[tom.rini@gmail.com: Fwd: New Defects reported by Coverity Scan for Das U-Boot]
Here's the latest report.
---------- Forwarded message --------- From: scan-admin@coverity.com Date: Tue, Jul 25, 2023 at 5:29 PM Subject: New Defects reported by Coverity Scan for Das U-Boot To: tom.rini@gmail.com
Hi,
Please find the latest report on new defect(s) introduced to Das U-Boot found with Coverity Scan.
5 new defect(s) introduced to Das U-Boot found with Coverity Scan. 30 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s)
** CID 463147: Insecure data handling (TAINTED_SCALAR)
________________________________________________________________________________________________________ *** CID 463147: Insecure data handling (TAINTED_SCALAR) /common/fdt_support.c: 1115 in fdt_copy_fixed_partitions() 1109 res = fdt_setprop_string(blob, suboff, "label", 1110 ofnode_read_string(subnode, "label")); 1111 if (res) 1112 return res; 1113 1114 reg = ofnode_get_property(subnode, "reg", &len);
CID 463147: Insecure data handling (TAINTED_SCALAR) Passing tainted expression "len" to "fdt_setprop", which uses it as an offset.
1115 res = fdt_setprop(blob, suboff, "reg", reg, len); 1116 if (res) 1117 return res; 1118 } 1119 1120 /* go to next fixed-partitions node */
** CID 463146: Null pointer dereferences (NULL_RETURNS)
________________________________________________________________________________________________________ *** CID 463146: Null pointer dereferences (NULL_RETURNS) /common/fdt_support.c: 1115 in fdt_copy_fixed_partitions() 1109 res = fdt_setprop_string(blob, suboff, "label", 1110 ofnode_read_string(subnode, "label")); 1111 if (res) 1112 return res; 1113 1114 reg = ofnode_get_property(subnode, "reg", &len);
CID 463146: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be "NULL" "reg" when calling "fdt_setprop".
1115 res = fdt_setprop(blob, suboff, "reg", reg, len); 1116 if (res) 1117 return res; 1118 } 1119 1120 /* go to next fixed-partitions node */
** CID 463145: Error handling issues (CHECKED_RETURN) /lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb()
________________________________________________________________________________________________________ *** CID 463145: Error handling issues (CHECKED_RETURN) /lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb() 170 fdt_for_each_subnode(offset, fdt, parent) { 171 efi_guid_t guid; 172 173 guid_str = fdt_getprop(fdt, offset, "image-type-id", &len); 174 if (!guid_str) 175 continue;
CID 463145: Error handling issues (CHECKED_RETURN) Calling "uuid_str_to_bin" without checking return value (as is done elsewhere 7 out of 8 times).
176 uuid_str_to_bin(guid_str, guid.b, UUID_STR_FORMAT_GUID); 177 178 val = fdt_getprop(fdt, offset, "image-index", &len); 179 if (!val) 180 continue; 181 index = fdt32_to_cpu(*val);
** CID 463144: (CHECKED_RETURN) /boot/expo.c: 257 in expo_apply_theme() /boot/expo.c: 258 in expo_apply_theme() /boot/expo.c: 259 in expo_apply_theme()
________________________________________________________________________________________________________ *** CID 463144: (CHECKED_RETURN) /boot/expo.c: 257 in expo_apply_theme() 251 struct expo_theme *theme = &exp->theme; 252 int ret; 253 254 log_debug("Applying theme %s\n", ofnode_get_name(node)); 255 256 memset(theme, '\0', sizeof(struct expo_theme));
CID 463144: (CHECKED_RETURN) Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
257 ofnode_read_u32(node, "font-size", &theme->font_size); 258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset); 259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y); 260 261 list_for_each_entry(scn, &exp->scene_head, sibling) { 262 ret = scene_apply_theme(scn, theme); /boot/expo.c: 258 in expo_apply_theme() 252 int ret; 253 254 log_debug("Applying theme %s\n", ofnode_get_name(node)); 255 256 memset(theme, '\0', sizeof(struct expo_theme)); 257 ofnode_read_u32(node, "font-size", &theme->font_size);
CID 463144: (CHECKED_RETURN) Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset); 259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y); 260 261 list_for_each_entry(scn, &exp->scene_head, sibling) { 262 ret = scene_apply_theme(scn, theme); 263 if (ret) /boot/expo.c: 259 in expo_apply_theme() 253 254 log_debug("Applying theme %s\n", ofnode_get_name(node)); 255 256 memset(theme, '\0', sizeof(struct expo_theme)); 257 ofnode_read_u32(node, "font-size", &theme->font_size); 258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
CID 463144: (CHECKED_RETURN) Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y); 260 261 list_for_each_entry(scn, &exp->scene_head, sibling) { 262 ret = scene_apply_theme(scn, theme); 263 if (ret) 264 return log_msg_ret("app", ret); 265 } 266 267 return 0;
** CID 463143: Control flow issues (DEADCODE) /test/dm/part.c: 124 in do_get_info_test()
________________________________________________________________________________________________________ *** CID 463143: Control flow issues (DEADCODE) /test/dm/part.c: 124 in do_get_info_test() 118 119 memset(&p, 0, sizeof(p)); 120 121 ret = part_get_info_by_type(dev_desc, part, part_type, &p); 122 printf("part_get_info_by_type(%d, 0x%x) = %d\n", part, part_type, ret); 123 if (ut_assertok(ret)) {
CID 463143: Control flow issues (DEADCODE) Execution cannot reach this statement: "return 0;".
124 return 0; 125 } 126 127 ut_asserteq(reference->start, p.start); 128 ut_asserteq(reference->size, p.size); 129 ut_asserteq(reference->sys_ind, p.sys_ind);
________________________________________________________________________________________________________
participants (1)
-
Tom Rini