Bug appneta#385 scan-build -V -v -v make is clean

baigubulu · May 8, 2017 · c6f05ee · c6f05ee
1 parent 506b4bd
commit c6f05ee
Show file tree

Hide file tree

Showing 12 changed files with 98 additions and 62 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -16,7 +16,7 @@ addons:
     project:
       name: "appneta/tcpreplay"
       description: "Build submitted via Travis CI"
-    notification_email: fklassen@appneta.com
+    notification_email: tcpreplay@appneta.com
     build_command_prepend: "./autogen.sh; ./configure; make clean"
     build_command:   "make"
     branch_pattern: coverity_scan

diff --git a/lib/tree.h b/lib/tree.h
@@ -390,8 +390,10 @@ name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
 {									\
 	struct type *parent, *gparent, *tmp;				\
 	while ((parent = RB_PARENT(elm, field)) &&			\
-	    RB_COLOR(parent, field) == RB_RED) {			\
+		RB_COLOR(parent, field) == RB_RED) {			\
 		gparent = RB_PARENT(parent, field);			\
+		if (!gparent)						\
+			continue;					\
 		if (parent == RB_LEFT(gparent, field)) {		\
 			tmp = RB_RIGHT(gparent, field);			\
 			if (tmp && RB_COLOR(tmp, field) == RB_RED) {	\
@@ -400,7 +402,7 @@ name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
 				elm = gparent;				\
 				continue;				\
 			}						\
-			if (RB_RIGHT(parent, field) == elm) {		\
+			if (RB_RIGHT(parent, field) == elm) {	\
 				RB_ROTATE_LEFT(head, parent, tmp, field);\
 				tmp = parent;				\
 				parent = elm;				\
@@ -416,7 +418,7 @@ name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
 				elm = gparent;				\
 				continue;				\
 			}						\
-			if (RB_LEFT(parent, field) == elm) {		\
+			if (RB_LEFT(parent, field) == elm) {	\
 				RB_ROTATE_RIGHT(head, parent, tmp, field);\
 				tmp = parent;				\
 				parent = elm;				\
@@ -434,24 +436,28 @@ name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm)
 {									\
 	struct type *tmp;						\
 	while ((elm == NULL || RB_COLOR(elm, field) == RB_BLACK) &&	\
-	    elm != RB_ROOT(head)) {					\
+			elm != RB_ROOT(head)) {				\
 		if (RB_LEFT(parent, field) == elm) {			\
 			tmp = RB_RIGHT(parent, field);			\
+			if (!tmp)					\
+				continue;				\
 			if (RB_COLOR(tmp, field) == RB_RED) {		\
 				RB_SET_BLACKRED(tmp, parent, field);	\
 				RB_ROTATE_LEFT(head, parent, tmp, field);\
 				tmp = RB_RIGHT(parent, field);		\
 			}						\
+			if (!tmp)					\
+				continue;				\
 			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
+				RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
+				(RB_RIGHT(tmp, field) == NULL ||		\
+				RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
 				RB_COLOR(tmp, field) = RB_RED;		\
 				elm = parent;				\
 				parent = RB_PARENT(elm, field);		\
 			} else {					\
 				if (RB_RIGHT(tmp, field) == NULL ||	\
-				    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK) {\
+						RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK) {\
 					struct type *oleft;		\
 					if ((oleft = RB_LEFT(tmp, field)))\
 						RB_COLOR(oleft, field) = RB_BLACK;\
@@ -469,15 +475,19 @@ name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm)
 			}						\
 		} else {						\
 			tmp = RB_LEFT(parent, field);			\
+			if (!tmp)					\
+				continue;				\
 			if (RB_COLOR(tmp, field) == RB_RED) {		\
 				RB_SET_BLACKRED(tmp, parent, field);	\
 				RB_ROTATE_RIGHT(head, parent, tmp, field);\
 				tmp = RB_LEFT(parent, field);		\
 			}						\
+			if (!tmp)					\
+				continue;				\
 			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
+				RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
+				(RB_RIGHT(tmp, field) == NULL ||		\
+				RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
 				RB_COLOR(tmp, field) = RB_RED;		\
 				elm = parent;				\
 				parent = RB_PARENT(elm, field);		\

