[tom.rini at gmail.com: Fwd: New Defects reported by Coverity Scan for Das U-Boot]
Tom Rini
trini at konsulko.com
Thu Jul 27 19:38:29 CEST 2023
Here's the latest report.
---------- Forwarded message ---------
From: <scan-admin at coverity.com>
Date: Tue, Jul 25, 2023 at 5:29 PM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <tom.rini at gmail.com>
Hi,
Please find the latest report on new defect(s) introduced to Das
U-Boot found with Coverity Scan.
5 new defect(s) introduced to Das U-Boot found with Coverity Scan.
30 defect(s), reported by Coverity Scan earlier, were marked fixed in
the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)
** CID 463147: Insecure data handling (TAINTED_SCALAR)
________________________________________________________________________________________________________
*** CID 463147: Insecure data handling (TAINTED_SCALAR)
/common/fdt_support.c: 1115 in fdt_copy_fixed_partitions()
1109 res = fdt_setprop_string(blob, suboff, "label",
1110
ofnode_read_string(subnode, "label"));
1111 if (res)
1112 return res;
1113
1114 reg = ofnode_get_property(subnode, "reg", &len);
>>> CID 463147: Insecure data handling (TAINTED_SCALAR)
>>> Passing tainted expression "len" to "fdt_setprop", which uses it as an offset.
1115 res = fdt_setprop(blob, suboff, "reg",
reg, len);
1116 if (res)
1117 return res;
1118 }
1119
1120 /* go to next fixed-partitions node */
** CID 463146: Null pointer dereferences (NULL_RETURNS)
________________________________________________________________________________________________________
*** CID 463146: Null pointer dereferences (NULL_RETURNS)
/common/fdt_support.c: 1115 in fdt_copy_fixed_partitions()
1109 res = fdt_setprop_string(blob, suboff, "label",
1110
ofnode_read_string(subnode, "label"));
1111 if (res)
1112 return res;
1113
1114 reg = ofnode_get_property(subnode, "reg", &len);
>>> CID 463146: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "reg" when calling "fdt_setprop".
1115 res = fdt_setprop(blob, suboff, "reg",
reg, len);
1116 if (res)
1117 return res;
1118 }
1119
1120 /* go to next fixed-partitions node */
** CID 463145: Error handling issues (CHECKED_RETURN)
/lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb()
________________________________________________________________________________________________________
*** CID 463145: Error handling issues (CHECKED_RETURN)
/lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb()
170 fdt_for_each_subnode(offset, fdt, parent) {
171 efi_guid_t guid;
172
173 guid_str = fdt_getprop(fdt, offset,
"image-type-id", &len);
174 if (!guid_str)
175 continue;
>>> CID 463145: Error handling issues (CHECKED_RETURN)
>>> Calling "uuid_str_to_bin" without checking return value (as is done elsewhere 7 out of 8 times).
176 uuid_str_to_bin(guid_str, guid.b, UUID_STR_FORMAT_GUID);
177
178 val = fdt_getprop(fdt, offset, "image-index", &len);
179 if (!val)
180 continue;
181 index = fdt32_to_cpu(*val);
** CID 463144: (CHECKED_RETURN)
/boot/expo.c: 257 in expo_apply_theme()
/boot/expo.c: 258 in expo_apply_theme()
/boot/expo.c: 259 in expo_apply_theme()
________________________________________________________________________________________________________
*** CID 463144: (CHECKED_RETURN)
/boot/expo.c: 257 in expo_apply_theme()
251 struct expo_theme *theme = &exp->theme;
252 int ret;
253
254 log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256 memset(theme, '\0', sizeof(struct expo_theme));
>>> CID 463144: (CHECKED_RETURN)
>>> Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
257 ofnode_read_u32(node, "font-size", &theme->font_size);
258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261 list_for_each_entry(scn, &exp->scene_head, sibling) {
262 ret = scene_apply_theme(scn, theme);
/boot/expo.c: 258 in expo_apply_theme()
252 int ret;
253
254 log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256 memset(theme, '\0', sizeof(struct expo_theme));
257 ofnode_read_u32(node, "font-size", &theme->font_size);
>>> CID 463144: (CHECKED_RETURN)
>>> Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261 list_for_each_entry(scn, &exp->scene_head, sibling) {
262 ret = scene_apply_theme(scn, theme);
263 if (ret)
/boot/expo.c: 259 in expo_apply_theme()
253
254 log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256 memset(theme, '\0', sizeof(struct expo_theme));
257 ofnode_read_u32(node, "font-size", &theme->font_size);
258 ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
>>> CID 463144: (CHECKED_RETURN)
>>> Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
259 ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261 list_for_each_entry(scn, &exp->scene_head, sibling) {
262 ret = scene_apply_theme(scn, theme);
263 if (ret)
264 return log_msg_ret("app", ret);
265 }
266
267 return 0;
** CID 463143: Control flow issues (DEADCODE)
/test/dm/part.c: 124 in do_get_info_test()
________________________________________________________________________________________________________
*** CID 463143: Control flow issues (DEADCODE)
/test/dm/part.c: 124 in do_get_info_test()
118
119 memset(&p, 0, sizeof(p));
120
121 ret = part_get_info_by_type(dev_desc, part, part_type, &p);
122 printf("part_get_info_by_type(%d, 0x%x) = %d\n", part,
part_type, ret);
123 if (ut_assertok(ret)) {
>>> CID 463143: Control flow issues (DEADCODE)
>>> Execution cannot reach this statement: "return 0;".
124 return 0;
125 }
126
127 ut_asserteq(reference->start, p.start);
128 ut_asserteq(reference->size, p.size);
129 ut_asserteq(reference->sys_ind, p.sys_ind);
________________________________________________________________________________________________________
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20230727/0b0ed43a/attachment.sig>
More information about the U-Boot
mailing list