Bug Summary

File:root/firefox-clang/security/nss/lib/jar/jarsign.c
Warning:line 247, column 5
Value stored to 'rv' is never read

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name jarsign.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/security/nss/lib/jar/jar_jar -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/security/nss/lib/jar/jar_jar -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG -D MOZILLA_CLIENT=1 -D NSS_FIPS_DISABLED -D NSS_NO_INIT_SUPPORT -D NSS_X86_OR_X64 -D NSS_X64 -D NSS_USE_64 -D USE_UTIL_DIRECTLY -D NO_NSPR_10_SUPPORT -D SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -D LINUX2_1 -D LINUX -D linux -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D HAVE_STRERROR -D XP_UNIX -D _REENTRANT -D NSS_DISABLE_DBM -D NSS_DISABLE_LIBPKIX -D NSS_USE_PKCS5_PBKD2_PARAMS2_ONLY -D SOFTOKEN_USE_PKCS5_PBKD2_PARAMS2_ONLY -I /root/firefox-clang/security/nss/lib/jar -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/security/nss/lib/jar/jar_jar -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/private/nss -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/security/nss/lib/jar/jarsign.c
1/* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5/*
6 * JARSIGN
7 *
8 * Routines used in signing archives.
9 */
10
11#include "jar.h"
12#include "jarint.h"
13#include "secpkcs7.h"
14#include "pk11func.h"
15#include "sechash.h"
16
17/* from libevent.h */
18typedef void (*ETVoidPtrFunc)(void *data);
19
20/* key database wrapper */
21/* static SECKEYKeyDBHandle *jar_open_key_database (void); */
22/* CHUNQ is our bite size */
23
24#define CHUNQ64000 64000
25#define FILECHUNQ32768 32768
26
27/*
28 * J A R _ c a l c u l a t e _ d i g e s t
29 *
30 * Quick calculation of a digest for
31 * the specified block of memory. Will calculate
32 * for all supported algorithms, now MD5.
33 *
34 */
35JAR_Digest *PR_CALLBACK
36JAR_calculate_digest(void *data, long length)
37{
38 PK11Context *md5 = 0;
39 PK11Context *sha1 = 0;
40 JAR_Digest *dig = PORT_ZNew(JAR_Digest)(JAR_Digest *)PORT_ZAlloc_Util(sizeof(JAR_Digest));
41 long chunq;
42 unsigned int md5_length, sha1_length;
43
44 if (dig == NULL((void*)0)) {
45 /* out of memory allocating digest */
46 return NULL((void*)0);
47 }
48
49 md5 = PK11_CreateDigestContext(SEC_OID_MD5);
50 if (md5 == NULL((void*)0)) {
51 PORT_ZFreePORT_ZFree_Util(dig, sizeof(JAR_Digest));
52 return NULL((void*)0);
53 }
54 sha1 = PK11_CreateDigestContext(SEC_OID_SHA1);
55 if (sha1 == NULL((void*)0)) {
56 PK11_DestroyContext(md5, PR_TRUE1);
57 /* added due to bug Bug 1250214 - prevent the 2nd memory leak */
58 PORT_ZFreePORT_ZFree_Util(dig, sizeof(JAR_Digest));
59 return NULL((void*)0);
60 }
61
62 if (length >= 0) {
63 PK11_DigestBegin(md5);
64 PK11_DigestBegin(sha1);
65
66 do {
67 chunq = length;
68
69 PK11_DigestOp(md5, (unsigned char *)data, chunq);
70 PK11_DigestOp(sha1, (unsigned char *)data, chunq);
71 length -= chunq;
72 data = ((char *)data + chunq);
73 } while (length > 0);
74
75 PK11_DigestFinal(md5, dig->md5, &md5_length, MD5_LENGTH16);
76 PK11_DigestFinal(sha1, dig->sha1, &sha1_length, SHA1_LENGTH20);
77
78 PK11_DestroyContext(md5, PR_TRUE1);
79 PK11_DestroyContext(sha1, PR_TRUE1);
80 }
81 return dig;
82}
83
84/*
85 * J A R _ d i g e s t _ f i l e
86 *
87 * Calculates the MD5 and SHA1 digests for a file
88 * present on disk, and returns these in JAR_Digest struct.
