GitLab

Issue 1:

/src/or/shared_random_state.c: 639 in disk_state_update()
633         next = &(line->next);
634       }
635       if (sr_state->current_srv != NULL) {
636         *next = line = tor_malloc_zero(sizeof(*line));
637         line->key = tor_strdup(dstate_cur_srv_key);
638         disk_state_put_srv_line(sr_state->current_srv, line);
>>>     CID 1362985:  Code maintainability issues  (UNUSED_VALUE)
>>>     Assigning value from "&line->next" to "next" here, but that stored value is overwritten before it can be used.
639         next = &(line->next);
640       }
641     
642       /* Parse the commits and construct config line(s). */
643       next = &sr_disk_state->Commit;
644       DIGESTMAP_FOREACH(sr_state->commits, key, sr_commit_t *, commit) {

Issue 2:

*** CID 1362984:  Memory - corruptions  (OVERRUN)
/src/test/test_shared_random.c: 943 in test_utils()
937         const char *payload =
938           "\x5d\xb9\x60\xb6\xcc\x51\x68\x52\x31\xd9\x88\x88\x71\x71\xe0\x30"
939           "\x59\x55\x7f\xcd\x61\xc0\x4b\x05\xb8\xcd\xc1\x48\xe9\xcd\x16\x1f"
940           "\x70\x15\x0c\xfc\xd3\x1a\x75\xd0\x93\x6c\xc4\xe0\x5c\xbe\xe2\x18"
941           "\xc7\xaf\x72\xb6\x7c\x9b\x52";
942         sr_commit_t commit1, commit2;
>>>     CID 1362984:  Memory - corruptions  (OVERRUN)
>>>     Overrunning buffer pointed to by "payload" of 56 bytes by passing it to a function which accesses it at byte offset 56 using argument "57UL". [Note: The source code implementation of the function has been overridden by a builtin model.]
943         memcpy(commit1.encoded_commit, payload, sizeof(commit1.encoded_commit));
944         memcpy(commit2.encoded_commit, payload, sizeof(commit2.encoded_commit));
945         tt_int_op(commitments_are_the_same(&commit1, &commit2), ==, 1);
946         /* Let's corrupt one of them. */
947         memset(commit1.encoded_commit, 'A', sizeof(commit1.encoded_commit));
948         tt_int_op(commitments_are_the_same(&commit1, &commit2), ==, 0);