Fwd: New Defects reported by Coverity Scan for RTEMS

Gedare Bloom gedare at rtems.org
Thu Jan 28 20:06:30 UTC 2021


fyi; I should see if I can get this put to the list directly...

---------- Forwarded message ---------
From: <scan-admin at coverity.com>
Date: Thu, Jan 28, 2021 at 11:59 AM
Subject: New Defects reported by Coverity Scan for RTEMS
To: <gedare at gwmail.gwu.edu>


Hi,

Please find the latest report on new defect(s) introduced to RTEMS found
with Coverity Scan.

7 new defect(s) introduced to RTEMS found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the
recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 7 of 7 defect(s)


** CID 1472601:  Null pointer dereferences  (NULL_RETURNS)
/bsps/shared/ofw/ofw.c: 627 in rtems_ofw_get_reg()


________________________________________________________________________________________________________
*** CID 1472601:  Null pointer dereferences  (NULL_RETURNS)
/bsps/shared/ofw/ofw.c: 627 in rtems_ofw_get_reg()
621         nranges = len / sizeof(rtems_ofw_ranges);
622
623         offset = 0;
624         for (int i=0; i < nregs; i++) {
625           for (int j=0; j < nranges; j++) {
626
>>>     CID 1472601:  Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing "ptr", which is known to be "NULL".
627             range.parent_bus = fdt32_to_cpu(ptr[j].parent_bus);
628             range.child_bus = fdt32_to_cpu(ptr[j].child_bus);
629             range.size = fdt32_to_cpu(ptr[j].size);
630
631             if (buf[i].start >= range.child_bus &&
632                 buf[i].start < range.child_bus + range.size) {

** CID 1472600:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 377 in rtems_ofw_get_enc_prop_alloc()


________________________________________________________________________________________________________
*** CID 1472600:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 377 in rtems_ofw_get_enc_prop_alloc()
371         if (*buf == NULL) {
372           return -1;
373         }
374
375         if (rtems_ofw_get_enc_prop(node, propname, *buf, len) == -1) {
376           rtems_ofw_free(buf);
>>>     CID 1472600:  Memory - corruptions  (USE_AFTER_FREE)
>>>     Dereferencing freed pointer "buf".
377           *buf = NULL;
378           return -1;
379         }
380       }
381
382       return len;

** CID 1472599:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 348 in rtems_ofw_get_prop_alloc_multi()


________________________________________________________________________________________________________
*** CID 1472599:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 348 in rtems_ofw_get_prop_alloc_multi()
342         if (*buf == NULL) {
343           return -1;
344         }
345
346         if (rtems_ofw_get_prop(node, propname, *buf, len) == -1) {
347           rtems_ofw_free(buf);
>>>     CID 1472599:  Memory - corruptions  (USE_AFTER_FREE)
>>>     Dereferencing freed pointer "buf".
348           *buf = NULL;
349           return -1;
350         }
351       }
352
353       return (len / elsz);

** CID 1472598:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 317 in rtems_ofw_get_prop_alloc()


________________________________________________________________________________________________________
*** CID 1472598:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 317 in rtems_ofw_get_prop_alloc()
311         if (*buf == NULL) {
312           return -1;
313         }
314
315         if (rtems_ofw_get_prop(node, propname, *buf, len) == -1) {
316           rtems_ofw_free(buf);
>>>     CID 1472598:  Memory - corruptions  (USE_AFTER_FREE)
>>>     Dereferencing freed pointer "buf".
317           *buf = NULL;
318           return -1;
319         }
320       }
321
322       return len;

** CID 1472597:  Memory - corruptions  (ARRAY_VS_SINGLETON)


________________________________________________________________________________________________________
*** CID 1472597:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/bsps/shared/ofw/ofw.c: 510 in rtems_ofw_get_effective_phandle()
504
505       for (child = rtems_ofw_child(node); child != 0; child =
rtems_ofw_peer(child)) {
506         ref = rtems_ofw_get_effective_phandle(child, xref);
507         if (ref != -1)
508           return ref;
509
>>>     CID 1472597:  Memory - corruptions  (ARRAY_VS_SINGLETON)
>>>     Passing "&ref" to function "rtems_ofw_get_enc_prop" which uses it
as an array. This might corrupt or misinterpret adjacent memory locations.
510         if (rtems_ofw_get_enc_prop(child, "phandle", &ref, sizeof(ref))
== -1 &&
511             rtems_ofw_get_enc_prop(child, "ibm,phandle", &ref,
sizeof(ref)) == -1 &&
512             rtems_ofw_get_enc_prop(child, "linux,phandle", &ref,
sizeof(ref)) == -1
513         ) {
514           continue;
515         }

