<div dir="ltr">fyi; I should see if I can get this put to the list directly...<br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <span dir="auto"><<a href="mailto:scan-admin@coverity.com">scan-admin@coverity.com</a>></span><br>Date: Thu, Jan 28, 2021 at 11:59 AM<br>Subject: New Defects reported by Coverity Scan for RTEMS<br>To: <<a href="mailto:gedare@gwmail.gwu.edu">gedare@gwmail.gwu.edu</a>><br></div><br><br>Hi,<br>
<br>
Please find the latest report on new defect(s) introduced to RTEMS found with Coverity Scan.<br>
<br>
7 new defect(s) introduced to RTEMS found with Coverity Scan.<br>
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.<br>
<br>
New defect(s) Reported-by: Coverity Scan<br>
Showing 7 of 7 defect(s)<br>
<br>
<br>
** CID 1472601: Null pointer dereferences (NULL_RETURNS)<br>
/bsps/shared/ofw/ofw.c: 627 in rtems_ofw_get_reg()<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472601: Null pointer dereferences (NULL_RETURNS)<br>
/bsps/shared/ofw/ofw.c: 627 in rtems_ofw_get_reg()<br>
621 nranges = len / sizeof(rtems_ofw_ranges);<br>
622 <br>
623 offset = 0;<br>
624 for (int i=0; i < nregs; i++) {<br>
625 for (int j=0; j < nranges; j++) {<br>
626 <br>
>>> CID 1472601: Null pointer dereferences (NULL_RETURNS)<br>
>>> Dereferencing "ptr", which is known to be "NULL".<br>
627 range.parent_bus = fdt32_to_cpu(ptr[j].parent_bus);<br>
628 range.child_bus = fdt32_to_cpu(ptr[j].child_bus);<br>
629 range.size = fdt32_to_cpu(ptr[j].size);<br>
630 <br>
631 if (buf[i].start >= range.child_bus &&<br>
632 buf[i].start < range.child_bus + range.size) {<br>
<br>
** CID 1472600: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 377 in rtems_ofw_get_enc_prop_alloc()<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472600: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 377 in rtems_ofw_get_enc_prop_alloc()<br>
371 if (*buf == NULL) {<br>
372 return -1;<br>
373 }<br>
374 <br>
375 if (rtems_ofw_get_enc_prop(node, propname, *buf, len) == -1) {<br>
376 rtems_ofw_free(buf);<br>
>>> CID 1472600: Memory - corruptions (USE_AFTER_FREE)<br>
>>> Dereferencing freed pointer "buf".<br>
377 *buf = NULL;<br>
378 return -1;<br>
379 }<br>
380 }<br>
381 <br>
382 return len;<br>
<br>
** CID 1472599: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 348 in rtems_ofw_get_prop_alloc_multi()<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472599: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 348 in rtems_ofw_get_prop_alloc_multi()<br>
342 if (*buf == NULL) {<br>
343 return -1;<br>
344 }<br>
345 <br>
346 if (rtems_ofw_get_prop(node, propname, *buf, len) == -1) {<br>
347 rtems_ofw_free(buf);<br>
>>> CID 1472599: Memory - corruptions (USE_AFTER_FREE)<br>
>>> Dereferencing freed pointer "buf".<br>
348 *buf = NULL;<br>
349 return -1;<br>
350 }<br>
351 }<br>
352 <br>
353 return (len / elsz);<br>
<br>
** CID 1472598: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 317 in rtems_ofw_get_prop_alloc()<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472598: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 317 in rtems_ofw_get_prop_alloc()<br>
311 if (*buf == NULL) {<br>
312 return -1;<br>
313 }<br>
314 <br>
315 if (rtems_ofw_get_prop(node, propname, *buf, len) == -1) {<br>
316 rtems_ofw_free(buf);<br>
>>> CID 1472598: Memory - corruptions (USE_AFTER_FREE)<br>
>>> Dereferencing freed pointer "buf".<br>
317 *buf = NULL;<br>
318 return -1;<br>
319 }<br>
320 }<br>
321 <br>
322 return len;<br>
<br>
** CID 1472597: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472597: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
/bsps/shared/ofw/ofw.c: 510 in rtems_ofw_get_effective_phandle()<br>
504 <br>
505 for (child = rtems_ofw_child(node); child != 0; child = rtems_ofw_peer(child)) {<br>
506 ref = rtems_ofw_get_effective_phandle(child, xref);<br>
507 if (ref != -1)<br>
508 return ref;<br>
509 <br>
>>> CID 1472597: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
