Skip to content

Scan-build: Add in CI #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mrdeep1 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Scan-build: Add in CI #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,18 @@ jobs:
with:
python-version: 3.x
- uses: pre-commit/action@v3.0.1
scan-build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: setup
run: |
sudo apt-get update && sudo apt-get install -y libcunit1-dev libtool libtool-bin exuberant-ctags clang-tools
./autogen.sh
- name: check
run: |
$GITHUB_WORKSPACE/configure --enable-tests
scan-build --status-bugs make EXTRA_CFLAGS=-DSCAN_BUILD_IGNORE_DEADSTORES

build-linux-autotools:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -91,6 +103,7 @@ jobs:
cd build_test
cmake -DWARNING_TO_ERROR=ON -Dmake_tests=ON ..
cmake --build .

build-macos-cmake:
name: Build for macOS using CMake
runs-on: macos-latest
Expand Down
3 changes: 3 additions & 0 deletions ccm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,6 +287,9 @@ dtls_ccm_decrypt_message(rijndael_ctx *ctx, size_t M, size_t L,
msg += lm;
}

/* Check that SET_COUNTER() does not overflow in L shift */
assert(L <= 8);

/* calculate S_0 */
SET_COUNTER(A, L, 0, counter_tmp);
rijndael_encrypt(ctx, A, S);
Expand Down
13 changes: 11 additions & 2 deletions dtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2446,7 +2446,6 @@ dtls_check_ecdsa_signature_elem(uint8 *data, size_t data_length,
if (ret <= 0)
return ret;
data += ret;
data_length -= ret;

return data - data_orig;
}
Expand Down Expand Up @@ -2483,8 +2482,10 @@ check_client_certificate_verify(dtls_context_t *ctx,
if (ret < 0) {
return ret;
}
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
data += ret;
data_length -= ret;
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */

copy_hs_hash(peer, &hs_hash);

Expand Down Expand Up @@ -3088,6 +3089,7 @@ dtls_send_certificate_verify_ecdh(dtls_context_t *ctx, dtls_peer_t *peer,

dtls_hash_finalize(sha256hash, &hs_hash);

assert(key);
/* sign the ephemeral and its parameters */
dtls_ecdsa_create_sig_hash(key->priv_key, DTLS_EC_KEY_SIZE,
sha256hash, sizeof(sha256hash),
Expand Down Expand Up @@ -3487,7 +3489,9 @@ check_server_certificate(dtls_context_t *ctx,

memcpy(config->keyx.ecdsa.other_pub_y, data,
sizeof(config->keyx.ecdsa.other_pub_y));
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
data += sizeof(config->keyx.ecdsa.other_pub_y);
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */

err = CALL(ctx, verify_ecdsa_key, &peer->session,
config->keyx.ecdsa.other_pub_x,
Expand Down Expand Up @@ -3571,8 +3575,10 @@ check_server_key_exchange_ecdsa(dtls_context_t *ctx,
if (ret < 0) {
return ret;
}
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
data += ret;
data_length -= ret;
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */

ret = dtls_ecdsa_verify_sig(config->keyx.ecdsa.other_pub_x, config->keyx.ecdsa.other_pub_y,
sizeof(config->keyx.ecdsa.other_pub_x),
Expand Down Expand Up @@ -3729,7 +3735,7 @@ check_server_hellodone(dtls_context_t *ctx,
{
int res;
#ifdef DTLS_ECC
const dtls_ecdsa_key_t *ecdsa_key;
const dtls_ecdsa_key_t *ecdsa_key = NULL;
#endif /* DTLS_ECC */

