On Mon, 5 May 2025 at 10:54, Christian Schoenebeck
<[email protected]> wrote:
>
> From: Greg Kurz <[email protected]>
>
> Factor out duplicated code to a single helper. More users to come.
Hi; Coverity complains about the callsites of this new
helper (CID 1660923, 1660924, 1660925):
> +static int local_fid_fd(int fid_type, V9fsFidOpenState *fs)
> +{
> + if (fid_type == P9_FID_DIR) {
> + return dirfd(fs->dir.stream);
> + } else {
> + return fs->fd;
> + }
> +}
dirfd() can fail and return -1, so this function is "returns a
file descriptor, or -1 on error"...
> +
> static int local_fstat(FsContext *fs_ctx, int fid_type,
> V9fsFidOpenState *fs, struct stat *stbuf)
> {
> - int err, fd;
> -
> - if (fid_type == P9_FID_DIR) {
> - fd = dirfd(fs->dir.stream);
> - } else {
> - fd = fs->fd;
> - }
> + int err, fd = local_fid_fd(fid_type, fs);
>
> err = fstat(fd, stbuf);
...but the callsites don't check for error, and instead can
feed -1 into fstat() or other functions, which isn't a valid
filedescriptor.
thanks
-- PMM
