From c40133d84062cd5a92fb7ab90b9db5a348d2ae2b Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Wed, 27 Jan 2021 17:17:36 +1100 Subject: [PATCH] Silence Insecure data handling (TAINTED_SCALAR) Coverity assumes that the memory holding any value read using byte swapping is tainted. As we store the NSEC3PARAM records in wire form and iterations is byte swapped the memory holding the record is marked as tainted. nsec3->salt_length is marked as tainted transitively. To remove the taint the value need to be range checked. For a correctly formatted record region.length should match nsec3->salt_length and provides a convenient value to check the field against. *** CID 316507: Insecure data handling (TAINTED_SCALAR) /lib/dns/rdata/generic/nsec3param_51.c: 241 in tostruct_nsec3param() 235 region.length = rdata->length; 236 nsec3param->hash = uint8_consume_fromregion(®ion); 237 nsec3param->flags = uint8_consume_fromregion(®ion); 238 nsec3param->iterations = uint16_consume_fromregion(®ion); 239 240 nsec3param->salt_length = uint8_consume_fromregion(®ion); >>> CID 316507: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "nsec3param->salt_length" to "mem_maybedup", which uses it as an offset. 241 nsec3param->salt = mem_maybedup(mctx, region.base, 242 nsec3param->salt_length); 243 if (nsec3param->salt == NULL) { 244 return (ISC_R_NOMEMORY); 245 } 246 isc_region_consume(®ion, nsec3param->salt_length); --- lib/dns/rdata/generic/nsec3param_51.c | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/dns/rdata/generic/nsec3param_51.c b/lib/dns/rdata/generic/nsec3param_51.c index 669c2c75a6..1cc56e5ae2 100644 --- a/lib/dns/rdata/generic/nsec3param_51.c +++ b/lib/dns/rdata/generic/nsec3param_51.c @@ -238,6 +238,7 @@ tostruct_nsec3param(ARGS_TOSTRUCT) { nsec3param->iterations = uint16_consume_fromregion(®ion); nsec3param->salt_length = uint8_consume_fromregion(®ion); + INSIST(nsec3param->salt_length == region.length); nsec3param->salt = mem_maybedup(mctx, region.base, nsec3param->salt_length); if (nsec3param->salt == NULL) {