Fwd: New Defects reported by Coverity Scan for Das U-Boot

Marek Vasut marex at denx.de
Wed Apr 30 18:50:50 CEST 2025


On 4/28/25 11:59 PM, Tom Rini wrote:
  > 
________________________________________________________________________________________________________
> *** CID 550306:  Control flow issues  (DEADCODE)
> /fs/exfat/io.c: 547 in exfat_generic_pwrite()
> 541             int rc;
> 542             cluster_t cluster;
> 543             const char* bufp = buffer;
> 544             off_t lsize, loffset, remainder;
> 545
> 546             if (offset < 0)
>>>>      CID 550306:  Control flow issues  (DEADCODE)
>>>>      Execution cannot reach this statement: "return -22L;".
> 547                     return -EINVAL;
> 548             if (uoffset > node->size)
> 549             {
> 550                     rc = exfat_truncate(ef, node, uoffset, true);
> 551                     if (rc != 0)
> 552                             return rc;

This one is I think false positive, off_t can be signed integer, so the 
check should be in place.

> ** CID 550305:  Security best practices violations  (STRING_OVERFLOW)
> /fs/exfat/io.c: 739 in exfat_fs_opendir()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 550305:  Security best practices violations  (STRING_OVERFLOW)
> /fs/exfat/io.c: 739 in exfat_fs_opendir()
> 733                     return err;
> 734
> 735             dirs = calloc(1, sizeof(*dirs));
> 736             if (!dirs)
> 737                     return -ENOMEM;
> 738
>>>>      CID 550305:  Security best practices violations  (STRING_OVERFLOW)
>>>>      You might overrun the 1024-character fixed-size string
> "dirs->dirname" by copying "filename" without checking the length.
> 739             strcpy(dirs->dirname, filename);
> 740             dirs->offset = -1;
> 741
> 742             *dirsp = &dirs->fs_dirs;
> 743
> 744             return 0;
> 
> ** CID 550304:  Error handling issues  (NEGATIVE_RETURNS)
> /tools/fit_check_sign.c: 98 in main()

Fixed:

https://patchwork.ozlabs.org/project/uboot/patch/20250430164559.27095-1-marex@denx.de/

> ________________________________________________________________________________________________________
> *** CID 550300:  Integer handling issues  (INTEGER_OVERFLOW)
> /fs/exfat/utils.c: 146 in exfat_humanize_bytes()
> 140             /* 16 EB (minus 1 byte) is the largest size that can be
> represented by
> 141                uint64_t */
> 142             const char* units[] = {"bytes", "KB", "MB", "GB", "TB",
> "PB", "EB"};
> 143             uint64_t divisor = 1;
> 144             uint64_t temp = 0;
> 145
>>>>      CID 550300:  Integer handling issues  (INTEGER_OVERFLOW)
>>>>      Expression "divisor", overflows the type of "divisor", which is
> type "uint64_t".
> 146             for (i = 0; ; i++, divisor *= 1024)
> 147             {
> 148                     temp = (value + divisor / 2) / divisor;
> 149
> 150                     if (temp == 0)
> 151                             break;
Fixed:

https://patchwork.ozlabs.org/project/uboot/patch/20250430164559.27095-2-marex@denx.de/


More information about the U-Boot mailing list