Skip to content

Commit 66b9256

Browse files
embhornembhorn
committed
Fixes from CodeSonar report
1 parent 3ca444e commit 66b9256

File tree

17 files changed

+77
-26
lines changed

17 files changed

+77
-26
lines changed

‎src/internal.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14178,8 +14178,10 @@ int SetupStoreCtxCallback(WOLFSSL_X509_STORE_CTX** store_pt,
1417814178
if (store != NULL)
1417914179
wolfSSL_X509_STORE_CTX_free(store);
1418014180
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
14181-
if (x509 != NULL)
14181+
if (x509 != NULL) {
1418214182
wolfSSL_X509_free(x509);
14183+
x509 = NULL;
14184+
}
1418314185
#endif
1418414186
XFREE(domain, heap, DYNAMIC_TYPE_STRING);
1418514187
return MEMORY_E;
@@ -14605,6 +14607,7 @@ int LoadCertByIssuer(WOLFSSL_X509_STORE* store, X509_NAME* issuer, int type)
1460514607
if (x509 != NULL) {
1460614608
ret = wolfSSL_X509_STORE_add_cert(store, x509);
1460714609
wolfSSL_X509_free(x509);
14610+
x509 = NULL;
1460814611
} else {
1460914612
WOLFSSL_MSG("failed to load certificate");
1461014613
ret = WOLFSSL_FAILURE;
@@ -31661,6 +31664,7 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
3166131664
return CLIENT_CERT_CB_ERROR;
3166231665
}
3166331666
wolfSSL_X509_free(x509);
31667+
x509 = NULL;
3166431668
wolfSSL_EVP_PKEY_free(pkey);
3166531669

3166631670
}

‎src/keys.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,9 @@ int GetCipherSpec(word16 side, byte cipherSuite0, byte cipherSuite,
124124
}
125125
#endif /* NO_WOLFSSL_CLIENT */
126126

127+
/* Initialize specs */
128+
XMEMSET(specs, 0, sizeof(CipherSpecs));
129+
127130
/* Chacha extensions, 0xcc */
128131
if (cipherSuite0 == CHACHA_BYTE) {
129132

‎src/pk.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -731,7 +731,7 @@ static int wolfssl_print_indent(WOLFSSL_BIO* bio, char* line, int lineLen,
731731
if (indent > 0) {
732732
/* Print indent spaces. */
733733
int len_wanted = XSNPRINTF(line, (size_t)lineLen, "%*s", indent, " ");
734-
if (len_wanted >= lineLen) {
734+
if ((len_wanted < 0) || (len_wanted >= lineLen)) {
735735
WOLFSSL_ERROR_MSG("Buffer overflow formatting indentation");
736736
ret = 0;
737737
}
@@ -16173,6 +16173,11 @@ static int pem_write_data(const char *name, const char *header,
1617316173
*pemOut = pem;
1617416174
*pemOutLen = (word32)((size_t)p - (size_t)pem);
1617516175
}
16176+
else {
16177+
/* Dispose of any allocated memory. */
16178+
XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
16179+
pem = NULL;
16180+
}
1617616181

1617716182
return ret;
1617816183
}

‎src/ssl.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1006,7 +1006,7 @@ int GetEchConfigsEx(WOLFSSL_EchConfig* configs, byte* output, word32* outputLen)
10061006
word32 totalLen = 2;
10071007
word32 workingOutputLen;
10081008

1009-
if (configs == NULL || outputLen == NULL)
1009+
if (configs == NULL || outputLen == NULL || *outputLen < totalLen)
10101010
return BAD_FUNC_ARG;
10111011

10121012
workingOutputLen = *outputLen - totalLen;
@@ -12511,6 +12511,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
1251112511
err = WOLFSSL_SUCCESS;
1251212512
cleanup:
1251312513
wolfSSL_X509_free(cert);
12514+
cert = NULL;
1251412515
wolfSSL_BIO_free(bio);
1251512516
if (err != WOLFSSL_SUCCESS) {
1251612517
/* We failed so return NULL */
@@ -14520,6 +14521,7 @@ static int PushCAx509Chain(WOLFSSL_CERT_MANAGER* cm,
1452014521
break;
1452114522
if (wolfSSL_sk_X509_push(sk, issuer) <= 0) {
1452214523
wolfSSL_X509_free(issuer);
14524+
issuer = NULL;
1452314525
return WOLFSSL_FATAL_ERROR;
1452414526
}
1452514527
x = issuer;
@@ -14565,6 +14567,7 @@ static WOLF_STACK_OF(WOLFSSL_X509)* CreatePeerCertChain(const WOLFSSL* ssl,
1456514567
if (err != 0) {
1456614568
WOLFSSL_MSG("Error decoding cert");
1456714569
wolfSSL_X509_free(x509);
14570+
x509 = NULL;
1456814571
wolfSSL_sk_X509_pop_free(sk, NULL);
1456914572
return NULL;
1457014573
}
@@ -21159,6 +21162,7 @@ long wolfSSL_CTX_ctrl(WOLFSSL_CTX* ctx, int cmd, long opt, void* pt)
2115921162
WOLFSSL_MSG("Error adding certificate to context");
2116021163
/* Decrease reference count on failure */
2116121164
wolfSSL_X509_free(x509);
21165+
x509 = NULL;
2116221166
}
2116321167
}
2116421168
}
@@ -22993,7 +22997,7 @@ int wolfSSL_sk_WOLFSSL_STRING_num(WOLF_STACK_OF(WOLFSSL_STRING)* strings)
2299322997
void wolfSSL_get0_alpn_selected(const WOLFSSL *ssl, const unsigned char **data,
2299422998
unsigned int *len)
2299522999
{
22996-
word16 nameLen;
23000+
word16 nameLen = 0;
2299723001

2299823002
if (ssl != NULL && data != NULL && len != NULL) {
2299923003
TLSX_ALPN_GetRequest(ssl->extensions, (void **)data, &nameLen);

‎src/ssl_certman.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,7 @@ WOLFSSL_STACK* wolfSSL_CertManagerGetCerts(WOLFSSL_CERT_MANAGER* cm)
397397
/* Decode certificate. */
398398
if ((!err) && (wolfSSL_sk_X509_push(sk, x509) <= 0)) {
399399
wolfSSL_X509_free(x509);
400+
x509 = NULL;
400401
err = 1;
401402
}
402403
}

‎src/ssl_load.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4839,6 +4839,7 @@ long wolfSSL_CTX_add_extra_chain_cert(WOLFSSL_CTX* ctx, WOLFSSL_X509* x509)
48394839
if (ret == 1) {
48404840
/* On success WOLFSSL_X509 memory is responsibility of SSL context. */
48414841
wolfSSL_X509_free(x509);
4842+
x509 = NULL;
48424843
}
48434844

48444845
WOLFSSL_LEAVE("wolfSSL_CTX_add_extra_chain_cert", ret);
@@ -4932,6 +4933,7 @@ int wolfSSL_CTX_add0_chain_cert(WOLFSSL_CTX* ctx, WOLFSSL_X509* x509)
49324933
if (ret == 1) {
49334934
/* Down reference or free original now as we own certificate. */
49344935
wolfSSL_X509_free(x509);
4936+
x509 = NULL;
49354937
}
49364938

49374939
return ret;
@@ -4990,6 +4992,7 @@ int wolfSSL_CTX_add1_chain_cert(WOLFSSL_CTX* ctx, WOLFSSL_X509* x509)
49904992
if (ret != 1) {
49914993
/* Decrease reference count on error as we didn't store it. */
49924994
wolfSSL_X509_free(x509);
4995+
x509 = NULL;
49934996
}
49944997
}
49954998

@@ -5053,6 +5056,7 @@ int wolfSSL_add0_chain_cert(WOLFSSL* ssl, WOLFSSL_X509* x509)
50535056
if (ret != 1) {
50545057
/* Free it now on error. */
50555058
wolfSSL_X509_free(x509);
5059+
x509 = NULL;
50565060
}
50575061
}
50585062
}
@@ -5085,6 +5089,7 @@ int wolfSSL_add1_chain_cert(WOLFSSL* ssl, WOLFSSL_X509* x509)
50855089
if ((ret = wolfSSL_add0_chain_cert(ssl, x509)) != 1) {
50865090
/* Decrease reference count on error as not stored. */
50875091
wolfSSL_X509_free(x509);
5092+
x509 = NULL;
50885093
}
50895094
}
50905095

‎src/ssl_p7p12.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,7 @@ WOLFSSL_STACK* wolfSSL_PKCS7_to_stack(PKCS7* pkcs7)
227227
if (x509) {
228228
if (wolfSSL_sk_X509_push(ret, x509) <= 0) {
229229
wolfSSL_X509_free(x509);
230+
x509 = NULL;
230231
WOLFSSL_MSG("wolfSSL_sk_X509_push error");
231232
goto error;
232233
}
@@ -1176,6 +1177,8 @@ PKCS7* wolfSSL_SMIME_read_PKCS7(WOLFSSL_BIO* in,
11761177
DYNAMIC_TYPE_PKCS7);
11771178
if (canonSection == NULL) {
11781179
goto error;
1180+
} else {
1181+
XMEMSET(canonSection, 0, (word32)canonSize);
11791182
}
11801183

11811184
lineLen = wolfSSL_BIO_gets(in, section, remainLen);
@@ -1908,12 +1911,14 @@ int wolfSSL_PKCS12_parse(WC_PKCS12* pkcs12, const char* psw,
19081911
WOLFSSL_MSG("Issue with parsing certificate");
19091912
FreeDecodedCert(DeCert);
19101913
wolfSSL_X509_free(x509);
1914+
x509 = NULL;
19111915
}
19121916
else {
19131917
if (CopyDecodedToX509(x509, DeCert) != 0) {
19141918
WOLFSSL_MSG("Failed to copy decoded cert");
19151919
FreeDecodedCert(DeCert);
19161920
wolfSSL_X509_free(x509);
1921+
x509 = NULL;
19171922
wolfSSL_sk_X509_pop_free(*ca, NULL); *ca = NULL;
19181923
XFREE(pk, heap, DYNAMIC_TYPE_PUBLIC_KEY);
19191924
XFREE(certData, heap, DYNAMIC_TYPE_PKCS);
@@ -1933,6 +1938,7 @@ int wolfSSL_PKCS12_parse(WC_PKCS12* pkcs12, const char* psw,
19331938
if (wolfSSL_sk_X509_push(*ca, x509) <= 0) {
19341939
WOLFSSL_MSG("Failed to push x509 onto stack");
19351940
wolfSSL_X509_free(x509);
1941+
x509 = NULL;
19361942
wolfSSL_sk_X509_pop_free(*ca, NULL); *ca = NULL;
19371943
XFREE(pk, heap, DYNAMIC_TYPE_PUBLIC_KEY);
19381944
XFREE(certData, heap, DYNAMIC_TYPE_PKCS);

‎src/ssl_sess.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1452,6 +1452,7 @@ int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
14521452
#if defined(SESSION_CERTS) && defined(OPENSSL_EXTRA)
14531453
if (peer != NULL) {
14541454
wolfSSL_X509_free(peer);
1455+
peer = NULL;
14551456
}
14561457
#endif
14571458

‎src/tls13.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8692,6 +8692,7 @@ static int SendTls13Certificate(WOLFSSL* ssl)
86928692
ssl->options.sendVerify = SEND_CERT;
86938693
}
86948694
wolfSSL_X509_free(x509);
8695+
x509 = NULL;
86958696
wolfSSL_EVP_PKEY_free(pkey);
86968697
}
86978698
}

