<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>New Defects Reported - RTEMS</title>
<style>
body { font-family: Arial, sans-serif; color: #222; line-height: 1.6; }
.button {
display: inline-block;
padding: 10px 20px;
margin: 20px 0;
font-size: 16px;
color: #fff !important;
background-color: #0056b3;
text-decoration: none;
border-radius: 5px;
}
pre {
background: #f8f9fa;
padding: 10px;
border-radius: 5px;
font-size: 14px;
overflow-x: auto;
}
</style>
</head>
<body>
<p>Hi,</p>
<p>
Please find the latest report on new defect(s) introduced to <strong>RTEMS</strong>
found with Coverity Scan.
</p>
<ul>
<li><strong>New Defects Found:</strong> 3</li>
<li>
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
</li>
<li><strong>Defects Shown:</strong> Showing 3 of 3 defect(s)</li>
</ul>
<h3>Defect Details</h3>
<pre>
** CID 1679602: (RESOURCE_LEAK)
/bsps/shared/dev/flash/flash_sim_flashdev.c: 426 in flash_sim_flashdev_init()
/bsps/shared/dev/flash/flash_sim_flashdev.c: 418 in flash_sim_flashdev_init()
_____________________________________________________________________________________________
*** CID 1679602: (RESOURCE_LEAK)
/bsps/shared/dev/flash/flash_sim_flashdev.c: 426 in flash_sim_flashdev_init()
420 memset( ntable->area, 0xff, total_pages * ntable->attr.page_size_bytes );
421
422 if ( ntable->attr.type == RTEMS_FLASHDEV_NAND ) {
423 ntable->oob = flashdev_malloc( &ntable->attr, total_pages * ntable->attr.page_oob_bytes );
424 if ( ntable->oob == NULL ) {
425 free_nand_priv( ntable );
>>> CID 1679602: (RESOURCE_LEAK)
>>> Variable "ftable" going out of scope leaks the storage it points to.
426 return NULL;
427 }
428 memset( ntable->oob, 0xff, total_pages * ntable->attr.page_oob_bytes );
429 }
430
431 ftable->regions = &ntable->regions[ 0 ];
/bsps/shared/dev/flash/flash_sim_flashdev.c: 418 in flash_sim_flashdev_init()
412
413 total_pages = ntable->attr.total_sectors * ntable->attr.pages_per_sector;
414
415 ntable->area = flashdev_malloc( &ntable->attr, total_pages * ntable->attr.page_size_bytes );
416 if ( ntable->area == NULL ) {
417 free_nand_priv( ntable );
>>> CID 1679602: (RESOURCE_LEAK)
>>> Variable "ftable" going out of scope leaks the storage it points to.
418 return NULL;
419 }
420 memset( ntable->area, 0xff, total_pages * ntable->attr.page_size_bytes );
421
422 if ( ntable->attr.type == RTEMS_FLASHDEV_NAND ) {
423 ntable->oob = flashdev_malloc( &ntable->attr, total_pages * ntable->attr.page_oob_bytes );
** CID 1679601: Integer handling issues (DIVIDE_BY_ZERO)
/bsps/shared/dev/nor/config-parser.c: 193 in rtems_flash_CFI_parse_from_buffer()
_____________________________________________________________________________________________
*** CID 1679601: Integer handling issues (DIVIDE_BY_ZERO)
/bsps/shared/dev/nor/config-parser.c: 193 in rtems_flash_CFI_parse_from_buffer()
187 }
188
189 if (num_regions == 1) {
190 /* Device size for at least s25fl512s is off by 1, calculate with sectors */
191 data->device_size = data->num_sectors * data->sector_size;
192 } else {
>>> CID 1679601: Integer handling issues (DIVIDE_BY_ZERO)
>>> In expression "data->device_size / data->sector_size", division by expression "data->sector_size" which may be zero has undefined behavior.
193 data->num_sectors = data->device_size / data->sector_size;
194 }
195
196 return RTEMS_SUCCESSFUL;
197 }
198
** CID 1679600: Insecure data handling (TAINTED_SCALAR)
/bsps/shared/dev/nor/config-parser.c: 172 in rtems_flash_CFI_parse_from_buffer()
_____________________________________________________________________________________________
*** CID 1679600: Insecure data handling (TAINTED_SCALAR)
/bsps/shared/dev/nor/config-parser.c: 172 in rtems_flash_CFI_parse_from_buffer()
166 return RTEMS_INVALID_ADDRESS;
167 }
168
169 /* Get largest block */
170 num_regions = bufbyte;
171 data->sector_size = 0;
>>> CID 1679600: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "num_regions" as a loop boundary.
172 for (region = 0; region < num_regions; ++region) {
173 if (read_config_short(cfi_raw, cfi_raw_len, datalen, 0x2d + (region * 4),
174 &num_sectors_sub)) {
175 return RTEMS_INVALID_ADDRESS;
176 }
177
</pre>
<p>
<a href="https://scan.coverity.com/projects/rtems?tab=overview" class="button">View Defects in Coverity Scan</a>
</p>
<p>Best regards,</p>
<p>The Coverity Scan Admin Team</p>
<img class="logo" width="140" src="https://scan.coverity.com/assets/BlackDuckLogo-6697adc63e07340464201a2ad534d3d3e44f95d36edda20b140440d34f05372f.svg" />
</body>
</html>