1376815 - Coverity issues Snapshot 170600

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement)

Description

[Franziskus Kiefer [:franziskus]]

** CID 1413404:  Null pointer dereferences  (NULL_RETURNS)
/lib/freebl/shvfy.c: 244 in mkCheckFileName()


________________________________________________________________________________________________________
*** CID 1413404:  Null pointer dereferences  (NULL_RETURNS)
/lib/freebl/shvfy.c: 244 in mkCheckFileName()
238
239         if ((index > 0) &&
240             (PORT_Strncmp(&libName[index],
241                           "." SHLIB_SUFFIX, sizeof("." SHLIB_SUFFIX)) == 0)) {
242             ln_len = index;
243         }
>>>     CID 1413404:  Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be null "output" when calling "memcpy".
244         PORT_Memcpy(output, libName, ln_len);
245         PORT_Memcpy(&output[ln_len], SGN_SUFFIX, sizeof(SGN_SUFFIX));
246         return output;
247     }
248
249     static int

** CID 1413403:  Null pointer dereferences  (NULL_RETURNS)
/lib/freebl/dh.c: 87 in DH_GenParam()


________________________________________________________________________________________________________
*** CID 1413403:  Null pointer dereferences  (NULL_RETURNS)
/lib/freebl/dh.c: 87 in DH_GenParam()
81         /* generate prime with MPI, uses Miller-Rabin to generate strong prime. */
82         CHECK_SEC_OK(generate_prime(&p, primeLen));
83         /* construct Sophie-Germain prime q = (p-1)/2. */
84         CHECK_MPI_OK(mp_sub_d(&p, 1, &psub1));
85         CHECK_MPI_OK(mp_div_2(&psub1, &q));
86         /* construct a generator from the prime. */
>>>     CID 1413403:  Null pointer dereferences  (NULL_RETURNS)
>>>     Assigning: "ab" = null return value from "PORT_Alloc_stub".
87         ab = PORT_Alloc(primeLen);
88         /* generate a candidate number a in p's field */
89         CHECK_SEC_OK(RNG_GenerateGlobalRandomBytes(ab, primeLen));
90         CHECK_MPI_OK(mp_read_unsigned_octets(&a, ab, primeLen));
91         /* force a < p (note that quot(a/p) <= 1) */
92         if (mp_cmp(&a, &p) > 0)

Comment 1

[Franziskus Kiefer [:franziskus]]

https://hg.mozilla.org/projects/nss/rev/e8c9c4aa24ff83e4fb57b229957a022ee636abc9