mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-08-31 03:45:41 +00:00
Khem Raj
f0d0a6b626
_cjose_jwk_import_RSA() and _cjose_jwk_import_EC() declare their *_buflen variables in the middle of the function, interleaved with error paths that goto a shared cleanup label. An early decode failure jumps over the remaining declarations, and the cleanup block then reads them uninitialized: | jwk.c:1501:9: error: variable 'dq_buflen' is used uninitialized | whenever 'if' condition is true | [-Werror,-Wsometimes-uninitialized] | jwk.c:1554:39: note: uninitialized use occurs here | _cjose_cleanse_dealloc(dq_buffer, dq_buflen); _cjose_cleanse_dealloc() uses the length to wipe key material, so this is an out-of-bounds write hazard on the error path rather than just a warning. src/Makefile.am builds with -Werror, so clang also makes it fatal; the 0.6.2.4 -> 0.6.2.7 upgrade exposed it. Verified on aarch64 for qemuarm64: do_compile fails before the change with 20 such errors, and do_compile and do_package succeed after. Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Collection of layers for the OE-core universe
Main layer maintainer: Khem Raj raj.khem@gmail.com
This repository is a collection of layers to supplement OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories