On (29/03/15 17:50), Simo Sorce wrote:
The issues was spotted by Lucas which luckily pays more attention than
I
do to things like clang :-)
The attached patch should fix handling the LOCAL_ONLY override properly.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
From 78f092a567dfdbdf63d295e9a9cf48aaaace380b Mon Sep 17 00:00:00
2001
From: Simo Sorce <simo(a)redhat.com>
Date: Sun, 29 Mar 2015 17:42:08 -0400
Subject: [PATCH] Fix handling of context initialization
If a previous call has decided to use only local (to the process)
credentials, then we need to override all the way to the end.
A previous patch also swapped the order in which credential handler
and context handler are initialized, make sure also to swap the
fallback checks.
Set the behavior to the process default only if it wasn't forced to
local.
Signed-off-by: Simo Sorce <simo(a)redhat.com>
---
Fixed defects
Error: DEADCODE (CWE-561): [#def1]
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:85: assignment: Assigning:
"behavior" = "GPP_UNINITIALIZED".
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:113: const: At condition "behavior
== GPP_LOCAL_ONLY", the value of "behavior" must be equal to 0.
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:113: dead_error_condition: The
condition "behavior == GPP_LOCAL_ONLY" cannot be true.
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:114: dead_error_begin: Execution cannot
reach this statement: "maj = 655360U;".
# 112| behavior = GPP_LOCAL_ONLY;
# 113| } else if (behavior == GPP_LOCAL_ONLY) {
# 114|-> maj = GSS_S_DEFECTIVE_CREDENTIAL;
# 115| min = 0;
# 116| goto done;
Error: UNUSED_VALUE (CWE-563): [#def2]
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:145: value_overwrite: Overwriting
previous write to "behavior" with value from "gpp_get_behavior()".
gssproxy-0.4.0/src/mechglue/gpp_init_sec_context.c:133: assigned_value: Assigning value
"GPP_LOCAL_ONLY" to "behavior" here, but that stored value is
overwritten before it can be used.
# 131| * local mech, so let's just re-enter the mechglue here, as we
# 132| * have no way to export creds yet. */
# 133|-> behavior = GPP_LOCAL_ONLY;
# 134| }
# 135| } else {
I did not test gssproxy, but warnings from static analyzers are gone.
ACK
LS