diff --git a/libopts/nested.c b/libopts/nested.c
@@ -342,7 +342,7 @@ static char const *
 scan_name(char const * name, tOptionValue * res)
 {
     tOptionValue* new_val;
-    char const * pzScan = name+1; /* we know first char is a name char */
+    char const * pzScan;
     char const * pzVal;
     size_t       nm_len = 1;
     size_t       d_len = 0;

diff --git a/libopts/numeric.c b/libopts/numeric.c
@@ -55,7 +55,6 @@ optionShowRange(tOptions * pOpts, tOptDesc * pOD, void * rng_table, int rng_ct)
     if (pOpts != OPTPROC_EMIT_USAGE) {
         if (pOpts <= OPTPROC_EMIT_LIMIT)
             return;
-        pz_indent = ONE_TAB_STR;
 
         fprintf(option_usage_fp, zRangeErr, pOpts->pzProgName,
                 pOD->pz_Name, pOD->optArg.argInt);

diff --git a/src/common/mac.c b/src/common/mac.c
@@ -115,6 +115,7 @@ macinstring(const char *macstring, const u_char *mac)
     int len = 6, ret = TCPR_DIR_S2C;
 
     ourstring = safe_strdup(macstring);
+    memset(&tempmac[0], 0, sizeof(tempmac));
 
     tempstr = strtok_r(ourstring, ",", &tok);
     if (strlen(tempstr)) {

diff --git a/src/fragroute/mod.c b/src/fragroute/mod.c
@@ -19,7 +19,7 @@
 #include "argv.h"
 #include "mod.h"
 
-#define MAX_ARGS		 128	/* XXX */
+#define MAX_ARGS		 128
 
 struct rule {
 	struct mod		*mod;
@@ -28,7 +28,7 @@ struct rule {
 };
 
 /*
- * XXX - new modules must be registered here.
+ * new modules must be registered here.
  */
 extern struct mod	 mod_delay;
 extern struct mod	 mod_drop;
@@ -84,7 +84,7 @@ mod_open(const char *script, char *errbuf)
 {
 	FILE *fp;
 	struct mod **m;
-	struct rule *rule;
+	struct rule *rule = NULL;
 	char *argv[MAX_ARGS], buf[BUFSIZ];
 	int i, argc, ret = 0;
 
@@ -158,8 +158,11 @@ mod_open(const char *script, char *errbuf)
 		}
 		buf[strlen(buf) - 4] = '\0';
 		sprintf(errbuf, "wtf: %s", buf);
-        // ret = -1;
 	}
+
+	if (rule)
+	    free(rule);
+
 	return (ret);
 }
 
@@ -182,6 +185,5 @@ mod_close(void)
 		if (rule->mod->close != NULL)
 			rule->data = rule->mod->close(rule->data);
 		TAILQ_REMOVE(&rules, rule, next);
-		free(rule);
 	}
 }
diff --git a/src/fragroute/mod_drop.c b/src/fragroute/mod_drop.c
@@ -82,8 +82,10 @@ drop_apply(void *d, struct pktq *pktq)
 	else
 		pkt = pktq_random(data->rnd, pktq);
 
-	TAILQ_REMOVE(pktq, pkt, pkt_next);
-	pkt_free(pkt);
+	if (pkt) {
+	    TAILQ_REMOVE(pktq, pkt, pkt_next);
+	    pkt_free(pkt);
+	}
 
 	return (0);
 }

diff --git a/src/fragroute/mod_dup.c b/src/fragroute/mod_dup.c
@@ -85,7 +85,13 @@ dup_apply(void *d, struct pktq *pktq)
 	else
 		pkt = pktq_random(data->rnd, pktq);
 
