More assorted coverity fixes (#41413)

src/basic/limits-util.c

@@ -28,6 +28,8 @@ uint64_t physical_memory(void) {
         assert(sc > 0);
 
         ps = page_size();
+        /* Silence static analyzers */
+        assert((uint64_t) sc <= UINT64_MAX / (uint64_t) ps);
         mem = (uint64_t) sc * (uint64_t) ps;
 
         r = cg_get_root_path(&root);

src/basic/user-util.c

@@ -1113,6 +1113,8 @@ int getpwnam_malloc(const char *name, struct passwd **ret) {
         for (;;) {
                 _cleanup_free_ void *buf = NULL;
 
+                /* Silence static analyzers */
+                assert(bufsize <= SIZE_MAX - ALIGN(sizeof(struct passwd)));
                 buf = malloc0(ALIGN(sizeof(struct passwd)) + bufsize);
                 if (!buf)
                         return -ENOMEM;
@@ -1154,6 +1156,8 @@ int getpwuid_malloc(uid_t uid, struct passwd **ret) {
         for (;;) {
                 _cleanup_free_ void *buf = NULL;
 
+                /* Silence static analyzers */
+                assert(bufsize <= SIZE_MAX - ALIGN(sizeof(struct passwd)));
                 buf = malloc0(ALIGN(sizeof(struct passwd)) + bufsize);
                 if (!buf)
                         return -ENOMEM;
@@ -1198,6 +1202,8 @@ int getgrnam_malloc(const char *name, struct group **ret) {
         for (;;) {
                 _cleanup_free_ void *buf = NULL;
 
+                /* Silence static analyzers */
+                assert(bufsize <= SIZE_MAX - ALIGN(sizeof(struct group)));
                 buf = malloc0(ALIGN(sizeof(struct group)) + bufsize);
                 if (!buf)
                         return -ENOMEM;
@@ -1237,6 +1243,8 @@ int getgrgid_malloc(gid_t gid, struct group **ret) {
         for (;;) {
                 _cleanup_free_ void *buf = NULL;
 
+                /* Silence static analyzers */
+                assert(bufsize <= SIZE_MAX - ALIGN(sizeof(struct group)));
                 buf = malloc0(ALIGN(sizeof(struct group)) + bufsize);
                 if (!buf)
                         return -ENOMEM;

src/boot/linux_x86.c

@@ -195,9 +195,14 @@ EFI_STATUS linux_exec_efi_handover(
 
         /* Setup size is determined by offset 0x0202 + byte value at offset 0x0201, which is the same as
          * offset of the header field and the target from the jump field (which we split for this reason). */
+        size_t setup_hdr_len;
+        if (!ADD_SAFE(&setup_hdr_len, offsetof(SetupHeader, header), image_params->hdr.setup_size))
+                setup_hdr_len = sizeof(SetupHeader);
+        else
+                setup_hdr_len = MIN(setup_hdr_len, sizeof(SetupHeader));
         memcpy(&boot_params->hdr,
                &image_params->hdr,
-               offsetof(SetupHeader, header) + image_params->hdr.setup_size);
+               setup_hdr_len);
 
         boot_params->hdr.type_of_loader = 0xff;
 

src/fsck/fsck.c

@@ -218,6 +218,7 @@ static int process_progress(int fd, FILE* console) {
 
                 /* Only update once every 50ms */
                 t = now(CLOCK_MONOTONIC);
+                assert_cc(50 * USEC_PER_MSEC <= USEC_INFINITY);
                 if (last + 50 * USEC_PER_MSEC > t)
                         continue;
 

src/journal/journald-stream.c

@@ -557,6 +557,8 @@ static int stdout_stream_process(sd_event_source *es, int fd, uint32_t revents,
 
         /* Try to make use of the allocated buffer in full, but never read more than the configured line size. Also,
          * always leave room for a terminating NUL we might need to add. */
+        /* Silence static analyzers, GREEDY_REALLOC above ensures allocated > 0 */
+        assert(allocated > 0);
         limit = MIN(allocated - 1, MAX(s->manager->config.line_max, STDOUT_STREAM_SETUP_PROTOCOL_LINE_MAX));
         assert(s->length <= limit);
         iovec = IOVEC_MAKE(s->buffer + s->length, limit - s->length);

src/libsystemd/sd-bus/bus-message.c

@@ -362,6 +362,8 @@ static int message_from_header(
 
         if (label) {
                 label_sz = strlen(label);
+                /* Silence static analyzers */
+                assert(label_sz <= SIZE_MAX - ALIGN(sizeof(sd_bus_message)) - 1);
                 a += label_sz + 1;
         }
 
