From af4634a1c198a35936c8e3dfe4fcf163b0d2ece0 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Tue, 14 Jan 2025 13:25:59 -0700 Subject: [PATCH] expand_include: initialize dst_size to 1 to quiet coverity warning This could only be an issue if the sudoers file was an empty string, which is not possible. --- plugins/sudoers/toke.c | 7 ++++--- plugins/sudoers/toke.l | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c index 8832a3f31..24e5cf9db 100644 --- a/plugins/sudoers/toke.c +++ b/plugins/sudoers/toke.c @@ -3262,7 +3262,7 @@ char *yytext; /* * SPDX-License-Identifier: ISC * - * Copyright (c) 1996, 1998-2005, 2007-2024 + * Copyright (c) 1996, 1998-2005, 2007-2025 * Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any @@ -5982,14 +5982,15 @@ expand_include(const char *src, const char *host) * If the current sudoers file was opened via a colon-separated path, * use the same path when opening src. */ - dst_size = 0; + dst_size = 1; for (cp = sudo_strsplit(path, path_end, ":", &ep); cp != NULL; cp = sudo_strsplit(NULL, path_end, ":", &ep)) { char *dirend = memrchr(cp, '/', (size_t)(ep - cp)); if (dirend != NULL) { + /* Include space for trailing '/' separator. */ dst_size += (size_t)(dirend - cp) + 1; } - /* Includes space for ':' separator and NUL terminator. */ + /* Includes space for expanded host and ':' separator. */ dst_size += src_len + (nhost * strlen(host)) - (nhost * 2) + 1; } diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l index 195d71334..9a930f207 100644 --- a/plugins/sudoers/toke.l +++ b/plugins/sudoers/toke.l @@ -2,7 +2,7 @@ /* * SPDX-License-Identifier: ISC * - * Copyright (c) 1996, 1998-2005, 2007-2024 + * Copyright (c) 1996, 1998-2005, 2007-2025 * Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any @@ -1203,14 +1203,15 @@ expand_include(const char *src, const char *host) * If the current sudoers file was opened via a colon-separated path, * use the same path when opening src. */ - dst_size = 0; + dst_size = 1; for (cp = sudo_strsplit(path, path_end, ":", &ep); cp != NULL; cp = sudo_strsplit(NULL, path_end, ":", &ep)) { char *dirend = memrchr(cp, '/', (size_t)(ep - cp)); if (dirend != NULL) { + /* Include space for trailing '/' separator. */ dst_size += (size_t)(dirend - cp) + 1; } - /* Includes space for ':' separator and NUL terminator. */ + /* Includes space for expanded host and ':' separator. */ dst_size += src_len + (nhost * strlen(host)) - (nhost * 2) + 1; }