Skip to content

Conversation

@troglobit
Copy link
Contributor

Description

Address two issues identified by Coverity Scan:

  1. CID 550484 (TOCTOU): Remove access() check before realpath()

    • realpath() already fails if file doesn't exist, making the access() check redundant and introducing a TOCTOU race
    • Simplifies code while improving security
  2. CID 550483 (CHECKED_RETURN): Mark unchecked remove() calls

    • Add (void) cast to two remove() calls to explicitly indicate we don't care about the return value
    • These are cleanup operations for temp files where failure is acceptable, even expected

Checklist

Tick relevant boxes, this PR is-a or has-a:

  • Bugfix
    • Regression tests
    • ChangeLog updates (for next release)
  • Feature
    • YANG model change => revision updated?
    • Regression tests added?
    • ChangeLog updates (for next release)
    • Documentation added?
  • Test changes
    • Checked in changed Readme.adoc (make test-spec)
    • Added new test to group Readme.adoc and yaml file
  • Code style update (formatting, renaming)
  • Refactoring (please detail in commit messages)
  • Build related changes
  • Documentation content changes
    • ChangeLog updated (for major changes)
  • Other (please describe):

Address two issues identified by Coverity Scan:

1. CID 550484 (TOCTOU): Remove access() check before realpath()
   - realpath() already fails if file doesn't exist, making the
     access() check redundant and introducing a TOCTOU race
   - Simplifies code while improving security

2. CID 550483 (CHECKED_RETURN): Mark unchecked remove() calls
   - Add (void) cast to two remove() calls to explicitly indicate
     we don't care about the return value
   - These are cleanup operations for temp files where failure
     is acceptable, even expected

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
@troglobit troglobit requested a review from mattiaswal October 25, 2025 07:45
Copy link
Contributor

@mattiaswal mattiaswal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👌

@mattiaswal mattiaswal merged commit 3384507 into main Oct 25, 2025
8 checks passed
@mattiaswal mattiaswal deleted the coverity-fixes branch October 25, 2025 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants