Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Defect is found by Coverity difference scan on rhel6.1 and rhel6.2 packages.
1) Unchecked return value of update_refcount()
=> misc/e2image.c:1025 return value is not checked (as is done in 5 of 6 cases)
I'm not sure if this is really a problem, it would be nice if somebody could
look at it.
2) Possible null dereference
=> misc/e2image.c:1329
passing null variable 'header' to function qcow2_write_raw_image
which dereferences it.
a) 1239: assigning header to NULL
b) 1290: assigning header to check_qcow2_image() return value,
which can fail or even may not happen -->1289 (if branch)
c) 1329: NULL used as parameter of qcow2_write_raw_image() which
dereferences it.
I forget to notice third defect:
3) Check for negative value on unsigned variable 'offset'
=> misc/e2image.c:771
error in 'llseek' will not be recorded when occurs -- never can reach less
than zero value.
Variable 'offset' should be signed type (e.g. ext2_loff_t which is correct
ext2fs_llseek return type?)
I think that these came about as a result of Lukas' e2image work, so I will assign to him.
Lukas just sent a patch upstream for the issue in comment #2, FWIW.
Thanks,
-Eric
Thanks Eric,
The problem 1) is false positive, because we really do not need to check return value from the update_refcount() in that case.
Problem 2) Is also false positive, because if check_qcow2_image() would return NULL, then E2IMAGE_IS_QCOW2_FLAG would not be set, hence qcow2_write_raw_image() would not be called at all.
Problem 3) is real, however should not cause any real troubles because if the lseek would fail and we would not catch that, the next lseek will catch the problem, because we are using the offset there as well. However it is a bug and should be fixed.
As Eric already pointed out, I did sent the patch upstream for the problem 3. Problems 1 and 2 are not real, hence no need to fix anything there.
Thanks!
-Lukas
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHBA-2011-1735.html
Defect is found by Coverity difference scan on rhel6.1 and rhel6.2 packages. 1) Unchecked return value of update_refcount() => misc/e2image.c:1025 return value is not checked (as is done in 5 of 6 cases) I'm not sure if this is really a problem, it would be nice if somebody could look at it. 2) Possible null dereference => misc/e2image.c:1329 passing null variable 'header' to function qcow2_write_raw_image which dereferences it. a) 1239: assigning header to NULL b) 1290: assigning header to check_qcow2_image() return value, which can fail or even may not happen -->1289 (if branch) c) 1329: NULL used as parameter of qcow2_write_raw_image() which dereferences it.