Fixed findings

List of Findings

Error: COMPILER_WARNING: [#def1]
openssh-10.2p1/chacha.c:51:31: warning[-Wunterminated-string-initialization]: initializer-string for array of ‘char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (17 chars into 16 available)
#   51 | static const char sigma[16] = "expand 32-byte k";
#      |                               ^~~~~~~~~~~~~~~~~~
#   49|     c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
#   50|   
#   51|-> static const char sigma[16] = "expand 32-byte k";
#   52|   static const char tau[16] = "expand 16-byte k";
#   53|   

Error: COMPILER_WARNING: [#def2]
openssh-10.2p1/chacha.c:52:29: warning[-Wunterminated-string-initialization]: initializer-string for array of ‘char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (17 chars into 16 available)
#   52 | static const char tau[16] = "expand 16-byte k";
#      |                             ^~~~~~~~~~~~~~~~~~
#   50|   
#   51|   static const char sigma[16] = "expand 32-byte k";
#   52|-> static const char tau[16] = "expand 16-byte k";
#   53|   
#   54|   void

Error: COMPILER_WARNING (CWE-563): [#def3]
openssh-10.2p1/monitor.c:758:32: warning[-Wunused-variable]: unused variable ‘alglen’
#  758 |         size_t datlen, siglen, alglen;
#      |                                ^~~~~~
#  756|   	u_char *p = NULL, *signature = NULL;
#  757|   	char *alg = NULL, *effective_alg;
#  758|-> 	size_t datlen, siglen, alglen;
#  759|   	int r, is_proof = 0;
#  760|   	u_int keyid, compat;

Error: COMPILER_WARNING (CWE-195): [#def4]
openssh-10.2p1/monitor.c: scope_hint: In function ‘mm_answer_sign’
openssh-10.2p1/monitor.c:772:57: warning[-Wsign-compare]: comparison of integer expressions of different signedness: ‘u_int’ {aka ‘unsigned int’} and ‘int’
#  772 |         if ((keyid = get_hostkey_index(pubkey, 1, ssh)) == -1)
#      |                                                         ^~
#  770|   		fatal_fr(r, "parse");
#  771|   
#  772|-> 	if ((keyid = get_hostkey_index(pubkey, 1, ssh)) == -1)
#  773|   		fatal_f("unknown hostkey");
#  774|   	debug_f("hostkey %s index %d", sshkey_ssh_name(pubkey), keyid);

Error: COMPILER_WARNING (CWE-704): [#def5]
openssh-10.2p1/monitor.c:822:39: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  822 |                         effective_alg = safe_rsa;
#      |                                       ^
#  820|   		if (ssh->compat & SSH_RH_RSASIGSHA && strcmp(alg, "ssh-rsa") == 0
#  821|   				&& (sshkey_type_plain(key->type) == KEY_RSA)) {
#  822|-> 			effective_alg = safe_rsa;
#  823|   		} else {
#  824|   			effective_alg = alg;

Error: COMPILER_WARNING (CWE-704): [#def6]
openssh-10.2p1/monitor.c:822:39: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  820|   		if (ssh->compat & SSH_RH_RSASIGSHA && strcmp(alg, "ssh-rsa") == 0
#  821|   				&& (sshkey_type_plain(key->type) == KEY_RSA)) {
#  822|-> 			effective_alg = safe_rsa;
#  823|   		} else {
#  824|   			effective_alg = alg;

Error: COMPILER_WARNING (CWE-704): [#def7]
openssh-10.2p1/monitor.c:833:39: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  833 |                         effective_alg = safe_rsa;
#      |                                       ^
#  831|   		if (ssh->compat & SSH_RH_RSASIGSHA && strcmp(alg, "ssh-rsa") == 0
#  832|   				&& (sshkey_type_plain(key->type) == KEY_RSA)) {
#  833|-> 			effective_alg = safe_rsa;
#  834|   		} else {
#  835|   			effective_alg = alg;

Error: COMPILER_WARNING (CWE-704): [#def8]
openssh-10.2p1/monitor.c:833:39: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  831|   		if (ssh->compat & SSH_RH_RSASIGSHA && strcmp(alg, "ssh-rsa") == 0
#  832|   				&& (sshkey_type_plain(key->type) == KEY_RSA)) {
#  833|-> 			effective_alg = safe_rsa;
#  834|   		} else {
#  835|   			effective_alg = alg;

Error: COMPILER_WARNING (CWE-195): [#def9]
openssh-10.2p1/monitor.c: scope_hint: In function ‘mm_answer_keyverify’
openssh-10.2p1/monitor.c:1620:18: warning[-Wsign-compare]: comparison of integer expressions of different signedness: ‘int’ and ‘u_int’ {aka ‘unsigned int’}
# 1620 |         if (type != key_blobtype)
#      |                  ^~
# 1618|   	  !monitor_allowed_key(blob, bloblen))
# 1619|   		fatal_f("bad key, not previously allowed");
# 1620|-> 	if (type != key_blobtype)
# 1621|   		fatal_f("bad key type");
# 1622|   

Error: COMPILER_WARNING: [#def10]
openssh-10.2p1/openbsd-compat/bcrypt_pbkdf.c: scope_hint: In function ‘bcrypt_hash’
openssh-10.2p1/openbsd-compat/bcrypt_pbkdf.c:77:13: warning[-Wunterminated-string-initialization]: initializer-string for array of ‘unsigned char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (33 chars into 32 available)
#   77 |             "OxychromaticBlowfishSwatDynamite";
#      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   75|   	blf_ctx state;
#   76|   	uint8_t ciphertext[BCRYPT_HASHSIZE] =
#   77|-> 	    "OxychromaticBlowfishSwatDynamite";
#   78|   	uint32_t cdata[BCRYPT_WORDS];
#   79|   	int i;

Error: COMPILER_WARNING (CWE-704): [#def11]
openssh-10.2p1/readconf.c: scope_hint: In function ‘parse_jump’
openssh-10.2p1/readconf.c:3527:33: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
# 3527 |                         if ((cp = strrchr(s, ',')) != NULL && cp != s) {
#      |                                 ^
# 3525|   			o->proxy_command = xstrdup("none");
# 3526|   			user = host = NULL;
# 3527|-> 			if ((cp = strrchr(s, ',')) != NULL && cp != s) {
# 3528|   				o->jump_extra = xstrdup(s);
# 3529|   				o->jump_extra[cp - s] = '\0';

Error: COMPILER_WARNING (CWE-704): [#def12]
openssh-10.2p1/readconf.c:3527:33: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
# 3525|   			o->proxy_command = xstrdup("none");
# 3526|   			user = host = NULL;
# 3527|-> 			if ((cp = strrchr(s, ',')) != NULL && cp != s) {
# 3528|   				o->jump_extra = xstrdup(s);
# 3529|   				o->jump_extra[cp - s] = '\0';

Error: COMPILER_WARNING (CWE-1164): [#def13]
openssh-10.2p1/ssh-pkcs11.c: scope_hint: At top level
openssh-10.2p1/ssh-pkcs11.c:2332:1: warning[-Wunused-function]: ‘pkcs11_register_provider’ defined but not used
# 2332 | pkcs11_register_provider(char *provider_id, char *pin, struct sshkey ***keyp,
#      | ^~~~~~~~~~~~~~~~~~~~~~~~
# 2330|   
# 2331|   static int
# 2332|-> pkcs11_register_provider(char *provider_id, char *pin, struct sshkey ***keyp,
# 2333|       char ***labelsp, struct pkcs11_provider **providerp, CK_ULONG user)
# 2334|   {

Scan Properties