+	if (!pkt)
+	    return -1;
+
 	new = pkt_dup(pkt);
+	if (!new)
+	    return -1;
+
 	TAILQ_INSERT_AFTER(pktq, pkt, new, pkt_next);
 
 	return (0);

diff --git a/src/fragroute/pkt.c b/src/fragroute/pkt.c
@@ -7,6 +7,7 @@
  */
 
 #include "config.h"
+#include "common/err.h"
 
 #include <sys/types.h>
 
@@ -292,14 +293,18 @@ pktq_shuffle(rand_t *r, struct pktq *pktq)
 	TAILQ_FOREACH(pkt, pktq, pkt_next) {
 		i++;
 	}
-	if (i > pvlen) {
+	if (i > 0 && i > pvlen) {
 		pvlen = i;
 		if (pvbase == NULL)
 			pvbase = malloc(sizeof(pkt) * pvlen);
 		else
 			pvbase = realloc(pvbase, sizeof(pkt) * pvlen);
+
 	}
-	i = 0;
+    if (!pvbase)
+        err(-1, "out of memory\n");
+
+    i = 0;
 	TAILQ_FOREACH(pkt, pktq, pkt_next) {
 		pvbase[i++] = pkt;
 	}
@@ -316,17 +321,22 @@ struct pkt *
 pktq_random(rand_t *r, struct pktq *pktq)
 {
 	struct pkt *pkt;
-	int i;
+	unsigned int i;
 
 	i = 0;
 	TAILQ_FOREACH(pkt, pktq, pkt_next) {
 		i++;
 	}
-	i = rand_uint32(r) % (i - 1);
+
+	if (i)
+	    --i;
+
+	if (i)
+	    i = rand_uint32(r) % i;
 	pkt = TAILQ_FIRST(pktq);
 
-	while (--i >= 0) {
-		pkt = TAILQ_NEXT(pkt, pkt_next);
+	while (pkt && --i >= 0) {
+	    pkt = TAILQ_NEXT(pkt, pkt_next);
 	}
 	return (pkt);
 }
diff --git a/src/tcpedit/portmap.c b/src/tcpedit/portmap.c
@@ -132,6 +132,7 @@ ports2PORT(char *ports)
         }
         portmap_last->next = NULL;
         free(portmap);
+        portmap = portmap_head = NULL;
     }
     /* process a list via +, filling in list[] */
     else if (strchr(from_s, '+')) {

diff --git a/src/tcpliveplay.c b/src/tcpliveplay.c
@@ -158,6 +158,7 @@ main(int argc, char **argv)
     pcap_t *local_handle;
     char errbuf[PCAP_ERRBUF_SIZE];
     char ebuf[SENDPACKET_ERRBUF_SIZE];
+    int i;
 
     optionProcess(&tcpliveplayOptions, argc, argv); /*Process AutoOpts for manpage options*/
 
@@ -208,7 +209,7 @@ main(int argc, char **argv)
     /* Rewrites the given "*.pcap" file with all the new parameters and returns the number of packets */
     /* that need to be replayed */
     num_packets = rewrite(&new_remoteip, &new_remotemac, &myip, &mymac, argv[2], new_src_port);
-    if (num_packets < 0)
+    if (num_packets < 2)
         errx(-1, "Unable to rewrite PCAP file %s\n",argv[2]);
 
     /* create schedule & set it up */
@@ -219,6 +220,11 @@ main(int argc, char **argv)
     pkts_scheduled = setup_sched(sched);    /* Returns number of packets in schedule*/
 
     /* Set up the schedule struct to be relative numbers rather than absolute*/
+    for (i = 0; i < num_packets; i++) {
+        sched[i].exp_rseq = 0;
+        sched[i].exp_rack = 0;
+    }
+
     relative_sched(sched, sched[1].exp_rseq, num_packets);
     printf("Packets Scheduled %d\n", pkts_scheduled);
 
@@ -1182,7 +1188,7 @@ do_checksum_liveplay(u_int8_t *data, int proto, int len) {
     int ip_hl;
     volatile int sum;   // <-- volatile works around a PPC g++ bug
 