‎src/x509.c‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3599,9 +3599,8 @@ char* wolfSSL_X509_get_name_oneline(WOLFSSL_X509_NAME* name, char* in, int sz)
35993599
WOLFSSL_MSG("Memory error");
36003600
return NULL;
36013601
}
3602-
if ((strLen = XSNPRINTF(str, (size_t)strSz, "%s=%s, ", sn, buf))
3603-
>= strSz)
3604-
{
3602+
strLen = XSNPRINTF(str, (size_t)strSz, "%s=%s, ", sn, buf);
3603+
if ((strLen < 0) || (strLen >= strSz)) {
36053604
WOLFSSL_MSG("buffer overrun");
36063605
XFREE(str, NULL, DYNAMIC_TYPE_TMP_BUFFER);
36073606
return NULL;
@@ -3617,8 +3616,8 @@ char* wolfSSL_X509_get_name_oneline(WOLFSSL_X509_NAME* name, char* in, int sz)
36173616
WOLFSSL_MSG("Memory error");
36183617
return NULL;
36193618
}
3620-
if ((strLen = XSNPRINTF(str, (size_t)strSz, "%s=%s", sn,
3621-
buf)) >= strSz) {
3619+
strLen = XSNPRINTF(str, (size_t)strSz, "%s=%s", sn, buf);
3620+
if ((strLen < 0) || (strLen >= strSz)) {
36223621
WOLFSSL_MSG("buffer overrun");
36233622
XFREE(str, NULL, DYNAMIC_TYPE_TMP_BUFFER);
36243623
return NULL;
@@ -6971,7 +6970,7 @@ static int X509PrintPubKey(WOLFSSL_BIO* bio, WOLFSSL_X509* x509, int indent)
69716970
case ECDSAk:
69726971
len = XSNPRINTF(scratch, MAX_WIDTH,
69736972
"%*sPublic Key Algorithm: EC\n", indent + 4, "");
6974-
if (len >= MAX_WIDTH)
6973+
if ((len < 0) || (len >= MAX_WIDTH))
69756974
return WOLFSSL_FAILURE;
69766975
if (wolfSSL_BIO_write(bio, scratch, len) <= 0)
69776976
return WOLFSSL_FAILURE;
@@ -7033,22 +7032,21 @@ static int X509PrintVersion(WOLFSSL_BIO* bio, int version, int indent)
70337032
char scratch[MAX_WIDTH];
70347033
int scratchLen;
70357034

7036-
if ((scratchLen = XSNPRINTF(scratch, MAX_WIDTH,
7037-
"%*s%s", indent, "", "Version:"))
7038-
>= MAX_WIDTH)
7039-
{
7035+
scratchLen = XSNPRINTF(scratch, MAX_WIDTH, "%*s%s", indent, "", "Version:");
7036+
if ((scratchLen < 0) || (scratchLen >= MAX_WIDTH)) {
70407037
return WOLFSSL_FAILURE;
70417038
}
7039+
70427040
if (wolfSSL_BIO_write(bio, scratch, scratchLen) <= 0) {
70437041
return WOLFSSL_FAILURE;
70447042
}
70457043

7046-
if ((scratchLen = XSNPRINTF(scratch, MAX_WIDTH,
7047-
" %d (0x%x)\n", version, (byte)version-1))
7048-
>= MAX_WIDTH)
7049-
{
7044+
scratchLen = XSNPRINTF(scratch, MAX_WIDTH, " %d (0x%x)\n",
7045+
version, (byte)version-1);
7046+
if ((scratchLen < 0) || (scratchLen >= MAX_WIDTH)) {
70507047
return WOLFSSL_FAILURE;
70517048
}
7049+
70527050
if (wolfSSL_BIO_write(bio, scratch, scratchLen) <= 0) {
70537051
return WOLFSSL_FAILURE;
70547052
}
@@ -8064,6 +8062,7 @@ int wc_GeneratePreTBS(DecodedCert* cert, byte *der, int derSz) {
80648062

80658063
if (x != NULL) {
80668064
wolfSSL_X509_free(x);
8065+
x = NULL;
80678066
}
80688067

80698068
return ret;

0 commit comments

Comments
 (0)