From 323f0488c24044971adf5180fed9f41d91a87b13 Mon Sep 17 00:00:00 2001
From: Eliseo Martínez <eliseomarmol@gmail.com>
Date: Tue, 27 Jan 2015 15:51:52 +0100
Subject: coverity/15019: String not null terminated: FP.

Problem    : String not null terminated @ 1165.
Diagnostic : False positive.
Rationale  : Code below terminates string (with NUL or '\n').
Resolution : Add explanatory comment, and assert termination.
             Mark as Intentional at coverity's database.
---
 src/nvim/os_unix.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'src/nvim/os_unix.c')

diff --git a/src/nvim/os_unix.c b/src/nvim/os_unix.c
index f7b47f9569..15185aca49 100644
--- a/src/nvim/os_unix.c
+++ b/src/nvim/os_unix.c
@@ -13,6 +13,7 @@
  * changed beyond recognition.
  */
 
+#include <assert.h>
 #include <errno.h>
 #include <inttypes.h>
 #include <stdbool.h>
@@ -1162,6 +1163,8 @@ int mch_expand_wildcards(int num_pat, char_u **pat, int *num_file,
   len = ftell(fd);                      /* get size of temp file */
   fseek(fd, 0L, SEEK_SET);
   buffer = xmalloc(len + 1);
+  // fread() doesn't terminate buffer with NUL;
+  // appropiate termination (not always NUL) is done below.
   i = fread((char *)buffer, 1, len, fd);
   fclose(fd);
   os_remove((char *)tempname);
@@ -1174,8 +1177,6 @@ int mch_expand_wildcards(int num_pat, char_u **pat, int *num_file,
   }
   free(tempname);
 
-
-
   /* file names are separated with Space */
   if (shell_style == STYLE_ECHO) {
     buffer[len] = '\n';                 /* make sure the buffer ends in NL */
@@ -1235,6 +1236,8 @@ int mch_expand_wildcards(int num_pat, char_u **pat, int *num_file,
     if (len)
       ++i;                              /* count last entry */
   }
+  assert(buffer[len] == NUL || buffer[len] == '\n');
+
   if (i == 0) {
     /*
      * Can happen when using /bin/sh and typing ":e $NO_SUCH_VAR^I".
-- 
cgit 


From 4d0ef9a6b92953eb06937c3f74001909bd071c86 Mon Sep 17 00:00:00 2001
From: Eliseo Martínez <eliseomarmol@gmail.com>
Date: Tue, 27 Jan 2015 17:02:57 +0100
Subject: coverity/13745: Argument cannot be negative: RI.

Problem    : Argument cannot be negative @ 1165.
Diagnostic : Real issue.
Rationale  : len can be assigned a negative value @ 1162;
             len is passed as an unsigned argument @ 1165.
Resolution : Refactor variable's types:
             - Use ftello instead of ftell to avoid using long.
             - Assert ftello result is safely convertible to size_t.
             - Introduce variable read_size to avoid using i (int).
---
 src/nvim/os_unix.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

(limited to 'src/nvim/os_unix.c')

diff --git a/src/nvim/os_unix.c b/src/nvim/os_unix.c
index 15185aca49..d674db951f 100644
--- a/src/nvim/os_unix.c
+++ b/src/nvim/os_unix.c
@@ -1159,16 +1159,30 @@ int mch_expand_wildcards(int num_pat, char_u **pat, int *num_file,
     free(tempname);
     goto notfound;
   }
-  fseek(fd, 0L, SEEK_END);
-  len = ftell(fd);                      /* get size of temp file */
+  int fseek_res = fseek(fd, 0L, SEEK_END);
+  if (fseek_res < 0) {
+    free(tempname);
+    fclose(fd);
+    return FAIL;
+  }
+  long long templen = ftell(fd);        /* get size of temp file */
+  if (templen < 0) {
+    free(tempname);
+    fclose(fd);
+    return FAIL;
+  }
+#if SIZEOF_LONG_LONG > SIZEOF_SIZE_T
+  assert(templen <= (long long)SIZE_MAX);
+#endif
+  len = (size_t)templen;
   fseek(fd, 0L, SEEK_SET);
   buffer = xmalloc(len + 1);
   // fread() doesn't terminate buffer with NUL;
   // appropiate termination (not always NUL) is done below.
-  i = fread((char *)buffer, 1, len, fd);
+  size_t readlen = fread((char *)buffer, 1, len, fd);
   fclose(fd);
   os_remove((char *)tempname);
-  if (i != (int)len) {
+  if (readlen != len) {
     /* unexpected read error */
     EMSG2(_(e_notread), tempname);
     free(tempname);
-- 
cgit