Advertisement
PVS-StudioWarnings

PVS-Studio warning V526 for nss

Nov 24th, 2014
201
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.03 KB | None | 0 0
  1. static SECStatus
  2. ssl3_SendEncryptedExtensions(sslSocket *ss)
  3. {
  4.   static const unsigned char P256_SPKI_PREFIX[] = {
  5.     0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86,
  6.     0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a,
  7.     0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03,
  8.     0x42, 0x00, 0x04
  9.   };
  10.   ....
  11.   if (.... ||
  12.       memcmp(spki->data, P256_SPKI_PREFIX,
  13.              sizeof(P256_SPKI_PREFIX) != 0))
  14.   {
  15.     PORT_SetError(SSL_ERROR_INVALID_CHANNEL_ID_KEY);
  16.     rv = SECFailure;
  17.     goto loser;
  18.   }
  19.   ....
  20. }
  21.  
  22. This is what should have been written here: memcmp(spki->data, P256_SPKI_PREFIX, sizeof(P256_SPKI_PREFIX)) != 0)
  23.  
  24. This suspicious code was found in nss project by PVS-Studio static code analyzer.
  25. Warning message is:
  26. V526 The 'memcmp' function returns 0 if corresponding buffers are equal. Consider examining the condition for mistakes. ssl3con.c 10533
  27.  
  28. PVS-Studio is a static analyzer for detecting bugs in the source code of applications written in C, C++, C++11, C++/CX. Site: http://www.viva64.com/en/pvs-studio/
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement