratelimit_check(&rl, now, &suppressed))
> 66     			emitted++;
> 67     		now += interval_count * interval / count;
> 68     	}
> 69     	now += interval;
> >>>     CID 1497673:  Error handling issues  (CHECKED_RETURN)
> >>>     Calling "ratelimit_check" without checking return value (as is done elsewhere 9 out of 10 times).
> 70     	ratelimit_check(&rl, now, &suppressed);
> 71     	check(interval_count * burst, count - interval_count * burst);
> 72     
> 73     	check_plan();
> 74     	footer();
> 75     
> 76     	return 0;
> 
> ** CID 1497672:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/key_def.c: 212 in key_def_set_part_path()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497672:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/key_def.c: 212 in key_def_set_part_path()
> 206     
> 207     	/* Skip JSON_TOKEN_ANY token. */
> 208     	struct json_lexer lexer;
> 209     	struct json_token token;
> 210     	json_lexer_create(&lexer, path + multikey_path_len,
> 211     			  path_len - multikey_path_len, TUPLE_INDEX_BASE);
> >>>     CID 1497672:  Error handling issues  (CHECKED_RETURN)
> >>>     Calling "json_lexer_next_token" without checking return value (as is done elsewhere 41 out of 48 times).
> 212     	json_lexer_next_token(&lexer, &token);
> 213     	assert(token.type == JSON_TOKEN_ANY);
> 214     
> 215     	/* The rest of JSON path couldn't be multikey. */
> 216     	int multikey_path_suffix_len =
> 217     		path_len - multikey_path_len - lexer.offset;
> 
> ** CID 1497671:  Memory - illegal accesses  (OVERRUN)
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497671:  Memory - illegal accesses  (OVERRUN)
> /third_party/luajit/src/lj_api.c: 529 in lua_hashstring()
> 523     {
> 524       TValue *o = index2adr(L, idx);
> 525       lua_assert(tvisstr(o));
> 526       GCstr *s = strV(o);
> 527       if (! strsmart(s))
> 528         return s->hash;
> >>>     CID 1497671:  Memory - illegal accesses  (OVERRUN)
> >>>     Overrunning array of 16 bytes at byte offset 16 by dereferencing pointer "(char const *)(s + 1)".
> 529       return lua_hash(strdata(s), s->len);
> 530     }
> 531     
> 532     LUALIB_API const char *luaL_checklstring(lua_State *L, int idx, size_t *len)
> 533     {
> 534       TValue *o = index2adr(L, idx);
> 
> ** CID 1497670:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/sql/select.c: 2342 in sql_multiselect_orderby_to_key_info()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497670:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/sql/select.c: 2342 in sql_multiselect_orderby_to_key_info()
> 2336     		uint32_t id;
> 2337     		bool unused;
> 2338     		if ((term->flags & EP_Collate) != 0) {
> 2339     			struct coll *unused_coll;
> 2340     			if (sql_expr_coll(parse, term, &unused, &id,
> 2341     					  &unused_coll) != 0)
> >>>     CID 1497670:  Resource leaks  (RESOURCE_LEAK)
> >>>     Variable "key_info" going out of scope leaks the storage it points to.
> 2342     				return 0;
> 2343     		} else {
> 2344     			id = multi_select_coll_seq(parse, s,
> 2345     						   item->u.x.iOrderByCol - 1);
> 2346     			if (id != COLL_NONE) {
> 2347     				const char *name = coll_by_id(id)->name;
> 
> ** CID 1497669:    (CONSTANT_EXPRESSION_RESULT)
> /projects/tarantool/tarantool.git/src/box/sql/vdbe.c: 4323 in sqlVdbeExec()
> /projects/tarantool/tarantool.git/src/box/sql/vdbe.c: 4326 in sqlVdbeExec()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497669:    (CONSTANT_EXPRESSION_RESULT)
> /projects/tarantool/tarantool.git/src/box/sql/vdbe.c: 4323 in sqlVdbeExec()
> 4317     	assert(pOp->opcode!=OP_NextIfOpen || pOp->p4.xAdvance == sqlCursorNext);
> 4318     	assert(pOp->opcode!=OP_PrevIfOpen || pOp->p4.xAdvance == sqlCursorPrevious);
> 4319     
> 4320     	/* The Next opcode is only used after SeekGT, SeekGE, and Rewind.
> 4321     	 * The Prev opcode is only used after SeekLT, SeekLE, and Last.
> 4322     	 */
> >>>     CID 1497669:    (CONSTANT_EXPRESSION_RESULT)
> >>>     The "or" condition "pOp->opcode != 8 || pOp->opcode != 3 || pC->seekOp == 40 || pC->seekOp == 39 || pC->seekOp == 48 || pC->seekOp == 43" will always be true because "pOp->opcode" cannot be equal to two different values at the same time, so it must be not equal to at least one of them.
> 4323     	assert(pOp->opcode!=OP_Next || pOp->opcode!=OP_NextIfOpen
> 4324     	       || pC->seekOp==OP_SeekGT || pC->seekOp==OP_SeekGE
> 4325     	       || pC->seekOp==OP_Rewind || pC->seekOp==OP_Found);
> 4326     	assert(pOp->opcode!=OP_Prev || pOp->opcode!=OP_PrevIfOpen
> 4327     	       || pC->seekOp==OP_SeekLT || pC->seekOp==OP_SeekLE
> 4328     	       || pC->seekOp==OP_Last);
> /projects/tarantool/tarantool.git/src/box/sql/vdbe.c: 4326 in sqlVdbeExec()
> 4320     	/* The Next opcode is only used after SeekGT, SeekGE, and Rewind.
> 4321     	 * The Prev opcode is only used after SeekLT, SeekLE, and Last.
> 4322     	 */
> 4323     	assert(pOp->opcode!=OP_Next || pOp->opcode!=OP_NextIfOpen
> 4324     	       || pC->seekOp==OP_SeekGT || pC->seekOp==OP_SeekGE
> 4325     	       || pC->seekOp==OP_Rewind || pC->seekOp==OP_Found);
> >>>     CID 1497669:    (CONSTANT_EXPRESSION_RESULT)
> >>>     The "or" condition "pOp->opcode != 4 || pOp->opcode != 2 || pC->seekOp == 37 || pC->seekOp == 38 || pC->seekOp == 44" will always be true because "pOp->opcode" cannot be equal to two different values at the same time, so it must be not equal to at least one of them.
> 4326     	assert(pOp->opcode!=OP_Prev || pOp->opcode!=OP_PrevIfOpen
> 4327     	       || pC->seekOp==OP_SeekLT || pC->seekOp==OP_SeekLE
> 4328     	       || pC->seekOp==OP_Last);
> 4329     
> 4330     	if (pOp->p4.xAdvance(pC->uc.pCursor, &res) != 0)
> 4331     		goto abort_due_to_error;
> 
> ** CID 1497668:  API usage errors  (PRINTF_ARGS)
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497668:  API usage errors  (PRINTF_ARGS)
> /projects/tarantool/tarantool.git/src/box/memtx_rtree.c: 402 in memtx_rtree_index_new()
> 396     	assert(def->key_def->part_count == 1);
> 397     	assert(def->key_def->parts[0].type == FIELD_TYPE_ARRAY);
> 398     	assert(def->opts.is_unique == false);
> 399     
> 400     	if (def->opts.dimension < 1 ||
> 401     	    def->opts.dimension > RTREE_MAX_DIMENSION) {
> >>>     CID 1497668:  API usage errors  (PRINTF_ARGS)
> >>>     Argument "def->opts.dimension" to format specifier "%lld" was expected to have type "long long" but has type "long".
