From 2e79d397a4f8928eb8f890dc71b6c7e2172843ce Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 24 Jun 2026 19:02:06 +0100 Subject: [PATCH 1/3] dhcp-message-dump: guard against negative option type before indexing dhcp_option_type_from_code() returns _DHCP_OPTION_TYPE_INVALID (-EINVAL) for the PAD and END option codes, and dump_dhcp_option_one() uses the returned value directly as an index into the functions[] table. Those codes are excluded by an assert() at the top of the function, but assert() compiles down to __builtin_unreachable() under NDEBUG, so a negative array index read is reachable there (and trips static analyzers). Bail out explicitly on the error return. CID#1660105 Follow-up for 149adb2fdce0d9a40f9332ecb1a48a486fce5194 --- src/libsystemd-network/dhcp-message-dump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libsystemd-network/dhcp-message-dump.c b/src/libsystemd-network/dhcp-message-dump.c index a593c86d45..0314522231 100644 --- a/src/libsystemd-network/dhcp-message-dump.c +++ b/src/libsystemd-network/dhcp-message-dump.c @@ -895,6 +895,8 @@ static int dump_dhcp_option_one(Table *table, sd_dhcp_message *message, uint8_t bool fallback = false; if (type == DHCP_OPTION_TYPE_AUTO) { type = dhcp_option_type_from_code(code); + if (type < 0) + return type; fallback = true; } From 6ebf344a1b0ae3e9788c088735a50c66c06a4c8d Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 24 Jun 2026 19:07:56 +0100 Subject: [PATCH 2/3] core: actually sort the parsed LUO session list The strv_sort() call sat after a for (;;) loop whose only exits are return statements inside the loop, so it never ran. CID#1660125 Follow-up for 82b8615463c306f8f7eeaec13600c89a7bbef151 --- src/core/load-fragment.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index 3fa92aff56..ce4517e85b 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -6823,8 +6823,10 @@ int config_parse_luo_sessions( "Failed to parse LUOSession= value, ignoring: %s", rvalue); return 0; } - if (r == 0) + if (r == 0) { + strv_sort(*sessions); return 0; + } if (!luo_session_name_is_valid(word)) { log_syntax(unit, LOG_WARNING, filename, line, 0, @@ -6842,6 +6844,4 @@ int config_parse_luo_sessions( if (r < 0) return log_oom(); } - - strv_sort(*sessions); } From 45033e39ec018cdbc2c3fc0399850a53c0a73fe0 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Wed, 24 Jun 2026 19:09:36 +0100 Subject: [PATCH 3/3] sd-future: drop redundant branch in test reader fiber Both the error and the success path returned (int) n, so the check was a no-op. Return the value directly. CID#1660095 Follow-up for 7bc793e21f2d4bf67bd311545270bc515fe63ad9 --- src/libsystemd/sd-future/test-fiber-ops.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/libsystemd/sd-future/test-fiber-ops.c b/src/libsystemd/sd-future/test-fiber-ops.c index f2c603fda0..35a9952710 100644 --- a/src/libsystemd/sd-future/test-fiber-ops.c +++ b/src/libsystemd/sd-future/test-fiber-ops.c @@ -422,8 +422,6 @@ static int loop_write_zero_blocking_reader_fiber(void *userdata) { _cleanup_free_ char *buf = malloc(ctx->total); ASSERT_NOT_NULL(buf); ssize_t n = loop_read(ctx->pipefd[0], buf, ctx->total, /* do_poll= */ true); - if (n < 0) - return (int) n; return (int) n; }