[scan-admin at coverity.com: New Defects reported by Coverity Scan for Das U-Boot]

[Tom Rini]

On Thu, Jan 21, 2021 at 11:09:16AM +0900, AKASHI Takahiro wrote:
> Tom,
> 
> Regarding EFI capsule update,
[snip]
> > > ** CID 316360:  Uninitialized variables  (UNINIT)
> > > /tools/mkeficapsule.c: 298 in create_fwbin()
> > > 
> > > 
> > > ________________________________________________________________________________________________________
> > > *** CID 316360:  Uninitialized variables  (UNINIT)
> > > /tools/mkeficapsule.c: 298 in create_fwbin()
> > > 292     		goto err_3;
> > > 293     	}
> > > 294
> > > 295     	capsule.version = 0x00000001;
> > > 296     	capsule.embedded_driver_count = 0;
> > > 297     	capsule.payload_item_count = 1;
> > > > > >      CID 316360:  Uninitialized variables  (UNINIT)
> > > > > >      Using uninitialized value "capsule". Field "capsule.item_offset_list" is uninitialized when calling "fwrite".
> > > 298     	size = fwrite(&capsule, 1, sizeof(capsule), f);
> 
> This code is safe because capsule.item_offset_list is actually
> defined as "item_offset_list[]" (null array) at the end of the structure
> and the data will be filled in by the succeeding fwrite()'s.
> 
> What action should be taken to suppress this warning?
> 
> > > 299     	if (size < (sizeof(capsule))) {
> > > 300     		printf("write failed (%lx)\n", size);
> > > 301     		goto err_3;
> > > 302     	}
> > > 303     	offset = sizeof(capsule) + sizeof(u64);
> > > 
> > > ** CID 316359:  Null pointer dereferences  (FORWARD_NULL)
> > > 
> > > 
> > > ________________________________________________________________________________________________________
> > > *** CID 316359:  Null pointer dereferences  (FORWARD_NULL)
> > > /lib/efi_loader/efi_capsule.c: 380 in efi_capsule_update_firmware()
> > > 374     			ret = EFI_UNSUPPORTED;
> > > 375     			goto out;
> > > 376     		}
> > > 377
> > > 378     		/* find a device for update firmware */
> > > 379     		/* TODO: should we pass index as well, or nothing but type? */
> > > > > >      CID 316359:  Null pointer dereferences  (FORWARD_NULL)
> > > > > >      Passing null pointer "handles" to "efi_fmp_find", which dereferences it.
> > > 380     		fmp = efi_fmp_find(&image->update_image_type_id,
> > > 381     				   image->update_hardware_instance,
> > > 382     				   handles, no_handles);
> 
> This code is safe because "handles" is actually an array of pointers
> and "no_handles" indicates the number of elements in this array.
> efi_fmp_find() will not dereference handles at all if no_handles is zero.
> 
> What action should be taken to suppress this warning?

I've updated Coverity to list both of these as intentional / ignore,
thanks.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20210126/446189dd/attachment.sig>