> 402     		diag_set(UnsupportedIndexFeature, def,
> 403     			 tt_sprintf("dimension (%lld): must belong to "
> 404     				    "range [%u, %u]", def->opts.dimension,
> 405     				    1, RTREE_MAX_DIMENSION));
> 406     		return NULL;
> 407     	}
> 
> ** CID 1497667:  API usage errors  (PRINTF_ARGS)
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497667:  API usage errors  (PRINTF_ARGS)
> /projects/tarantool/tarantool.git/extra/lemon.c: 2661 in parseonetoken()
> 2655             }
> 2656           }
> 2657           break;
> 2658         case WAITING_FOR_CLASS_ID:
> 2659           if( !ISLOWER(x[0]) ){
> 2660             ErrorMsg(psp->filename, psp->tokenlineno,
> >>>     CID 1497667:  API usage errors  (PRINTF_ARGS)
> >>>     This argument was not used by the format string: "x".
> 2661               "%%token_class must be followed by an identifier: ", x);
> 2662             psp->errorcnt++;
> 2663             psp->state = RESYNC_AFTER_DECL_ERROR;
> 2664          }else if( Symbol_find(x) ){
> 2665             ErrorMsg(psp->filename, psp->tokenlineno,
> 2666               "Symbol \"%s\" already used", x);
> 
> ** CID 1497666:  Integer handling issues  (BAD_SHIFT)
> /projects/tarantool/tarantool.git/src/box/iproto_constants.h: 174 in iproto_dml_body_has_key()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497666:  Integer handling issues  (BAD_SHIFT)
> /projects/tarantool/tarantool.git/src/box/iproto_constants.h: 174 in iproto_dml_body_has_key()
> 168     }
> 169     
> 170     static inline bool
> 171     iproto_dml_body_has_key(const char *pos, const char *end)
> 172     {
> 173     	unsigned char key = pos < end ? *pos : (unsigned char) IPROTO_KEY_MAX;
> >>>     CID 1497666:  Integer handling issues  (BAD_SHIFT)
> >>>     In expression "1ULL << key", left shifting by more than 63 bits has undefined behavior.  The shift amount, "key", is as much as 82.
> 174     	return key < IPROTO_KEY_MAX && IPROTO_DML_BODY_BMAP & (1ULL<<key);
> 175     }
> 176     
> 177     #undef bit
> 178     
> 179     static inline uint64_t
> 
> ** CID 1497665:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/vy_lsm.c: 1217 in vy_lsm_split_range()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497665:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/src/box/vy_lsm.c: 1217 in vy_lsm_split_range()
> 1211     		 vy_range_str(range), tuple_str(split_key.stmt));
> 1212     
> 1213     	rlist_foreach_entry(slice, &range->slices, in_range)
> 1214     		vy_slice_wait_pinned(slice);
> 1215     	vy_range_delete(range);
> 1216     	tuple_unref(split_key.stmt);
> >>>     CID 1497665:  Resource leaks  (RESOURCE_LEAK)
> >>>     Variable "new_slice" going out of scope leaks the storage it points to.
> 1217     	return true;
> 1218     fail:
> 1219     	for (int i = 0; i < n_parts; i++) {
> 1220     		if (parts[i] != NULL)
> 1221     			vy_range_delete(parts[i]);
> 1222     	}
> 
> ** CID 1497664:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/test/unit/sio.c: 110 in check_auto_bind()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497664:  Resource leaks  (RESOURCE_LEAK)
> /projects/tarantool/tarantool.git/test/unit/sio.c: 110 in check_auto_bind()
> 104     	is(sio_getsockname(fd, (struct sockaddr *) &addr, &addrlen), 0,
> 105     	   "getsockname works on 0 bind");
> 106     	isnt(addr.sin_port, 0, "a real port is returned");
> 107     
> 108     	check_plan();
> 109     	footer();
> >>>     CID 1497664:  Resource leaks  (RESOURCE_LEAK)
> >>>     Handle variable "fd" going out of scope leaks the handle.