@@ -462,6 +464,8 @@ _public_ int sd_bus_message_new(
         /* Creation of messages with _SD_BUS_MESSAGE_TYPE_INVALID is allowed. */
         assert_return(type < _SD_BUS_MESSAGE_TYPE_MAX, -EINVAL);
 
+        /* Silence static analyzers */
+        assert_cc(sizeof(sd_bus_message) + sizeof(void*) + sizeof(BusMessageHeader) <= SIZE_MAX);
         sd_bus_message *t = malloc0(ALIGN(sizeof(sd_bus_message)) + sizeof(BusMessageHeader));
         if (!t)
                 return -ENOMEM;

src/libsystemd/sd-bus/bus-message.h

@@ -153,6 +153,9 @@ static inline uint64_t BUS_MESSAGE_COOKIE(sd_bus_message *m) {
 }
 
 static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) {
+        /* Silence static analyzers */
+        assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader));
+        assert(m->body_size <= SIZE_MAX - sizeof(BusMessageHeader) - ALIGN8(m->fields_size));
         return
                 sizeof(BusMessageHeader) +
                 ALIGN8(m->fields_size) +
@@ -160,6 +163,8 @@ static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) {
 }
 
 static inline size_t BUS_MESSAGE_BODY_BEGIN(sd_bus_message *m) {
+        /* Silence static analyzers */
+        assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader));
         return
                 sizeof(BusMessageHeader) +
                 ALIGN8(m->fields_size);

src/libsystemd/sd-bus/bus-socket.c

@@ -788,7 +788,7 @@ int bus_socket_start_auth(sd_bus *b) {
         bus_get_peercred(b);
 
         bus_set_state(b, BUS_AUTHENTICATING);
-        b->auth_timeout = now(CLOCK_MONOTONIC) + BUS_AUTH_TIMEOUT;
+        b->auth_timeout = usec_add(now(CLOCK_MONOTONIC), BUS_AUTH_TIMEOUT);
 
         if (sd_is_socket(b->input_fd, AF_UNIX, 0, 0) <= 0)
                 b->accept_fd = false;

src/libsystemd/sd-daemon/sd-daemon.c

@@ -603,6 +603,8 @@ static int pid_notify_with_fds_internal(
                                 return log_debug_errno(errno, "Failed to send notify message to '%s': %m", e);
 
                         /* If that failed, try with our own ucred instead */
+                        /* Silence static analyzers */
+                        assert(msghdr.msg_controllen >= CMSG_SPACE(sizeof(struct ucred)));
                         msghdr.msg_controllen -= CMSG_SPACE(sizeof(struct ucred));
                         if (msghdr.msg_controllen == 0)
                                 msghdr.msg_control = NULL;

src/libsystemd/sd-journal/journal-file.c

@@ -4058,6 +4058,8 @@ static void journal_default_metrics(JournalMetrics *m, int fd, bool compact) {
                 if (m->max_size < JOURNAL_FILE_SIZE_MIN)
                         m->max_size = JOURNAL_FILE_SIZE_MIN;
 
+                /* Silence static analyzers */
+                assert(m->max_size <= UINT64_MAX / 2);
                 if (m->max_use != 0 && m->max_size*2 > m->max_use)
                         m->max_use = m->max_size*2;
         }

src/libsystemd/sd-json/sd-json.c

@@ -1940,7 +1940,7 @@ _public_ int sd_json_variant_filter(sd_json_variant **v, char **to_remove) {
         if (strv_isempty(to_remove))
                 return 0;
 
-        for (size_t i = 0; i < sd_json_variant_elements(*v); i += 2) {
+        for (size_t i = 0, m = sd_json_variant_elements(*v); i < m; i += 2) {
                 sd_json_variant *p;
 
                 p = sd_json_variant_by_index(*v, i);
@@ -1949,7 +1949,9 @@ _public_ int sd_json_variant_filter(sd_json_variant **v, char **to_remove) {
 
                 if (strv_contains(to_remove, sd_json_variant_string(p))) {
                         if (!array) {
-                                array = new(sd_json_variant*, sd_json_variant_elements(*v) - 2);
+                                /* Silence static analyzers */
+                                assert(m >= 2);
+                                array = new(sd_json_variant*, m - 2);
                                 if (!array)
                                         return -ENOMEM;
 

src/network/networkd-ndisc.c

@@ -1909,6 +1909,8 @@ static int ndisc_router_process_dnssl(Link *link, sd_ndisc_router *rt, bool zero
                 _cleanup_free_ NDiscDNSSL *s = NULL;
                 NDiscDNSSL *dnssl;
 
