From 7e58d78bfee8d69963029e798a73acbcc748b5b8 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 18:36:03 +0100 Subject: [PATCH 01/11] proto/base: fix copy and paste bug in uwsgi_proto_base_cgi_prepare_headers Reported by Coverity as CID #989253 --- proto/base.c | 1 - 1 file changed, 1 deletion(-) diff --git a/proto/base.c b/proto/base.c index f46da7f1..6b424db0 100644 --- a/proto/base.c +++ b/proto/base.c @@ -155,7 +155,6 @@ end: struct uwsgi_buffer *uwsgi_proto_base_cgi_prepare_headers(struct wsgi_request *wsgi_req, char *s, uint16_t sl) { struct uwsgi_buffer *ub = uwsgi_buffer_new(8 + sl + 2); - ub = uwsgi_buffer_new(8 + sl + 2); if (uwsgi_buffer_append(ub, "Status: ", 8)) goto end; if (uwsgi_buffer_append(ub, s, sl)) goto end; if (uwsgi_buffer_append(ub, "\r\n", 2)) goto end; From 18dfd10b71ea05eb22888084a833086a3b0e99a3 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 18:44:33 +0100 Subject: [PATCH 02/11] core/exceptions: fix memory leak in wsgi_exception_setup_handlers Reported by Coverity as CID #989249. --- core/exceptions.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/core/exceptions.c b/core/exceptions.c index fdaf0a04..32bf468a 100644 --- a/core/exceptions.c +++ b/core/exceptions.c @@ -473,8 +473,11 @@ void uwsgi_exception_setup_handlers() { struct uwsgi_exception_handler *ueh = uwsgi_exception_handler_by_name(handler); if (!ueh) { uwsgi_log("unable to find exception handler: %s\n", handler); + free(handler); exit(1); } + free(handler); + struct uwsgi_exception_handler_instance *uehi = uwsgi_calloc(sizeof(struct uwsgi_exception_handler_instance)); uehi->handler = ueh; if (colon) { From cf634e11a9658b71e25e00b02f7cabfeef4f44b3 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 18:48:59 +0100 Subject: [PATCH 03/11] core/exceptions: fix leak in uwsgi_exception_handler_thread_loop Reported by Coverity as CID #989248. --- core/exceptions.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/exceptions.c b/core/exceptions.c index 32bf468a..fe7e69f6 100644 --- a/core/exceptions.c +++ b/core/exceptions.c @@ -452,13 +452,15 @@ static void uwsgi_exception_handler_thread_loop(struct uwsgi_thread *ut) { long ptr = 0; memcpy(&ptr, buf, sizeof(long)); struct uwsgi_exception_handler_instance *uehi = (struct uwsgi_exception_handler_instance *) ptr; - if (!uehi) return; + if (!uehi) + break; if (uehi->handler->func(uehi, msg, msg_size)) { uwsgi_log("[uwsgi-exception] error running the handler \"%s\" args: \"%s\"\n", uehi->handler->name, uehi->arg ? uehi->arg : ""); } } } } + free(buf); } void uwsgi_exception_setup_handlers() { From 133dff6b760c4b220a6d79372ead845d30d8977e Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 18:51:46 +0100 Subject: [PATCH 04/11] core/alarm: fix memory leak in uwsgi_alarm_thread_loop Rpoerted by Coverity as CID #989247. --- core/alarm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/alarm.c b/core/alarm.c index 46c53e66..2a60423a 100644 --- a/core/alarm.c +++ b/core/alarm.c @@ -201,11 +201,13 @@ static void uwsgi_alarm_thread_loop(struct uwsgi_thread *ut) { long ptr = 0; memcpy(&ptr, buf, sizeof(long)); struct uwsgi_alarm_instance *uai = (struct uwsgi_alarm_instance *) ptr; - if (!uai) return; + if (!uai) + break; uwsgi_alarm_run(uai, msg, msg_size); } } } + free(buf); } // initialize alarms, instances and log regexps From eae00a5c77e0707084381adf2274996e0c0ad2fe Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 18:56:46 +0100 Subject: [PATCH 05/11] core/subscription: fix wrong check in uwsgi_subscribe2 It looks like both s2_server and s2_key are mandatory in uwsgi_send_subscription so fail if any of them is missing not both. Reported by coverity as CID #989245. --- core/subscription.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/subscription.c b/core/subscription.c index ad7f1788..3cf9926c 100644 --- a/core/subscription.c +++ b/core/subscription.c @@ -767,7 +767,7 @@ void uwsgi_subscribe2(char *arg, uint8_t cmd) { return; } - if (!s2_server && !s2_key) goto end; + if (!s2_server || !s2_key) goto end; if (s2_check) { if (uwsgi_file_exists(s2_check)) goto end; From 07bd3f5df04093b3b2f75b69514bc22d61066619 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:06:59 +0100 Subject: [PATCH 06/11] core/exception: avoid null pointer dereference in uwsgi_exception_run_handlers If wsgi_req is NULL and uwsgi.reload_on_exception is True Reported by Coverity as CID #989244. --- core/exceptions.