From 03d1aed896b4d32a3c7e5031ba255b397c040ed2 Mon Sep 17 00:00:00 2001
From: Daniel Adam <daniel.adam1922@protonmail.com>
Date: Wed, 25 Sep 2024 13:04:58 +0200
Subject: [PATCH] Fix issues reported by Coverity

---
 api/oc_collection.c        | 2 ++
 api/oc_endpoint.c          | 5 +++++
 apps/secure_mcast_client.c | 9 +++++----
 port/linux/ip.c            | 3 +++
 port/linux/tcpsession.c    | 9 +++++++--
 util/jsmn/jsmn.c           | 9 +++++++--
 6 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/api/oc_collection.c b/api/oc_collection.c
index e228411462..f4a91b6312 100644
--- a/api/oc_collection.c
+++ b/api/oc_collection.c
@@ -295,6 +295,8 @@ oc_get_link_by_uri(oc_collection_t *collection, const char *uri_path,
     size_t resource_uri_len = oc_string_len(link->resource->uri);
     while (resource_uri[0] == '/') {
       resource_uri++;
+      // overflow check for coverity scan
+      assert(resource_uri_len > 0);
       resource_uri_len--;
     }
     if (resource_uri_len == uri_path_len &&
diff --git a/api/oc_endpoint.c b/api/oc_endpoint.c
index b42ad6dc68..16ba8ca4a8 100644
--- a/api/oc_endpoint.c
+++ b/api/oc_endpoint.c
@@ -27,6 +27,9 @@
 #include "util/oc_macros_internal.h"
 #include "util/oc_memb.h"
 
+#include <assert.h>
+#include <limits.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -167,6 +170,8 @@ oc_endpoint_to_cstring(const oc_endpoint_t *endpoint, char *buffer,
   if (written < 0) {
     return -1;
   }
+  // overflow check for coverity scan
+  assert(len <= INT_MAX - written && "Integer overflow detected");
   return len + written;
 }
 
diff --git a/apps/secure_mcast_client.c b/apps/secure_mcast_client.c
index 1ba6f26561..4c486afe82 100644
--- a/apps/secure_mcast_client.c
+++ b/apps/secure_mcast_client.c
@@ -330,12 +330,13 @@ discovery(const char *di, const char *uri, oc_string_array_t types,
   const oc_endpoint_t *ep = endpoint;
   oc_string_t ep_str;
   bool supports_mcast = false;
-  while (ep) {
+  while (ep != NULL) {
     memset(&ep_str, 0, sizeof(oc_string_t));
-    if (oc_endpoint_to_string(ep, &ep_str) >= 0) {
-      if ((oc_string_len(ep_str) == 23 &&
+    if (oc_endpoint_to_string(ep, &ep_str) == 0) {
+      size_t ep_str_len = oc_string_len(ep_str);
+      if ((ep_str_len == 23 &&
            memcmp(oc_string(ep_str), "coap://224.0.1.187:5683", 23) == 0) ||
-          (oc_string_len(ep_str) == 23 &&
+          (ep_str_len == 23 &&
            memcmp(oc_string(ep_str), "coap://[ff02::158]:5683", 23) == 0)) {
         supports_mcast = true;
       }
diff --git a/port/linux/ip.c b/port/linux/ip.c
index 5c76f6d639..9bb82d4ed7 100644
--- a/port/linux/ip.c
+++ b/port/linux/ip.c
@@ -28,6 +28,7 @@
 #include <errno.h>
 #include <limits.h>
 #include <netinet/in.h>
+#include <stdint.h>
 #include <string.h>
 #include <sys/socket.h>
 
@@ -119,6 +120,8 @@ oc_ip_send_msg(int sock, struct sockaddr_storage *receiver,
       OC_ERR("sendmsg failed (error %d)", (int)errno);
       break;
     }
+    // overflow check for coverity scan
+    assert(bytes_sent <= SIZE_MAX - (size_t)ret && "Integer overflow detected");
     bytes_sent += ret;
   }
   OC_TRACE("Sent %zu bytes", bytes_sent);
diff --git a/port/linux/tcpsession.c b/port/linux/tcpsession.c
index 6a0f520699..373ec0ff4e 100644
--- a/port/linux/tcpsession.c
+++ b/port/linux/tcpsession.c
@@ -50,6 +50,7 @@
 #include <fcntl.h>
 #include <ifaddrs.h>
 #include <net/if.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <unistd.h>
 
@@ -939,8 +940,9 @@ tcp_send_message(int sockfd, const oc_message_t *message)
 {
   size_t bytes_sent = 0;
   do {
-    ssize_t send_len = send(sockfd, message->data + bytes_sent,
-                            message->length - bytes_sent, MSG_NOSIGNAL);
+    const void *data = message->data + bytes_sent;
+    size_t data_length = message->length - bytes_sent;
+    ssize_t send_len = send(sockfd, data, data_length, MSG_NOSIGNAL);
     if (send_len < 0) {
       if (errno == EINTR) {
         continue;
@@ -951,6 +953,9 @@ tcp_send_message(int sockfd, const oc_message_t *message)
       }
       return (int)bytes_sent;
     }
+    // overflow check for coverity scan
+    assert(bytes_sent <= SIZE_MAX - (size_t)send_len &&
+           "Integer overflow detected");
     bytes_sent += send_len;
   } while (bytes_sent < message->length);
 
diff --git a/util/jsmn/jsmn.c b/util/jsmn/jsmn.c
index f735664540..83e5c89cd9 100644
--- a/util/jsmn/jsmn.c
+++ b/util/jsmn/jsmn.c
@@ -45,6 +45,7 @@
 
 #include <assert.h>
 #include <ctype.h>
+#include <limits.h>
 #include <stdint.h>
 #include <string.h>
 
@@ -247,6 +248,8 @@ jsmn_parse_next_char(jsmn_parser_t *parser, jsmntok_t *token, const char *js,
     if (r < 0) {
       return r;
     }
+    // overflow check for coverity scan
+    assert(count <= INT_MAX - r && "Integer overflow detected");
     count += r;
     break;
   }
@@ -289,12 +292,14 @@ jsmn_parse(jsmn_parser_t *parser, const char *js, const size_t len,
 {
   jsmntok_t token;
   jsmn_init_token(&token);
-  unsigned count = 0;
+  int count = 0;
   for (; parser->pos < len && js[parser->pos] != '\0'; parser->pos++) {
     int r = jsmn_parse_next_char(parser, &token, js, len, cb, data);
     if (r < 0) {
       return r;
     }
+    // overflow check for coverity scan
+    assert(count <= INT_MAX - r && "Integer overflow detected");
     count += r;
   }
 
@@ -302,7 +307,7 @@ jsmn_parse(jsmn_parser_t *parser, const char *js, const size_t len,
     return JSMN_ERROR_PART;
   }
 
-  return (int)count;
+  return count;
 }
 
 void