-    sum = 0;
+    sum;
     ipv4 = NULL;
 
     ipv4 = (ipv4_hdr *)data;

diff --git a/src/tree.c b/src/tree.c
@@ -245,25 +245,25 @@ check_ip_tree(const int mode, const unsigned long ip)
              "Try a different auto mode (-n router|client|server)",
              get_addr2name4(ip, RESOLVE), ip);
 
+    /* return node type if we found the node, else return the default (mode) */
+    if (node != NULL) {
 #ifdef DEBUG
-    switch (node->type) {
-    case DIR_SERVER:
-        dbgx(1, "DIR_SERVER: %s", get_addr2name4(ip, RESOLVE));
-        break;
-    case DIR_CLIENT:
-        dbgx(1, "DIR_CLIENT: %s", get_addr2name4(ip, RESOLVE));
-        break;
-    case DIR_UNKNOWN:
-        dbgx(1, "DIR_UNKNOWN: %s", get_addr2name4(ip, RESOLVE));
-        break;
-    case DIR_ANY:
-        dbgx(1, "DIR_ANY: %s", get_addr2name4(ip, RESOLVE));
-        break;
-    }
+        switch (node->type) {
+        case DIR_SERVER:
+            dbgx(1, "DIR_SERVER: %s", get_addr2name4(ip, RESOLVE));
+            break;
+        case DIR_CLIENT:
+            dbgx(1, "DIR_CLIENT: %s", get_addr2name4(ip, RESOLVE));
+            break;
+        case DIR_UNKNOWN:
+            dbgx(1, "DIR_UNKNOWN: %s", get_addr2name4(ip, RESOLVE));
+            break;
+        case DIR_ANY:
+            dbgx(1, "DIR_ANY: %s", get_addr2name4(ip, RESOLVE));
+            break;
+        }
 #endif
 
-    /* return node type if we found the node, else return the default (mode) */
-    if (node != NULL) {
         switch (node->type) {
         case DIR_SERVER:
             return TCPR_DIR_S2C;
@@ -310,29 +310,28 @@ check_ip6_tree(const int mode, const struct tcpr_in6_addr *addr)
              "Try a different auto mode (-n router|client|server)",
              get_addr2name6(addr, RESOLVE));
 
-#ifdef DEBUG
-    switch (node->type) {
-    case DIR_SERVER:
-        dbgx(1, "DIR_SERVER: %s", get_addr2name6(addr, RESOLVE));
-        break;
-    case DIR_CLIENT:
-        dbgx(1, "DIR_CLIENT: %s", get_addr2name6(addr, RESOLVE));
-        break;
-    case DIR_UNKNOWN:
-        dbgx(1, "DIR_UNKNOWN: %s", get_addr2name6(addr, RESOLVE));
-        break;
-    case DIR_ANY:
-        dbgx(1, "DIR_ANY: %s", get_addr2name6(addr, RESOLVE));
-        break;
-    }
-#endif
-
     /*
      * FIXME: Is this logic correct?  I think this might be backwards :(
      */
 
     /* return node type if we found the node, else return the default (mode) */
     if (node != NULL) {
+#ifdef DEBUG
+        switch (node->type) {
+        case DIR_SERVER:
+            dbgx(1, "DIR_SERVER: %s", get_addr2name6(addr, RESOLVE));
+            break;
+        case DIR_CLIENT:
+            dbgx(1, "DIR_CLIENT: %s", get_addr2name6(addr, RESOLVE));
+            break;
+        case DIR_UNKNOWN:
+            dbgx(1, "DIR_UNKNOWN: %s", get_addr2name6(addr, RESOLVE));
+            break;
+        case DIR_ANY:
+            dbgx(1, "DIR_ANY: %s", get_addr2name6(addr, RESOLVE));
+            break;
+        }
+#endif
         switch (node->type) {
         case DIR_SERVER:
             return TCPR_DIR_C2S;