** CID 1472596:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 408 in rtems_ofw_get_enc_prop_alloc_multi()


________________________________________________________________________________________________________
*** CID 1472596:  Memory - corruptions  (USE_AFTER_FREE)
/bsps/shared/ofw/ofw.c: 408 in rtems_ofw_get_enc_prop_alloc_multi()
402         if (*buf == NULL) {
403           return -1;
404         }
405
406         if (rtems_ofw_get_enc_prop(node, propname, *buf, len) == -1) {
407           rtems_ofw_free(buf);
>>>     CID 1472596:  Memory - corruptions  (USE_AFTER_FREE)
>>>     Dereferencing freed pointer "buf".
408           *buf = NULL;
409           return -1;
410         }
411       }
412
413       return (len / elsz);

** CID 1472595:  Memory - corruptions  (ARRAY_VS_SINGLETON)


________________________________________________________________________________________________________
*** CID 1472595:  Memory - corruptions  (ARRAY_VS_SINGLETON)
/bsps/shared/ofw/ofw.c: 538 in rtems_ofw_xref_from_node()
532     }
533
534     phandle_t rtems_ofw_xref_from_node( phandle_t node )
535     {
536       phandle_t ref;
537
>>>     CID 1472595:  Memory - corruptions  (ARRAY_VS_SINGLETON)
>>>     Passing "&ref" to function "rtems_ofw_get_enc_prop" which uses it
as an array. This might corrupt or misinterpret adjacent memory locations.
538         if (rtems_ofw_get_enc_prop(node, "phandle", &ref, sizeof(ref))
== -1 &&
539             rtems_ofw_get_enc_prop(node, "ibm,phandle", &ref,
sizeof(ref)) == -1 &&
540             rtems_ofw_get_enc_prop(node, "linux,phandle", &ref,
sizeof(ref)) == -1)
541         {
542           return node;
543         }


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit,
https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypUUzi-2FdSNmuyRB7BEFT8xQ4-2B8hpujh0hTgQljRGId4Dg-3D-3D4rCS_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRzqrUhmhYWDX-2FyQdnWo5YnM-2FFUamWoMY-2BoKaEuqI2cyQv-2F-2Fhu0OTnekxXXUMfFLrMvhuvV4eI1uHLQGggvvsj-2FLfNGn-2BGPcv-2FG4UQSY4tky86S7nsFiHxxfqeXd31O6xy-2FCgLy2h3kVviDDWthwfms12-2BjQqk8Zt9jVBFB6z3QmdY-3D

  To manage Coverity Scan email notifications for "gedare at gwmail.gwu.edu",
click
https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxkxN7gn3yK5ofbuH1ptBFYw9YgpazuIaA-2BBUVKiHj8oUDwYWUynp42iaapm4KJU8XqWU01jaV7ANE1ZK33b9AxrNSft0QTNSkD2bLN6ho-2BnY-3DliTr_NXfCUf1CLFYLbjXajJIgHlbL5qYn95oel6MvjPauKObfKXAxQ82kyzbTTgHGbdRz-2BKYfPnlg8v0lG2OqkZltGqoPujs4o3Ew0WTou9CIxoFc4RjvuFhkcXGRn3c7g6KmB509Izxa1pJ-2F-2FjZk3UcbB8IeOv8BL-2FA9BKCOzInvZG8-2BJhuSFCgnDMpdzFxT189-2FHmarweYa8ZFAFFgf29GheX05-2F2-2FArB0zn-2F7w52Pa2yo-3D
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/devel/attachments/20210128/bb56b4e0/attachment.html>


More information about the devel mailing list