From de688f350f5ade61998f76d7b9512764af37f636 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 16:57:16 +0200 Subject: [PATCH] libkmipclient: Fix invalid return of -1 for an unsigned int MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Functions kmip_node_get_structure_element_count() and kmip_node_get_structure_element_by_tag_count() return an unsigned int, but the error case returns -1. This leads to a wrap around actually returning 0xffffffff which the caller might interpret as a very large number of elements. Return 0 in case of an error instead. Also fix some callers to not unconditionally subtract -1 from the returned value, but return an error if the returned value is zero. These callers check the preconditions upfront, so the error case won't be hit anyway. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libkmipclient/key.c | 10 ++++++++-- libkmipclient/kmip.c | 12 ++++++------ libkmipclient/response.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 12 deletions(-) diff --git a/libkmipclient/key.c b/libkmipclient/key.c index d701e036..fd6aefd8 100644 --- a/libkmipclient/key.c +++ b/libkmipclient/key.c @@ -426,8 +426,14 @@ int kmip_get_key_value(const struct kmip_node *node, /* Must be a KMIP v1.x attribute then */ kmip_node_free(attr); - if (num_attrs != NULL) - *num_attrs = kmip_node_get_structure_element_count(node) - 1; + if (num_attrs != NULL) { + *num_attrs = kmip_node_get_structure_element_count(node); + if (*num_attrs == 0) { + rc = -EBADMSG; + goto error; + } + (*num_attrs)--; + } if (v2_attr == NULL) return 0; diff --git a/libkmipclient/kmip.c b/libkmipclient/kmip.c index 7d847798..3ed8e6bf 100644 --- a/libkmipclient/kmip.c +++ b/libkmipclient/kmip.c @@ -258,7 +258,7 @@ int kmip_node_add_structure_elements(struct kmip_node *node, * * @param node the KMIP node * - * @returns the number of elements, or -1 if the node is not of type structure + * @returns the number of elements, or 0 if the node is not of type structure */ unsigned int kmip_node_get_structure_element_count(const struct kmip_node *node) { @@ -266,10 +266,10 @@ unsigned int kmip_node_get_structure_element_count(const struct kmip_node *node) unsigned int i; if (node == NULL) - return -1; + return 0; if (node->type != KMIP_TYPE_STRUCTURE) - return -1; + return 0; element = node->structure_value; for (i = 0; element != NULL; i++) @@ -319,7 +319,7 @@ struct kmip_node *kmip_node_get_structure_element_by_index( * @param node the KMIP node * @param tag the tag to find * - * @returns the number of elements, or -1 if the node is not of type structure + * @returns the number of elements, or 0 if the node is not of type structure */ unsigned int kmip_node_get_structure_element_by_tag_count( const struct kmip_node *node, @@ -329,10 +329,10 @@ unsigned int kmip_node_get_structure_element_by_tag_count( unsigned int i; if (node == NULL) - return -1; + return 0; if (node->type != KMIP_TYPE_STRUCTURE) - return -1; + return 0; element = node->structure_value; for (i = 0; element != NULL; element = element->next) { diff --git a/libkmipclient/response.c b/libkmipclient/response.c index 58804a7d..ace54b37 100644 --- a/libkmipclient/response.c +++ b/libkmipclient/response.c @@ -686,14 +686,20 @@ int kmip_get_get_attribute_list_response_payload(const struct kmip_node *node, if (kmip_node_get_tag(node) != KMIP_TAG_RESPONSE_PAYLOAD) return -EBADMSG; + if (kmip_node_get_type(node) != KMIP_TYPE_STRUCTURE) + return -EBADMSG; if (unique_id != NULL) *unique_id = kmip_node_get_structure_element_by_tag(node, KMIP_TAG_UNIQUE_IDENTIFIER, 0); - if (num_attr_refs != NULL) + if (num_attr_refs != NULL) { *num_attr_refs = - kmip_node_get_structure_element_count(node) - 1; + kmip_node_get_structure_element_count(node); + if (*num_attr_refs == 0) + return -EBADMSG; + (*num_attr_refs)--; + } if (attr_ref == NULL) return 0; @@ -766,6 +772,8 @@ int kmip_get_get_attributes_response_payload(const struct kmip_node *node, if (kmip_node_get_tag(node) != KMIP_TAG_RESPONSE_PAYLOAD) return -EBADMSG; + if (kmip_node_get_type(node) != KMIP_TYPE_STRUCTURE) + return -EBADMSG; if (unique_id != NULL) *unique_id = kmip_node_get_structure_element_by_tag(node, @@ -798,8 +806,12 @@ int kmip_get_get_attributes_response_payload(const struct kmip_node *node, /* Must be a KMIP v1.x attribute then */ kmip_node_free(attr); - if (num_attrs != NULL) - *num_attrs = kmip_node_get_structure_element_count(node) - 1; + if (num_attrs != NULL) { + *num_attrs = kmip_node_get_structure_element_count(node); + if (*num_attrs == 0) + return -EBADMSG; + (*num_attrs)--; + } if (v2_attr == NULL) return 0;