89 *
90 */
91int
92JAR_digest_file(char *filename, JAR_Digest *dig)
93{
94 JAR_FILEPRFileDesc * fp;
95 PK11Context *md5 = 0;
96 PK11Context *sha1 = 0;
97 unsigned char *buf = (unsigned char *)PORT_ZAllocPORT_ZAlloc_Util(FILECHUNQ32768);
98 int num;
99 unsigned int md5_length, sha1_length;
100
101 if (buf == NULL((void*)0)) {
102 /* out of memory */
103 return JAR_ERR_MEMORY((-0x2000) + 300 + 4);
104 }
105
106 if ((fp = JAR_FOPEN(filename, "rb")JAR_FOPEN_to_PR_Open(filename, "rb")) == 0) {
107 /* perror (filename); FIX XXX XXX XXX XXX XXX XXX */
108 PORT_FreePORT_Free_Util(buf);
109 return JAR_ERR_FNF((-0x2000) + 300 + 2);
110 }
111
112 md5 = PK11_CreateDigestContext(SEC_OID_MD5);
113 sha1 = PK11_CreateDigestContext(SEC_OID_SHA1);
114
115 if (md5 == NULL((void*)0) || sha1 == NULL((void*)0)) {
116 if (md5) {
117 PK11_DestroyContext(md5, PR_TRUE1);
118 }
119 if (sha1) {
120 PK11_DestroyContext(sha1, PR_TRUE1);
121 }
122 /* can't generate digest contexts */
123 PORT_FreePORT_Free_Util(buf);
124 JAR_FCLOSEPR_Close(fp);
125 return JAR_ERR_GENERAL((-0x2000) + 300 + 1);
126 }
127
128 PK11_DigestBegin(md5);
129 PK11_DigestBegin(sha1);
130
131 while (1) {
132 num = JAR_FREADPR_Read(fp, buf, FILECHUNQ32768);
133 if (num == 0)
134 break;
135 if (num < 0) {
136 PK11_DestroyContext(md5, PR_TRUE1);
137 PK11_DestroyContext(sha1, PR_TRUE1);
138 PORT_FreePORT_Free_Util(buf);
139 JAR_FCLOSEPR_Close(fp);
140 return JAR_ERR_GENERAL((-0x2000) + 300 + 1);
141 }
142
143 PK11_DigestOp(md5, buf, num);
144 PK11_DigestOp(sha1, buf, num);
145 }
146
147 PK11_DigestFinal(md5, dig->md5, &md5_length, MD5_LENGTH16);
148 PK11_DigestFinal(sha1, dig->sha1, &sha1_length, SHA1_LENGTH20);
149
150 PK11_DestroyContext(md5, PR_TRUE1);
151 PK11_DestroyContext(sha1, PR_TRUE1);
152
153 PORT_FreePORT_Free_Util(buf);
154 JAR_FCLOSEPR_Close(fp);
155
156 return 0;
157}
158
159/*
160 * J A R _ o p e n _ k e y _ d a t a b a s e
161 *
162 */
163
164void *
165jar_open_key_database(void)
166{
167 return NULL((void*)0);
168}
169
170int
171jar_close_key_database(void *keydb)
172{
173 /* We never do close it */
174 return 0;
175}
176
177/*
178 * j a r _ c r e a t e _ p k 7
179 *
180 */
181
182static void
183jar_pk7_out(void *arg, const char *buf, unsigned long len)
184{
185 JAR_FWRITEPR_Write((JAR_FILEPRFileDesc *)arg, buf, len);
186}
187
188int
189jar_create_pk7(CERTCertDBHandle *certdb, void *keydb, CERTCertificate *cert,
190 char *password, JAR_FILEPRFileDesc * infp, JAR_FILEPRFileDesc * outfp)
191{
192 SEC_PKCS7ContentInfo *cinfo;
193 const SECHashObject *hashObj;
194 void *mw = NULL((void*)0);
195 void *hashcx;
196 unsigned int len;
197 int status = 0;
198 SECStatus rv;
199 SECItem digest;
200 unsigned char digestdata[32];
201 unsigned char buffer[4096];
202
203 if (outfp == NULL((void*)0) || infp == NULL((void*)0) || cert == NULL((void*)0))
204 return JAR_ERR_GENERAL((-0x2000) + 300 + 1);
205
206 /* we sign with SHA */
207 hashObj = HASH_GetHashObject(HASH_AlgSHA1);
208
209 hashcx = (*hashObj->create)();
210 if (hashcx == NULL((void*)0))
211 return JAR_ERR_GENERAL((-0x2000) + 300 + 1);
212
213 (*hashObj->begin)(hashcx);
214 while (1) {
215 int nb = JAR_FREADPR_Read(infp, buffer, sizeof buffer);
216 if (nb == 0) { /* eof */
217 break;
218 }
219 if (nb < 0) {
220 (*hashObj->destroy)(hashcx, PR_TRUE1);
221 return JAR_ERR_GENERAL((-0x2000) + 300 + 1);
222 }
223 (*hashObj->update)(hashcx, buffer, nb);
224 }
225 (*hashObj->end)(hashcx, digestdata, &len, 32);
226 (*hashObj->destroy)(hashcx, PR_TRUE1);
227
228 digest.data = digestdata;
229 digest.len = len;
230
231 /* signtool must use any old context it can find since it's
232 calling from inside javaland. */
233 PORT_SetErrorPORT_SetError_Util(0);
234 cinfo = SEC_PKCS7CreateSignedData(cert, certUsageObjectSigner, NULL((void*)0),
235 SEC_OID_SHA1, &digest, NULL((void*)0), mw);
236 if (cinfo == NULL((void*)0))
237 return JAR_ERR_PK7((-0x2000) + 300 + 11);
238
239 rv = SEC_PKCS7IncludeCertChain(cinfo, NULL((void*)0));
240 if (rv != SECSuccess) {
241 status = PORT_GetErrorPORT_GetError_Util();
242 SEC_PKCS7DestroyContentInfo(cinfo);
243 return status;
244 }
245
246 /* Having this here forces signtool to always include signing time. */
247 rv = SEC_PKCS7AddSigningTime(cinfo);
Value stored to 'rv' is never read
248 /* don't check error */
249 PORT_SetErrorPORT_SetError_Util(0);
250
251 /* if calling from mozilla thread*/
252 rv = SEC_PKCS7Encode(cinfo, jar_pk7_out, outfp, NULL((void*)0), NULL((void*)0), mw);
253 if (rv != SECSuccess)
254 status = PORT_GetErrorPORT_GetError_Util();
255 SEC_PKCS7DestroyContentInfo(cinfo);
256 if (rv != SECSuccess) {
257 return ((status < 0) ? status : JAR_ERR_GENERAL((-0x2000) + 300 + 1));
258 }
259 return 0;
260}