Static analysis flagged that 'path' was never being checked (which should not ever be NULL) but during that review I noticed stat() was being called, then fstat afterwards. --- src/main.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/src/main.c b/src/main.c index 7a378b64..d790f61f 100644 --- a/src/main.c +++ b/src/main.c @@ -428,11 +428,8 @@ static bool setup_system_key(void) } path = l_strdup_printf("%s/%s", cred_dir, key_id); - - if (stat(path, &st) < 0) { - l_warn("SystemdEncrypt: Could not stat %s", path); + if (!path) return false; - } fd = open(path, O_RDONLY, 0); if (fd < 0) { -- 2.34.1

This was caught by static analysis. As is common this should never happen in the real world since the only way this can fail (apart from extreme circumstances like OOM) is if the key size is incorrect, which it will never be. --- src/dpp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/dpp.c b/src/dpp.c index f664e490..54662e8f 100644 --- a/src/dpp.c +++ b/src/dpp.c @@ -1070,8 +1070,11 @@ static void send_authenticate_response(struct dpp_sm *dpp) * do not use AAD; in other words, the number of AAD components is set * to zero."" */ - aes_siv_encrypt(dpp->ke, dpp->key_len, wrapped2_plaintext, - dpp->key_len + 4, NULL, 0, wrapped2); + if (!aes_siv_encrypt(dpp->ke, dpp->key_len, wrapped2_plaintext, + dpp->key_len + 4, NULL, 0, wrapped2)) { + l_error("Failed to encrypt wrapped data"); + return; + } wrapped2_len += 16; -- 2.34.1

On 2/18/22 13:55, James Prestwood wrote: I changed this to break instead of return. Applied, thanks. Regards, -Denis