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/core/exceptions.c b/core/exceptions.c index fe7e69f6..b67ba8df 100644 --- a/core/exceptions.c +++ b/core/exceptions.c @@ -316,12 +316,11 @@ static void uwsgi_exception_run_handlers(struct uwsgi_buffer *ub) { void uwsgi_manage_exception(struct wsgi_request *wsgi_req,int catch) { - int do_exit = 0; + int do_exit = uwsgi.reload_on_exception; - if (uwsgi.reload_on_exception) { - do_exit = 1; - goto check_catch; - } + if (!wsgi_req) goto log2; + + if (do_exit) goto check_catch; if (wsgi_req && uwsgi.exception_handlers_instance) { struct uwsgi_buffer *ehi = uwsgi_exception_handler_object(wsgi_req); @@ -331,8 +330,6 @@ void uwsgi_manage_exception(struct wsgi_request *wsgi_req,int catch) { } } - if (!wsgi_req) goto log2; - uwsgi.workers[uwsgi.mywid].cores[wsgi_req->async_id].exceptions++; uwsgi_apps[wsgi_req->app_id].exceptions++; From 192c73d53d780c477903ca7547a1f7587530ff1e Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:17:18 +0100 Subject: [PATCH 07/11] plugins/router_http: Fix copy and paste bug in uwsgi_routing_func_http Don't redeclare ub_url since it is already there. Reported by Coverity as CID #989243, #989252. --- plugins/router_http/router_http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/router_http/router_http.c b/plugins/router_http/router_http.c index 87763dc1..6065b485 100644 --- a/plugins/router_http/router_http.c +++ b/plugins/router_http/router_http.c @@ -16,7 +16,7 @@ static int uwsgi_routing_func_http(struct wsgi_request *wsgi_req, struct uwsgi_r if (ur->data3_len) { char **subject = (char **) (((char *)(wsgi_req))+ur->subject); uint16_t *subject_len = (uint16_t *) (((char *)(wsgi_req))+ur->subject_len); - struct uwsgi_buffer *ub_url = uwsgi_routing_translate(wsgi_req, ur, *subject, *subject_len, ur->data3, ur->data3_len); + ub_url = uwsgi_routing_translate(wsgi_req, ur, *subject, *subject_len, ur->data3, ur->data3_len); if (!ub_url) return UWSGI_ROUTE_BREAK; } From f102ef64da6432cb58fee968f62abff3c1eb9948 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:37:49 +0100 Subject: [PATCH 08/11] core/static: Add missing break in switch Reported by Coverity as CID #970990. --- core/static.c | 1 + 1 file changed, 1 insertion(+) diff --git a/core/static.c b/core/static.c index 5d318061..e263f220 100644 --- a/core/static.c +++ b/core/static.c @@ -148,6 +148,7 @@ static time_t parse_http_date(char *date, uint16_t len) { case 'N': hdtm.tm_mon = 10; + break; case 'D': hdtm.tm_mon = 11; From e4e346772a15e08ba4452484c62636c230cbefae Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:44:30 +0100 Subject: [PATCH 09/11] core/ini: change ini_get_line size type The only user of ini_get_line uses a size_t as size. Since off_t and size_t have different storage size just switch ini_get_line to size_t. Reported by Coverity as CID #970984. --- core/ini.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/ini.c b/core/ini.c index 5fc9fcd0..faed46ca 100644 --- a/core/ini.c +++ b/core/ini.c @@ -54,7 +54,7 @@ char *ini_get_key(char *key) { return ptr; } -char *ini_get_line(char *ini, off_t size) { +char *ini_get_line(char *ini, size_t size) { off_t i; char *ptr = ini; From 0b0a0ccce111192adfbb6141f7ecd50adda8e804 Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:47:45 +0100 Subject: [PATCH 10/11] core/yaml: use size_t for buffer lenght in yaml_get_line As the only user pass a size_t value and they have different storage size. Reported by Coverity as CID #970987. --- core/yaml.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/yaml.c b/core/yaml.c index 14179256..c69c49c4 100644 --- a/core/yaml.c +++ b/core/yaml.c @@ -61,7 +61,7 @@ int yaml_get_depth(char *line) { return depth; } -char *yaml_get_line(char *yaml, off_t size) { +char *yaml_get_line(char *yaml, size_t size) { off_t i; char *ptr = yaml; From 511a0aca0be1ad93167c49b1b77f23b86681289c Mon Sep 17 00:00:00 2001 From: Riccardo Magliocchetti Date: Sun, 3 Mar 2013 19:51:40 +0100 Subject: [PATCH 11/11] plugins/http: remove self assignment Also while at it cleanup the handling of the if branch around the ifdefery. Reported by Coverity as CID #970999. --- plugins/http/keepalive.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/plugins/http/keepalive.c b/plugins/http/keepalive.c index 1396521a..48164463 100644 --- a/plugins/http/keepalive.c +++ b/plugins/http/keepalive.c @@ -152,12 +152,9 @@ int http_response_parse(struct http_session *hr, struct uwsgi_buffer *ub, size_t } } - hr->session.can_keepalive = hr->session.can_keepalive; - } - else if (hr->session.can_keepalive) { -#else - if (hr->session.can_keepalive) { + } else #endif + if (hr->session.can_keepalive) { if (uhttp.auto_chunked) { char cr = buf[len-2]; char nl = buf[len-1];