Hello, 2 potential software vulnerabilities were found in code. To identify this kind of vulnerabilities I used tool ESBMC-WR: https://github.com/thalestas/esbmc-wr Please, check the logs of analysis: Issue #1 -------- State 2 file syserr.c line 4 function strerror thread 0 ---------------------------------------------------- errnum = -2147483648 (10000000 00000000 00000000 00000000) State 3 file syserr.c line 108 function strerror thread 0 ---------------------------------------------------- Violated property: file syserr.c line 108 function strerror array bounds violated: array `sys_errlist' lower bound (signed long int)errnum >= 0 Issue #2 -------- State 3 file utimensattest.c line 46 function fail thread 0 ---------------------------------------------------- saved_errno = -2147483648 (10000000 00000000 00000000 00000000) State 4 file syserr.c line 4 function strerror thread 0 ---------------------------------------------------- errnum = -2147483648 (10000000 00000000 00000000 00000000) State 5 file syserr.c line 108 function strerror thread 0 ---------------------------------------------------- Violated property: file syserr.c line 108 function strerror array bounds violated: array `sys_errlist' lower bound (signed long int)errnum >= 0
I think these are both false positives. (In reply to janislley from comment #0) [...] > State 2 file syserr.c There is no file with that name in OpenSSH. There is (potentially, if depending on autoconf) a strerror, however a) it's in bsd-misc.c and b) Linuxes usually have a native strerror. > line 4 function strerror thread 0 Line 4 in bsd-misc.c is in the middle of a comment block. [...] > State 3 file syserr.c line 108 function strerror thread 0 Line 108 in bsd-misc.c is a blank line after the strerror function. In addition, the strerror replacement explicitly checks for errno<0: const char *strerror(int e) { extern int sys_nerr; extern char *sys_errlist[]; if ((e >= 0) && (e < sys_nerr)) return (sys_errlist[e]); return ("unlisted error"); }
Closing for lack of followup. Please reopen after addressing Darren's concerns in comment #1
closing bug resolved during openssh-9.0 release cycle