From ff102359b7cf767c9c793a163ff34d95370d0107 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 11 Apr 2026 22:04:37 +0100 Subject: [PATCH 1/4] uid-range: add assert to prevent underflow in coalesce loop Coverity flags range->n_entries - j as a potential underflow in the memmove size calculation. Add assert(range->n_entries > 0) before decrementing n_entries, which holds since the loop condition guarantees j < n_entries. CID#1548015 Follow-up for 8dcc66cefc8ab489568c737adcba960756d76a3c --- src/basic/uid-range.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/basic/uid-range.c b/src/basic/uid-range.c index 3d8f8445c4..62c7d7d928 100644 --- a/src/basic/uid-range.c +++ b/src/basic/uid-range.c @@ -75,6 +75,8 @@ static void uid_range_coalesce(UIDRange *range) { if (range->n_entries > j + 1) memmove(y, y + 1, sizeof(UIDRangeEntry) * (range->n_entries - j - 1)); + /* Silence static analyzers, n_entries > 0 since j < n_entries holds in the loop condition */ + assert(range->n_entries > 0); range->n_entries--; /* Silence static analyzers, j cannot be 0 here since it starts at i + 1, i.e. >= 1 */ From 1afc0c6c608e75e6fccba13cc4f36039b0a7ae6e Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 11 Apr 2026 22:15:52 +0100 Subject: [PATCH 2/4] nss-myhostname: add more INC_SAFE for buffer index accumulation Use overflow-safe INC_SAFE() instead of raw addition for idx accumulation, so that Coverity can see the addition is checked. CID#1548028 Follow-up for a05483a921a518fd283e7cb32dc8c8e816b2ab2c --- src/nss-myhostname/nss-myhostname.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/nss-myhostname/nss-myhostname.c b/src/nss-myhostname/nss-myhostname.c index 601a4198dd..b4a9775ef3 100644 --- a/src/nss-myhostname/nss-myhostname.c +++ b/src/nss-myhostname/nss-myhostname.c @@ -230,7 +230,7 @@ static enum nss_status fill_in_hostent( if (additional) { r_alias = buffer + idx; memcpy(r_alias, additional, l_additional+1); - idx += ALIGN(l_additional+1); + assert_se(INC_SAFE(&idx, ALIGN(l_additional+1))); } /* Second, create aliases array */ @@ -258,14 +258,14 @@ static enum nss_status fill_in_hostent( } assert(i == c); - idx += c*ALIGN(alen); + assert_se(INC_SAFE(&idx, c*ALIGN(alen))); } else if (af == AF_INET) { *(uint32_t*) r_addr = local_address_ipv4; - idx += ALIGN(alen); + assert_se(INC_SAFE(&idx, ALIGN(alen))); } else if (socket_ipv6_is_enabled()) { memcpy(r_addr, LOCALADDRESS_IPV6, FAMILY_ADDRESS_SIZE(AF_INET6)); - idx += ALIGN(alen); + assert_se(INC_SAFE(&idx, ALIGN(alen))); } /* Fourth, add address pointer array */ @@ -277,15 +277,15 @@ static enum nss_status fill_in_hostent( ((char**) r_addr_list)[i] = r_addr + i*ALIGN(alen); ((char**) r_addr_list)[i] = NULL; - idx += (c+1) * sizeof(char*); + assert_se(INC_SAFE(&idx, (c+1) * sizeof(char*))); } else if (af == AF_INET || socket_ipv6_is_enabled()) { ((char**) r_addr_list)[0] = r_addr; ((char**) r_addr_list)[1] = NULL; - idx += 2 * sizeof(char*); + assert_se(INC_SAFE(&idx, 2 * sizeof(char*))); } else { ((char**) r_addr_list)[0] = NULL; - idx += sizeof(char*); + assert_se(INC_SAFE(&idx, sizeof(char*))); } /* Verify the size matches */ From efccc0dc2311ef21cb10334a2594616f340a415f Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 11 Apr 2026 22:50:39 +0100 Subject: [PATCH 3/4] debug-generator: assert breakpoint type is valid before bit shift The BreakpointType enum includes _BREAKPOINT_TYPE_INVALID (-EINVAL), so Coverity flags the bit shift as potentially using a negative shift amount. Add an assert to verify the type is in valid range, since the static table only contains valid entries. CID#1568482 Follow-up for 1929226e7e649b72f3f9acd464eaac771c00945c --- src/debug-generator/debug-generator.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/debug-generator/debug-generator.c b/src/debug-generator/debug-generator.c index e3b7768fbc..9ef271343c 100644 --- a/src/debug-generator/debug-generator.c +++ b/src/debug-generator/debug-generator.c @@ -101,6 +101,7 @@ static int parse_breakpoint_from_string(const char *s, uint32_t *ret_breakpoints FOREACH_ELEMENT(i, breakpoint_info_table) if (FLAGS_SET(i->validity, BREAKPOINT_DEFAULT) && breakpoint_applies(i, INT_MAX)) { + assert(i->type >= 0 && i->type < _BREAKPOINT_TYPE_MAX); /* silence coverity */ breakpoints |= UINT32_C(1) << i->type; found_default = true; break; From 44296e41db20b40d0b9a4cbe320d262ffdd8905d Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 11 Apr 2026 22:52:47 +0100 Subject: [PATCH 4/4] test-json: add iszero_safe guards for float division at index 0 and 1 The existing iszero_safe guards at index 9 and 10 were added to silence Coverity, but the same division-by-float-zero warning also applies to the divisions at index 0 (DBL_MIN) and 1 (DBL_MAX). CID#1587762 Follow-up for 7f133c996c8b1ea9219540ec8f966b64b58d30a6 --- src/test/test-json.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/test/test-json.c b/src/test/test-json.c index 8e2c8621c1..1bd5d94f98 100644 --- a/src/test/test-json.c +++ b/src/test/test-json.c @@ -690,7 +690,9 @@ static void test_float_match(sd_json_variant *v) { assert_se(sd_json_variant_is_array(v)); assert_se(sd_json_variant_elements(v) == 11); + assert_se(!iszero_safe(sd_json_variant_real(sd_json_variant_by_index(v, 0)))); assert_se(fabs(1.0 - (DBL_MIN / sd_json_variant_real(sd_json_variant_by_index(v, 0)))) <= delta); + assert_se(!iszero_safe(sd_json_variant_real(sd_json_variant_by_index(v, 1)))); assert_se(fabs(1.0 - (DBL_MAX / sd_json_variant_real(sd_json_variant_by_index(v, 1)))) <= delta); assert_se(sd_json_variant_is_null(sd_json_variant_by_index(v, 2))); /* nan is not supported by json → null */ assert_se(sd_json_variant_is_null(sd_json_variant_by_index(v, 3))); /* +inf is not supported by json → null */