>>> Passing "&ref" to function "rtems_ofw_get_enc_prop" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.<br>
510 if (rtems_ofw_get_enc_prop(child, "phandle", &ref, sizeof(ref)) == -1 &&<br>
511 rtems_ofw_get_enc_prop(child, "ibm,phandle", &ref, sizeof(ref)) == -1 &&<br>
512 rtems_ofw_get_enc_prop(child, "linux,phandle", &ref, sizeof(ref)) == -1<br>
513 ) {<br>
514 continue;<br>
515 }<br>
<br>
** CID 1472596: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 408 in rtems_ofw_get_enc_prop_alloc_multi()<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472596: Memory - corruptions (USE_AFTER_FREE)<br>
/bsps/shared/ofw/ofw.c: 408 in rtems_ofw_get_enc_prop_alloc_multi()<br>
402 if (*buf == NULL) {<br>
403 return -1;<br>
404 }<br>
405 <br>
406 if (rtems_ofw_get_enc_prop(node, propname, *buf, len) == -1) {<br>
407 rtems_ofw_free(buf);<br>
>>> CID 1472596: Memory - corruptions (USE_AFTER_FREE)<br>
>>> Dereferencing freed pointer "buf".<br>
408 *buf = NULL;<br>
409 return -1;<br>
410 }<br>
411 }<br>
412 <br>
413 return (len / elsz);<br>
<br>
** CID 1472595: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
<br>
<br>
________________________________________________________________________________________________________<br>
*** CID 1472595: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
/bsps/shared/ofw/ofw.c: 538 in rtems_ofw_xref_from_node()<br>
532 }<br>
533 <br>
534 phandle_t rtems_ofw_xref_from_node( phandle_t node )<br>
535 {<br>
536 phandle_t ref;<br>
537 <br>
>>> CID 1472595: Memory - corruptions (ARRAY_VS_SINGLETON)<br>
>>> Passing "&ref" to function "rtems_ofw_get_enc_prop" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.<br>
538 if (rtems_ofw_get_enc_prop(node, "phandle", &ref, sizeof(ref)) == -1 &&<br>
539 rtems_ofw_get_enc_prop(node, "ibm,phandle", &ref, sizeof(ref)) == -1 &&<br>
540 rtems_ofw_get_enc_prop(node, "linux,phandle", &ref, sizeof(ref)) == -1)<br>
541 {<br>
542 return node;<br>
543 }<br>
<br>
<br>
________________________________________________________________________________________________________<br>
To view the defects in Coverity Scan visit, <a href="https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypUUzi-2FdSNmuyRB7BEFT8xQ4-2B8hpujh0hTgQljRGId4Dg-3D-3D4rCS_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRzqrUhmhYWDX-2FyQdnWo5YnM-2FFUamWoMY-2BoKaEuqI2cyQv-2F-2Fhu0OTnekxXXUMfFLrMvhuvV4eI1uHLQGggvvsj-2FLfNGn-2BGPcv-2FG4UQSY4tky86S7nsFiHxxfqeXd31O6xy-2FCgLy2h3kVviDDWthwfms12-2BjQqk8Zt9jVBFB6z3QmdY-3D" rel="noreferrer" target="_blank">https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypUUzi-2FdSNmuyRB7BEFT8xQ4-2B8hpujh0hTgQljRGId4Dg-3D-3D4rCS_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRzqrUhmhYWDX-2FyQdnWo5YnM-2FFUamWoMY-2BoKaEuqI2cyQv-2F-2Fhu0OTnekxXXUMfFLrMvhuvV4eI1uHLQGggvvsj-2FLfNGn-2BGPcv-2FG4UQSY4tky86S7nsFiHxxfqeXd31O6xy-2FCgLy2h3kVviDDWthwfms12-2BjQqk8Zt9jVBFB6z3QmdY-3D</a><br>
<br>
To manage Coverity Scan email notifications for "<a href="mailto:gedare@gwmail.gwu.edu" target="_blank">gedare@gwmail.gwu.edu</a>", click <a href="https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxkxN7gn3yK5ofbuH1ptBFYw9YgpazuIaA-2BBUVKiHj8oUDwYWUynp42iaapm4KJU8XqWU01jaV7ANE1ZK33b9AxrNSft0QTNSkD2bLN6ho-2BnY-3DliTr_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRz-2BKYfPnlg8v0lG2OqkZltGqoPujs4o3Ew0WTou9CIxoFc4RjvuFhkcXGRn3c7g6KmB509Izxa1pJ-2F-2FjZk3UcbB8IeOv8BL-2FA9BKCOzInvZG8-2BJhuSFCgnDMpdzFxT189-2FHmarweYa8ZFAFFgf29GheX05-2F2-2FArB0zn-2F7w52Pa2yo-3D" rel="noreferrer" target="_blank">https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxkxN7gn3yK5ofbuH1ptBFYw9YgpazuIaA-2BBUVKiHj8oUDwYWUynp42iaapm4KJU8XqWU01jaV7ANE1ZK33b9AxrNSft0QTNSkD2bLN6ho-2BnY-3DliTr_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRz-2BKYfPnlg8v0lG2OqkZltGqoPujs4o3Ew0WTou9CIxoFc4RjvuFhkcXGRn3c7g6KmB509Izxa1pJ-2F-2FjZk3UcbB8IeOv8BL-2FA9BKCOzInvZG8-2BJhuSFCgnDMpdzFxT189-2FHmarweYa8ZFAFFgf29GheX05-2F2-2FArB0zn-2F7w52Pa2yo-3D</a><br>
<br>
</div></div>