From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Rini Date: Tue, 26 Jan 2021 12:02:24 -0500 Subject: [scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot] In-Reply-To: <20210121020916.GA9519@laputa> References: <20210120190418.GA9782@bill-the-cat> <20210121020916.GA9519@laputa> Message-ID: <20210126170224.GW7530@bill-the-cat> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On Thu, Jan 21, 2021 at 11:09:16AM +0900, AKASHI Takahiro wrote: > Tom, > > Regarding EFI capsule update, [snip] > > > ** CID 316360: Uninitialized variables (UNINIT) > > > /tools/mkeficapsule.c: 298 in create_fwbin() > > > > > > > > > ________________________________________________________________________________________________________ > > > *** CID 316360: Uninitialized variables (UNINIT) > > > /tools/mkeficapsule.c: 298 in create_fwbin() > > > 292 goto err_3; > > > 293 } > > > 294 > > > 295 capsule.version = 0x00000001; > > > 296 capsule.embedded_driver_count = 0; > > > 297 capsule.payload_item_count = 1; > > > > > > CID 316360: Uninitialized variables (UNINIT) > > > > > > Using uninitialized value "capsule". Field "capsule.item_offset_list" is uninitialized when calling "fwrite". > > > 298 size = fwrite(&capsule, 1, sizeof(capsule), f); > > This code is safe because capsule.item_offset_list is actually > defined as "item_offset_list[]" (null array) at the end of the structure > and the data will be filled in by the succeeding fwrite()'s. > > What action should be taken to suppress this warning? > > > > 299 if (size < (sizeof(capsule))) { > > > 300 printf("write failed (%lx)\n", size); > > > 301 goto err_3; > > > 302 } > > > 303 offset = sizeof(capsule) + sizeof(u64); > > > > > > ** CID 316359: Null pointer dereferences (FORWARD_NULL) > > > > > > > > > ________________________________________________________________________________________________________ > > > *** CID 316359: Null pointer dereferences (FORWARD_NULL) > > > /lib/efi_loader/efi_capsule.c: 380 in efi_capsule_update_firmware() > > > 374 ret = EFI_UNSUPPORTED; > > > 375 goto out; > > > 376 } > > > 377 > > > 378 /* find a device for update firmware */ > > > 379 /* TODO: should we pass index as well, or nothing but type? */ > > > > > > CID 316359: Null pointer dereferences (FORWARD_NULL) > > > > > > Passing null pointer "handles" to "efi_fmp_find", which dereferences it. > > > 380 fmp = efi_fmp_find(&image->update_image_type_id, > > > 381 image->update_hardware_instance, > > > 382 handles, no_handles); > > This code is safe because "handles" is actually an array of pointers > and "no_handles" indicates the number of elements in this array. > efi_fmp_find() will not dereference handles at all if no_handles is zero. > > What action should be taken to suppress this warning? I've updated Coverity to list both of these as intentional / ignore, thanks. -- Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: not available URL: