URL:
https://github.com/SSSD/sssd/pull/553
Title: #553: Use p11_child to verify certificates for the ssh responder
jhrozek commented:
"""
I started the review by running Coverity:
```
Error: UNREACHABLE (CWE-561):
sssd-1.16.2/src/responder/ssh/ssh_reply.c:166: unreachable: This code cannot be reached:
"ret = 12;".
# 164| if (state->elements == NULL) {
# 165| goto done;
# 166|-> ret = ENOMEM;
# 167| }
# 168|
Error: UNINIT (CWE-457):
sssd-1.16.2/src/responder/ssh/ssh_reply.c:135: var_decl: Declaring variable
"ret" without initializer.
sssd-1.16.2/src/responder/ssh/ssh_reply.c:258: uninit_use: Using uninitialized value
"ret".
# 256|
# 257| done:
# 258|-> if (ret != EAGAIN) {
# 259| if (ret == EOK) {
# 260| tevent_req_done(req);
Error: COMPILER_WARNING:
sssd-1.16.2/src/responder/ssh/ssh_reply.c: scope_hint: In function
'ssh_get_output_keys_send'
sssd-1.16.2/src/responder/ssh/ssh_reply.c:258:8: warning: 'ret' may be used
uninitialized in this function [-Wmaybe-uninitialized]
# if (ret != EAGAIN) {
# ^
# 256|
# 257| done:
# 258|-> if (ret != EAGAIN) {
# 259| if (ret == EOK) {
# 260| tevent_req_done(req);
Error: CLANG_WARNING:
sssd-1.16.2/src/responder/ssh/ssh_reply.c:258:13: warning: The left operand of
'!=' is a garbage value
# if (ret != EAGAIN) {
# ~~~ ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:135:5: note: 'ret' declared without an
initial value
# errno_t ret;
# ^~~~~~~~~~~
sssd-1.16.2/src/responder/ssh/ssh_reply.c:139:9: note: Assuming 'req' is not equal
to null
# if (req == NULL) {
# ^~~~~~~~~~~
sssd-1.16.2/src/responder/ssh/ssh_reply.c:139:5: note: Taking false branch
# if (req == NULL) {
# ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:150:5: note: Taking false branch
# if (state->ssh_ctx == NULL) {
# ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:157:5: note: Taking false branch
# if (state->name == NULL) {
# ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:164:5: note: Taking true branch
# if (state->elements == NULL) {
# ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:165:9: note: Control jumps to line 258
# goto done;
# ^
sssd-1.16.2/src/responder/ssh/ssh_reply.c:258:13: note: The left operand of '!='
is a garbage value
# if (ret != EAGAIN) {
# ~~~ ^
# 256|
# 257| done:
# 258|-> if (ret != EAGAIN) {
# 259| if (ret == EOK) {
# 260| tevent_req_done(req);
```
Feel free to fix this just locally, I haven't really done anything else so far.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/553#issuecomment-382755929