+                /* Silence static analyzers */
+                assert(strlen(*j) <= SIZE_MAX - ALIGN(sizeof(NDiscDNSSL)) - 1);
                 s = malloc0(ALIGN(sizeof(NDiscDNSSL)) + strlen(*j) + 1);
                 if (!s)
                         return log_oom();

src/nspawn/nspawn-oci.c

@@ -22,6 +22,7 @@
 #include "string-util.h"
 #include "strv.h"
 #include "time-util.h"
+#include "user-util.h"
 
 /* TODO:
  * OCI runtime tool implementation
@@ -685,6 +686,10 @@ static int oci_uid_gid_mappings(const char *name, sd_json_variant *v, sd_json_di
         if (r < 0)
                 return r;
 
+        /* Silence static analyzers, sd_json_dispatch_uid_gid() already validates */
+        assert(uid_is_valid(data.host_id));
+        assert(uid_is_valid(data.container_id));
+
         if (data.range > UINT32_MAX - data.host_id ||
             data.range > UINT32_MAX - data.container_id)
                 return json_log(v, flags, SYNTHETIC_ERRNO(EINVAL),

src/nss-myhostname/nss-myhostname.c

@@ -238,9 +238,13 @@ static enum nss_status fill_in_hostent(
         if (additional) {
                 ((char**) r_aliases)[0] = r_alias;
                 ((char**) r_aliases)[1] = NULL;
+                /* Silence static analyzers */
+                assert(idx <= buflen - 2 * sizeof(char*));
                 idx += 2*sizeof(char*);
         } else {
                 ((char**) r_aliases)[0] = NULL;
+                /* Silence static analyzers */
+                assert(idx <= buflen - sizeof(char*));
                 idx += sizeof(char*);
         }
 

src/repart/repart.c

@@ -1133,16 +1133,16 @@ static uint64_t partition_min_size(const Context *context, const Partition *p) {
                 uint64_t d = 0;
 
                 if (p->encrypt != ENCRYPT_OFF)
-                        d += round_up_size(LUKS2_METADATA_KEEP_FREE, context->grain_size);
+                        assert_se(INC_SAFE(&d, round_up_size(LUKS2_METADATA_KEEP_FREE, context->grain_size)));
 
                 if (p->copy_blocks_size != UINT64_MAX)
-                        d += round_up_size(p->copy_blocks_size, context->grain_size);
+                        assert_se(INC_SAFE(&d, round_up_size(p->copy_blocks_size, context->grain_size)));
                 else if (p->format || p->encrypt != ENCRYPT_OFF) {
                         uint64_t f;
 
                         /* If we shall synthesize a file system, take minimal fs size into account (assumed to be 4K if not known) */
                         f = partition_fstype_min_size(context, p);
-                        d += f == UINT64_MAX ? context->grain_size : round_up_size(f, context->grain_size);
+                        assert_se(INC_SAFE(&d, f == UINT64_MAX ? context->grain_size : round_up_size(f, context->grain_size)));
                 }
 
                 if (d > sz)
@@ -1247,6 +1247,8 @@ static uint64_t free_area_current_end(Context *context, const FreeArea *a) {
 
         assert(a->after->offset != UINT64_MAX);
         assert(a->after->current_size != UINT64_MAX);
+        /* Silence static analyzers */
+        assert(a->after->current_size <= UINT64_MAX - a->after->offset);
 
         /* Calculate where the free area ends, based on the offset of the partition preceding it. */
         return round_up_size(a->after->offset + a->after->current_size, context->grain_size) + free_area_available(a);

src/shared/calendarspec.c

@@ -1149,9 +1149,8 @@ static int find_matching_component(
                 } else if (c->repeat > 0) {
                         int k;
 
-                        k = start + ROUND_UP(*val - start, c->repeat);
-
-                        if ((!d_set || k < d) && (stop < 0 || k <= stop)) {
+                        if (ADD_SAFE(&k, start, ROUND_UP(*val - start, c->repeat)) &&
+                            (!d_set || k < d) && (stop < 0 || k <= stop)) {
                                 d = k;
                                 d_set = true;
                         }

src/shared/creds-util.c

@@ -1068,6 +1068,8 @@ int encrypt_credential_and_warn(
                 ALIGN8(offsetof(struct metadata_credential_header, name) + strlen_ptr(name)) +
                 input->iov_len + 2U * (size_t) bsz +
                 tsz;
+        /* Silence static analyzers */
+        assert(output.iov_len >= input->iov_len);
 
         output.iov_base = malloc0(output.iov_len);
         if (!output.iov_base)

src/shared/dns-packet.c

@@ -120,6 +120,8 @@ int dns_packet_new(
                 a = min_alloc_dsize;
 
