darconeous / libnyoci

A flexible CoAP stack for embedded devices and computers. RFC7252 compatible.
Other
27 stars 10 forks source link

Port may be garbage, in nyoci_outbound_set_uri() #2

Closed snej closed 6 years ago

snej commented 6 years ago

Clang's static analyzer reports that the function nyoci_outbound_set_uri() uses an uninitialized variable toport in some call paths; this seems a legit bug and not a false positive.

src/libnyoci/nyoci-outbound.c:501:9: warning: 2nd function call argument is an uninitialized value
                ret = nyoci_plat_set_remote_hostname_and_port(
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This occurs when components.host is non-null but components.protocol and components.port are null. The flow of control bypasses the three lines where toport is assigned but falls through to a line where it's passed to nyoci_plat_set_remote_hostname_and_port().

Xcode doesn't produce a textual version of the detailed flow-control analysis, but here's a screenshot:

screen shot 2018-05-16 at 10 23 04 am
snej commented 6 years ago

I'm guessing the fix is to initialize toport to COAP_DEFAULT_PORT where it's declared ... ?

darconeous commented 6 years ago

Thanks for the fix!