From 21cc3216a7c572c6689a7406e37ec0f6915ad3fc Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 28 Mar 2026 21:14:35 +0000 Subject: [PATCH] dns-packet: add asserts for allocation overflow safety Coverity flags ALIGN(sizeof(DnsPacket)) + size calculations in dns_packet_new() and dns_packet_dup() as potential overflows. The sizes are bounded by DNS_PACKET_SIZE_MAX but add asserts to make this explicit for static analyzers. CID#1548058 CID#1548076 Follow-up for c73ce96b569e2f10dff64b7dc0bd271972674c2a --- src/shared/dns-packet.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/shared/dns-packet.c b/src/shared/dns-packet.c index cdd56d513f..d333b255ee 100644 --- a/src/shared/dns-packet.c +++ b/src/shared/dns-packet.c @@ -120,6 +120,8 @@ int dns_packet_new( a = min_alloc_dsize; /* round up to next page size */ + /* Silence static analyzers */ + assert(a <= SIZE_MAX - ALIGN(sizeof(DnsPacket))); a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket)); /* make sure we never allocate more than useful */ @@ -226,6 +228,8 @@ int dns_packet_dup(DnsPacket **ret, DnsPacket *p) { if (r < 0) return r; + /* Silence static analyzers */ + assert(p->size <= SIZE_MAX - ALIGN(sizeof(DnsPacket))); c = malloc(ALIGN(sizeof(DnsPacket)) + p->size); if (!c) return -ENOMEM;