> 110     }
> 111     
> 112     int
> 113     main(void)
> 114     {
> 115     	memory_init();
> 
> ** CID 1497663:  Memory - corruptions  (OVERLAPPING_COPY)
> /projects/tarantool/tarantool.git/src/box/sql/vdbemem.c: 601 in vdbe_mem_numerify()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497663:  Memory - corruptions  (OVERLAPPING_COPY)
> /projects/tarantool/tarantool.git/src/box/sql/vdbemem.c: 601 in vdbe_mem_numerify()
> 595     int
> 596     vdbe_mem_numerify(struct Mem *mem)
> 597     {
> 598     	if ((mem->flags & (MEM_Int | MEM_UInt | MEM_Real | MEM_Null)) != 0)
> 599     		return 0;
> 600     	if ((mem->flags & MEM_Bool) != 0) {
> >>>     CID 1497663:  Memory - corruptions  (OVERLAPPING_COPY)
> >>>     Assigning "mem->u.b" to "mem->u.u", which have overlapping memory locations and different types.
> 601     		mem->u.u = mem->u.b;
> 602     		MemSetTypeFlag(mem, MEM_UInt);
> 603     		return 0;
> 604     	}
> 605     	assert((mem->flags & (MEM_Blob | MEM_Str)) != 0);
> 606     	bool is_neg;
> 
> ** CID 1497662:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/sql/vdbeapi.c: 533 in createAggContext()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497662:  Error handling issues  (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/sql/vdbeapi.c: 533 in createAggContext()
> 527     	Mem *pMem = p->pMem;
> 528     	assert((pMem->flags & MEM_Agg) == 0);
> 529     	if (nByte <= 0) {
> 530     		sqlVdbeMemSetNull(pMem);
> 531     		pMem->z = 0;
> 532     	} else {
> >>>     CID 1497662:  Error handling issues  (CHECKED_RETURN)
> >>>     Calling "sqlVdbeMemClearAndResize" without checking return value (as is done elsewhere 8 out of 9 times).
> 533     		sqlVdbeMemClearAndResize(pMem, nByte);
> 534     		pMem->flags = MEM_Agg;
> 535     		pMem->u.func = p->func;
> 536     		if (pMem->z) {
> 537     			memset(pMem->z, 0, nByte);
> 538     		}
> 
> ** CID 1497661:  Null pointer dereferences  (FORWARD_NULL)
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497661:  Null pointer dereferences  (FORWARD_NULL)
> /projects/tarantool/tarantool.git/src/box/sql/build.c: 2057 in sql_create_foreign_key()
> 2051     	}
> 2052     
> 2053     exit_create_fk:
> 2054     	sql_expr_list_delete(db, child_cols);
> 2055     	if (!is_self_referenced)
> 2056     		sql_expr_list_delete(db, parent_cols);
> >>>     CID 1497661:  Null pointer dereferences  (FORWARD_NULL)
> >>>     Passing null pointer "parent_name" to "sqlDbFree", which dereferences it.
> 2057     	sqlDbFree(db, parent_name);
> 2058     	sqlDbFree(db, constraint_name);
> 2059     	return;
> 2060     tnt_error:
> 2061     	parse_context->is_aborted = true;
> 2062     	goto exit_create_fk;
> 
> ** CID 1497660:  Memory - corruptions  (USE_AFTER_FREE)
> /projects/tarantool/tarantool.git/src/box/sql/func.c: 1624 in replaceFunc()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497660:  Memory - corruptions  (USE_AFTER_FREE)
> /projects/tarantool/tarantool.git/src/box/sql/func.c: 1624 in replaceFunc()
> 1618     				return;
> 1619     			}
> 1620     			zOld = zOut;
> 1621     			zOut = sql_realloc64(zOut, (int)nOut);
> 1622     			if (zOut == 0) {
> 1623     				context->is_aborted = true;
> >>>     CID 1497660:  Memory - corruptions  (USE_AFTER_FREE)
> >>>     Calling "sql_free" frees pointer "zOld" which has already been freed.
> 1624     				sql_free(zOld);
> 1625     				return;
> 1626     			}
> 1627     			memcpy(&zOut[j], zRep, nRep);
> 1628     			j += nRep;
> 1629     			i += nPattern - 1;
> 
> ** CID 1497659:  Null pointer dereferences  (REVERSE_INULL)
> /projects/tarantool/tarantool.git/src/box/vy_write_iterator.c: 964 in vy_read_view_merge()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497659:  Null pointer dereferences  (REVERSE_INULL)
> /projects/tarantool/tarantool.git/src/box/vy_write_iterator.c: 964 in vy_read_view_merge()
> 958     		 */
> 959     		struct tuple *copy = vy_stmt_dup(rv->entry.stmt);
> 960     		if (is_first_insert)
> 961     			vy_stmt_set_type(copy, IPROTO_INSERT);
> 962     		else
> 963     			vy_stmt_set_type(copy, IPROTO_REPLACE);
> >>>     CID 1497659:  Null pointer dereferences  (REVERSE_INULL)
> >>>     Null-checking "copy" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
> 964     		if (copy == NULL)
> 965     			return -1;
> 966     		vy_stmt_set_lsn(copy, vy_stmt_lsn(rv->entry.stmt));
> 967     		vy_stmt_unref_if_possible(rv->entry.stmt);
> 968     		rv->entry.stmt = copy;
> 969     	}
> 
> ** CID 1497658:  Security best practices violations  (TOCTOU)
> /projects/tarantool/tarantool.git/src/box/wal.c: 480 in wal_open()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497658:  Security best practices violations  (TOCTOU)
> /projects/tarantool/tarantool.git/src/box/wal.c: 480 in wal_open()
> 474      */
> 475     static int
> 476     wal_open(struct wal_writer *writer)
> 477     {
> 478     	const char *path = xdir_format_filename(&writer->wal_dir,
> 479     				vclock_sum(&writer->vclock), NONE);
> >>>     CID 1497658:  Security best practices violations  (TOCTOU)
> >>>     Calling function "access" to perform check on "path".
> 480     	if (access(path, F_OK) != 0) {
> 481     		if (errno == ENOENT) {
> 482     			/* No WAL, nothing to do. */
> 483     			return 0;
> 484     		}
> 485     		diag_set(SystemError, "failed to access %s", path);
> 
> ** CID 1497657:    (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/xrow.c: 630 in xrow_decode_sql()
> /projects/tarantool/tarantool.git/src/box/xrow.c: 629 in xrow_decode_sql()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1497657:    (CHECKED_RETURN)
> /projects/tarantool/tarantool.git/src/box/xrow.c: 630 in xrow_decode_sql()
> 624     	request->stmt_id = NULL;
> 625     	for (uint32_t i = 0; i < map_size; ++i) {
> 626     		uint8_t key = *data;
> 627     		if (key != IPROTO_SQL_BIND && key != IPROTO_SQL_TEXT &&
> 628     		    key != IPROTO_STMT_ID) {
> 629     			mp_check(&data, end);   /* skip the key */
> >>>     CID 1497657:    (CHECKED_RETURN)
> >>>     Calling "mp_check" without checking return value (as is done elsewhere 206 out of 208 times).
> 630     			mp_check(&data, end);   /* skip the value */
> 631     			continue;
> 632     		}
> 633     		const char *value = ++data;     /* skip the key */
> 634     		if (mp_check(&data, end) != 0)  /* check the value */
> 635     			goto error;
> /projects/tarantool/tarantool.git/src/box/xrow.c: 629 in xrow_decode_sql()
> 623     	request->bind = NULL;
> 624     	request->stmt_id = NULL;
> 625     	for (uint32_t i = 0; i < map_size; ++i) {
> 626     		uint8_t key = *data;
> 627     		if (key != IPROTO_SQL_BIND && key != IPROTO_SQL_TEXT &&
> 628     		    key != IPROTO_STMT_ID) {
> >>>     CID 1497657:    (CHECKED_RETURN)
> >>>     Calling "mp_check" without checking return value (as is done elsewhere 206 out of 208 times).
> 629     			mp_check(&data, end);   /* skip the key */
> 630     			mp_check(&data, end);   /* skip the value */
> 631     			continue;
> 632     		}
> 633     		const char *value = ++data;     /* skip the key */
> 634     		if (mp_check(&data, end) != 0)  /* check the value */
> 
> 
----- End forwarded message -----


More information about the Tarantool-patches mailing list