Fix issues found by coverity (ARMmbed#2082)

Fix issues found by coverity -324809 Dereference after null check (thread_extension_bbr.c) -348373 Dereference after null check (dhcpv6_client_service.c) -348840 Misuse of memcmp-style function (ws_pae_controller.c) -324625 Unchecked return value (thread_extension.c) -324547 Wrong size argument (ws_pae_supp.c)
artokin · May 16, 2019 · 3524877 · 3524877
1 parent e5f1627
commit 3524877
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 8 deletions.
diff --git a/source/6LoWPAN/Thread/thread_extension.c b/source/6LoWPAN/Thread/thread_extension.c
@@ -661,11 +661,11 @@ void thread_extension_child_address_registration_response_process(struct protoco
         return;
     }
     // We will start address registration timers
-
     if (!thread_address_registration_running()) {
-        uint32_t dua_delay = randLIB_get_random_in_range(1, 5);
-        thread_extension_primary_bbr_get(interface, NULL, NULL, NULL, &dua_delay);
-
+        uint32_t dua_delay;
+        if (0 != thread_extension_primary_bbr_get(interface, NULL, NULL, NULL, &dua_delay)) {
+            dua_delay = randLIB_get_random_in_range(1, 5);
+        }
         thread_address_registration_init();
         thread_address_registration_timer_set(interface, 1 + randLIB_get_random_in_range(0, dua_delay / 1000), randLIB_get_random_in_range(1, 5));
     }

diff --git a/source/6LoWPAN/Thread/thread_extension_bbr.c b/source/6LoWPAN/Thread/thread_extension_bbr.c
@@ -1543,7 +1543,7 @@ void thread_extension_bbr_mcast_fwd_check(int8_t interface_id, bool *multicast_f
 {
     thread_pbbr_t *this = thread_bbr_find_by_interface(interface_id);
 
-    if (!this || multicast_fwd) {
+    if (!this || !multicast_fwd) {
         return;
     }
 
@@ -1557,6 +1557,7 @@ void thread_extension_bbr_mcast_fwd_check(int8_t interface_id, bool *multicast_f
         *multicast_fwd = true;
         return;
     }
+
     if (0 == thread_extension_primary_bbr_get(cur, NULL, NULL, NULL, NULL)) {
         // We are secondary BBR we newer forward
         *multicast_fwd = false;

diff --git a/source/6LoWPAN/ws/ws_pae_controller.c b/source/6LoWPAN/ws/ws_pae_controller.c
@@ -293,7 +293,7 @@ static int8_t ws_pae_controller_nw_key_check_and_insert(protocol_interface_info_
     for (uint8_t i = 0; i < GTK_NUM; i++) {
         // If hash is set for a key
         if (!sec_prot_keys_gtk_hash_empty(gtk_hash_ptr)) {
-            int8_t hash_matches = memcmp(gtk_hash_ptr, nw_key[i].hash, GTK_HASH_LEN);
+            int hash_matches = memcmp(gtk_hash_ptr, nw_key[i].hash, GTK_HASH_LEN);
             // If the hash does not match (not set or modified) or not installed
             if (hash_matches != 0 || !nw_key[i].installed) {
 

diff --git a/source/6LoWPAN/ws/ws_pae_supp.c b/source/6LoWPAN/ws/ws_pae_supp.c
@@ -914,7 +914,7 @@ static void ws_pae_supp_kmp_service_addr_get(kmp_service_t *service, kmp_api_t *
             if (pae_supp->new_br_eui_64_set && kmp_api_type_get(kmp) >= IEEE_802_1X_INITIAL_KEY) {
                 kmp_address_eui_64_set(remote_addr, pae_supp->new_br_eui_64);
             } else {
-                memset(remote_addr, 0, 8);
+                memset(remote_addr, 0, sizeof(kmp_addr_t));
                 tr_error("No border router EUI-64");
             }
         }

diff --git a/source/DHCPv6_client/dhcpv6_client_service.c b/source/DHCPv6_client/dhcpv6_client_service.c
@@ -440,7 +440,9 @@ void dhcpv6_renew(protocol_interface_info_entry_t *interface, if_address_entry_t
     srv_data_ptr->transActionId = dhcp_service_send_req(dhcp_client.service_instance, 0, srv_data_ptr, server_address, payload_ptr, payload_len, dhcp_solicit_resp_cb);
     if (srv_data_ptr->transActionId == 0) {
         ns_dyn_mem_free(payload_ptr);
-        addr->state_timer = 200; //Retry after 20 seconds
+        if (addr) {
+            addr->state_timer = 200; //Retry after 20 seconds
+        }
         tr_error("DHCP renew send failed");
     }
     if (packetReq.messageType == DHCPV6_SOLICATION_TYPE && dhcp_client.sol_timeout != 0) {