         /* round up to next page size */
+        /* Silence static analyzers */
+        assert(a <= SIZE_MAX - ALIGN(sizeof(DnsPacket)));
         a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
 
         /* make sure we never allocate more than useful */
@@ -226,6 +228,8 @@ int dns_packet_dup(DnsPacket **ret, DnsPacket *p) {
         if (r < 0)
                 return r;
 
+        /* Silence static analyzers */
+        assert(p->size <= SIZE_MAX - ALIGN(sizeof(DnsPacket)));
         c = malloc(ALIGN(sizeof(DnsPacket)) + p->size);
         if (!c)
                 return -ENOMEM;

src/shared/utmp-wtmp.c

@@ -17,6 +17,8 @@ static void init_timestamp(struct utmpx *store, usec_t t) {
         if (t <= 0)
                 t = now(CLOCK_REALTIME);
 
+        /* Silence static analyzers */
+        assert_cc(USEC_PER_SEC > 0);
         store->ut_tv.tv_sec = t / USEC_PER_SEC;
         store->ut_tv.tv_usec = t % USEC_PER_SEC;
 }

src/test/test-json.c

@@ -665,6 +665,7 @@ static void test_float_match(sd_json_variant *v) {
                   sd_json_variant_integer(sd_json_variant_by_index(v, 8)) == -10);
         assert_se(sd_json_variant_is_real(sd_json_variant_by_index(v, 9)) &&
                   !sd_json_variant_is_integer(sd_json_variant_by_index(v, 9)));
+        assert_se(!iszero_safe(sd_json_variant_real(sd_json_variant_by_index(v, 9))));
         assert_se(fabs(1.0 - (DBL_MIN / 2 / sd_json_variant_real(sd_json_variant_by_index(v, 9)))) <= delta);
         assert_se(sd_json_variant_is_real(sd_json_variant_by_index(v, 10)) &&
                   !sd_json_variant_is_integer(sd_json_variant_by_index(v, 10)));

src/test/test-path.c

@@ -78,6 +78,8 @@ static int _check_states(unsigned line,
         assert_se(m);
         assert_se(service);
 
+        /* Silence static analyzers */
+        assert_cc(30 * USEC_PER_SEC <= USEC_INFINITY);
         usec_t end = now(CLOCK_MONOTONIC) + 30 * USEC_PER_SEC;
 
         while (path->state != path_state || service->state != service_state ||

src/test/test-strv.c

@@ -799,14 +799,14 @@ TEST(strv_foreach) {
 
 TEST(strv_foreach_backwards) {
         _cleanup_strv_free_ char **a;
-        unsigned i = 2;
+        unsigned i = 3;
 
         a = strv_new("one", "two", "three");
 
         assert_se(a);
 
         STRV_FOREACH_BACKWARDS(check, a)
-                ASSERT_STREQ(*check, input_table_multiple[i--]);
+                ASSERT_STREQ(*check, input_table_multiple[--i]);
 
         STRV_FOREACH_BACKWARDS(check, (char**) NULL)
                 assert_not_reached();

src/test/test-time-util.c

@@ -1113,6 +1113,8 @@ TEST(usec_shift_clock) {
 
         assert_se(usec_shift_clock(USEC_INFINITY, CLOCK_REALTIME, CLOCK_MONOTONIC) == USEC_INFINITY);
 
+        /* Silence static analyzers */
+        assert_cc(9 * USEC_PER_HOUR <= USEC_INFINITY);
         assert_similar(usec_shift_clock(rt + USEC_PER_HOUR, CLOCK_REALTIME, CLOCK_MONOTONIC), mn + USEC_PER_HOUR);
         assert_similar(usec_shift_clock(rt + 2*USEC_PER_HOUR, CLOCK_REALTIME, CLOCK_BOOTTIME), bt + 2*USEC_PER_HOUR);
         assert_se(usec_shift_clock(rt + 3*USEC_PER_HOUR, CLOCK_REALTIME, CLOCK_REALTIME_ALARM) == rt + 3*USEC_PER_HOUR);