From 1448fbc5a3d75d5826972d9121876c2576beeb17 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sat, 8 Feb 2014 12:36:09 +0100 Subject: [PATCH 1/5] ssl: Fix fd leak on write error Reported by Coverity as CID #1167591 --- core/ssl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/core/ssl.c b/core/ssl.c index 1d7a65fa..197166ca 100644 --- a/core/ssl.c +++ b/core/ssl.c @@ -181,6 +181,7 @@ char *uwsgi_write_pem_to_file(char *name, char *buf, size_t len, char *ext) { uwsgi_log("unable to write pem data in file %s\n", filename); uwsgi_error("uwsgi_write_pem_to_file()/write()"); free(filename); + close(fd); return NULL; } From e9a58bac463103bbf8db8f3cd217ab21fce6e791 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sat, 8 Feb 2014 12:39:58 +0100 Subject: [PATCH 2/5] ssl: avoid null pointer dereference name is checked not to be null earlier, if it is here just error out. Reported by Coverity as CID #1167590 --- core/ssl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/ssl.c b/core/ssl.c index 197166ca..c9c18452 100644 --- a/core/ssl.c +++ b/core/ssl.c @@ -305,6 +305,10 @@ SSL_CTX *uwsgi_ssl_new_server_context(char *name, char *crt, char *key, char *ci SSL_CTX_set_verify_depth(ctx, 1); if (uwsgi.ssl_tmp_dir && !uwsgi_starts_with(client_ca, strlen(client_ca), "-----BEGIN ", 11)) { + if (!name) { + SSL_CTX_free(ctx); + return NULL; + } client_ca = uwsgi_write_pem_to_file(name, client_ca, strlen(client_ca), ".ca"); if (!client_ca) { SSL_CTX_free(ctx); From e143e25b3c54eef5ef5c921b498da6163ff79409 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sat, 8 Feb 2014 12:45:47 +0100 Subject: [PATCH 3/5] spooler: fix use after free Reported by Coverity as CID #1153073 --- core/spooler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/spooler.c b/core/spooler.c index 713cd829..892503a5 100644 --- a/core/spooler.c +++ b/core/spooler.c @@ -374,12 +374,12 @@ char *uwsgi_spool_request(struct wsgi_request *wsgi_req, char *buf, size_t len, clear: - if (filename) free(filename); uwsgi_unlock(uspool->lock); uwsgi_error("uwsgi_spool_request()/write()"); if (unlink(filename)) { uwsgi_error("uwsgi_spool_request()/unlink()"); } + if (filename) free(filename); // unlock the file too close(fd); return NULL; From ce260ecbb6798dab2db20774dac9c08525bcf936 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sat, 8 Feb 2014 12:49:17 +0100 Subject: [PATCH 4/5] spooler: filename cannot be null Since it is allocated by uwsgi_malloc. Reported by Coverity as CID #1153071 --- core/spooler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/spooler.c b/core/spooler.c index 892503a5..2245ecee 100644 --- a/core/spooler.c +++ b/core/spooler.c @@ -379,7 +379,7 @@ clear: if (unlink(filename)) { uwsgi_error("uwsgi_spool_request()/unlink()"); } - if (filename) free(filename); + free(filename); // unlock the file too close(fd); return NULL; From 6e6efc5605b51883bb47f812ef1e2d302bd9e45c Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sat, 8 Feb 2014 12:52:20 +0100 Subject: [PATCH 5/5] plugins/logpipe: check setsid return code Reported by Coverity as CID #1167589 --- plugins/logpipe/logpipe.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/logpipe/logpipe.c b/plugins/logpipe/logpipe.c index 9e14fad6..859003ef 100644 --- a/plugins/logpipe/logpipe.c +++ b/plugins/logpipe/logpipe.c @@ -29,6 +29,10 @@ static ssize_t uwsgi_pipe_logger(struct uwsgi_logger *ul, char *message, size_t else { // child setsid(); + if (setsid() < 0) { + uwsgi_error("setsid()"); + exit(1); + } close(pipefd[1]); dup2(pipefd[0], STDIN_FILENO); close(pipefd[0]);