]> www.infradead.org Git - users/dwmw2/openconnect.git/commitdiff
Remove repeated flexible array member which is confusing Coverity
authorDaniel Lenski <dlenski@gmail.com>
Thu, 17 Feb 2022 16:34:17 +0000 (08:34 -0800)
committerDaniel Lenski <dlenski@gmail.com>
Thu, 17 Feb 2022 19:37:26 +0000 (11:37 -0800)
A recent Coverity Scan run is complaining about buffer overruns
when accessing the `esp` header member of `struct pkt`:

> CID 379245:  Memory - corruptions  (OVERRUN)
> Overrunning struct type <unnamed> of 24 bytes by passing it to a function which accesses it at byte offset 25 using argument "len" (which evaluates to 26).

The unnecessary and duplicated `esp.payload` member of `struct pkt` appears
to be the source of confusion:

    struct pkt {
            int alloc_len;
            int len;
            struct pkt *next;
            union {
                    struct {
                            uint32_t spi;
                            uint32_t seq;
                            unsigned char iv[16];
                            unsigned char payload[];
                    } esp;
                    /* ...
                     * other protocols' packet headers
                     * ...
                     */

            };
            unsigned char data[];
    };

It's a flexible array member (`payload[]`), within a union, within a struct
that has another flexible array member (`data[]`); for how these are
supposed to work, see https://en.wikipedia.org/wiki/Flexible_array_member.

The `payload` member is both unused and unnecessary. Let's just remove it.

Signed-off-by: Daniel Lenski <dlenski@gmail.com>
openconnect-internal.h

index b3fd398d213ddd41c49040e79b9f3dede7801cc8..fb046efa7488f30606448d36ebee660cf2e15d9e 100644 (file)
@@ -182,7 +182,6 @@ struct pkt {
                        uint32_t spi;
                        uint32_t seq;
                        unsigned char iv[16];
-                       unsigned char payload[];
                } esp;
                struct {
                        unsigned char pad[2];