dtls_handshake_parameters_t *handshake = peer->handshake_params;
Expand Down Expand Up @@ -4785,6 +4791,9 @@ dtls_handle_message(dtls_context_t *ctx,
dtls_info("received close_notify alert, peer has been invalidated\n");
else
dtls_warn("received fatal alert, peer has been invalidated\n");
/* handle alert has invalidated peer */
peer = NULL;
/* no more valid records after fatal alerts */
return 0;
} else {
dtls_stop_retransmission(ctx, peer);
Expand Down
1 change: 0 additions & 1 deletion dtls_debug.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,6 @@ dsrv_print_addr(const session_t *addr, char *buf, size_t len) {
return 0;
}
p += err;
len -= err;

return p - buf;
#else /* ! HAVE_INET_NTOP */
Expand Down
8 changes: 8 additions & 0 deletions sha2/sha2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,8 +575,10 @@ void dtls_sha256_transform(dtls_sha256_ctx* context, const sha2_byte* data) {
context->state[6] += g;
context->state[7] += h;

#ifndef SCAN_BUILD_IGNORE_DEADSTORES
/* Clean up */
a = b = c = d = e = f = g = h = T1 = T2 = 0;

@boaks boaks Oct 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume, that someone wants to remove these values to protect them from "whatever". Why is that removed?

@mrdeep1 mrdeep1 Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. PR updated so that these variables (and others) are cleared under normal operation, but not when running scan-build by wrapping the statements with

#ifndef SCAN_BUILD_IGNORE_DEADSTORES
  ...
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */

which is locally defined when running scan-build.

#endif /* SCAN_BUILD_IGNORE_DEADSTORES */
}

#endif /* SHA2_UNROLL_TRANSFORM */
Expand Down Expand Up @@ -608,8 +610,10 @@ void dtls_sha256_update(dtls_sha256_ctx* context, const sha2_byte *data, size_t
/* The buffer is not yet full */
MEMCPY_BCOPY(&context->buffer[usedspace], data, len);
context->bitcount += len << 3;
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
/* Clean up: */
usedspace = freespace = 0;
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */
return;
}
}
Expand All @@ -625,8 +629,10 @@ void dtls_sha256_update(dtls_sha256_ctx* context, const sha2_byte *data, size_t
MEMCPY_BCOPY(context->buffer, data, len);
context->bitcount += len << 3;
}
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
/* Clean up: */
usedspace = freespace = 0;
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */
}

void dtls_sha256_final(uint8_t digest[DTLS_SHA256_DIGEST_LENGTH], dtls_sha256_ctx* context) {
Expand Down Expand Up @@ -686,7 +692,9 @@ void dtls_sha256_final(uint8_t digest[DTLS_SHA256_DIGEST_LENGTH], dtls_sha256_ct

/* Clean up state data: */
MEMSET_BZERO(context, sizeof(*context));
#ifndef SCAN_BUILD_IGNORE_DEADSTORES
usedspace = 0;
#endif /* SCAN_BUILD_IGNORE_DEADSTORES */
}

char *dtls_sha256_end(dtls_sha256_ctx* context, char buffer[DTLS_SHA256_DIGEST_STRING_LENGTH]) {
Expand Down
1 change: 0 additions & 1 deletion tests/dtls-client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,6 @@ try_send(struct dtls_context_t *ctx, session_t *dst, size_t len, char *buf) {
res = dtls_write(ctx, dst, (uint8 *)buf, len);
if (res >= 0) {
memmove(buf, buf + res, len - res);
len -= res;
}
}

Expand Down
1 change: 1 addition & 0 deletions tests/unit-tests/test_ecc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,7 @@ t_test_ecc_ecdsa0(void) {
ecc_ec_mult(BasePointx, BasePointy, ecdsaTestSecret, pub_x, pub_y);

ret = ecc_ecdsa_sign(ecdsaTestSecret, ecdsaTestMessage, ecdsaTestRand1, tempx, tempy);
CU_ASSERT(ret == 0);

memset(tempy, 0, sizeof(tempy));
ret = ecc_ecdsa_validate(pub_x, pub_y, ecdsaTestMessage, tempx, tempy);
Expand Down
Loading