From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98D16C433F5 for ; Mon, 15 Nov 2021 18:02:45 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AC3826326A for ; Mon, 15 Nov 2021 18:02:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org AC3826326A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 16D7A8373D; Mon, 15 Nov 2021 19:02:43 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="tSH9XMM1"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id CFE4B83790; Mon, 15 Nov 2021 19:02:41 +0100 (CET) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4416383717 for ; Mon, 15 Nov 2021 19:02:38 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-qt1-x82e.google.com with SMTP id a2so16358325qtx.11 for ; Mon, 15 Nov 2021 10:02:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=date:from:to:subject:message-id:mime-version:content-disposition; bh=hX2s1CQrs2FRE4m48MS+fpBAqp0aDfLlaZd1e8GP+Qs=; b=tSH9XMM1RF48/ArQwZboShrMN6l5B3Npoz2xcynmPu9WqlGtBxqoti5jP/LUlJK2JV pmHHTV+/Rfec5R9o+kLXAuoDjzRSQ0tZcCTYXPw+kndj3GBLxJZJ5xMD7F2leOZXJ4Wa goquEqbAB/2N1CCbqx4PqBp7YUm4yDk3hkeJ8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:subject:message-id:mime-version :content-disposition; bh=hX2s1CQrs2FRE4m48MS+fpBAqp0aDfLlaZd1e8GP+Qs=; b=q00kzkzWEEiQmY68+yZdTfvXq3ikdHk3FYA1jSPYtLb6VFrMOH/JKaa4OXNm9tKLem 04PW2PGw0UidyONFPI4DB/QnG7VkzcPtPXP4XZR3Mt5fmAmF1LXNi3HgZT9fb/c7RdQz Qb/Xw9kIWOvQb7Drt253UCscsMyKOwKTMskBmX3qhElQveMMuvtsxLUhgfIL6mb7GNQi sCuUZe9RNWU84T2SxnWsmo49jpFDZMPD5ORN4oug/BjbOqFgwujE2V+d180OIKZtVCG6 CJs23tWjr0H7WBUyFHVAbgPiPDvPuMm4+kfbWxnTv+81booNLIpSQbKy1V8JGFHGDDmn TMkQ== X-Gm-Message-State: AOAM530JLMQGNol29KaCiqR1fAEA4pPgmOjBcwjmAohxNfDCI40kFKuf Q3LY628hupfsbtXolU/QtLlcwNAlctkmKQ== X-Google-Smtp-Source: ABdhPJwDfdgVqo+OVrYuN13kwtqqxtnMx++bG21cq8Pnx+7aBrEGHT+cGwmAeDt03DeLuZy1Bug4SQ== X-Received: by 2002:ac8:4a0e:: with SMTP id x14mr873659qtq.345.1636999356898; Mon, 15 Nov 2021 10:02:36 -0800 (PST) Received: from bill-the-cat (2603-6081-7b01-cbda-24a1-dfd8-1438-caaa.res6.spectrum.com. [2603:6081:7b01:cbda:24a1:dfd8:1438:caaa]) by smtp.gmail.com with ESMTPSA id r26sm1020350qtm.67.2021.11.15.10.02.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Nov 2021 10:02:35 -0800 (PST) Date: Mon, 15 Nov 2021 13:02:33 -0500 From: Tom Rini To: u-boot@lists.denx.de, Simon Glass Subject: [scan-admin@coverity.com: New Defects reported by Coverity Scan for Das U-Boot] Message-ID: <20211115180233.GV24579@bill-the-cat> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="gRH+qzXGttQm6w+q" Content-Disposition: inline X-Clacks-Overhead: GNU Terry Pratchett X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.35 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean --gRH+qzXGttQm6w+q Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Now I'm not 100% sure if this is actually new or due to the code moving, since there's a new helper function involved, and I also know I had to hand-merge this section due to the zboot related changes. ----- Forwarded message from scan-admin@coverity.com ----- Date: Mon, 15 Nov 2021 17:10:36 +0000 (UTC) =46rom: scan-admin@coverity.com To: tom.rini@gmail.com Subject: New Defects reported by Coverity Scan for Das U-Boot Hi, Please find the latest report on new defect(s) introduced to Das U-Boot fou= nd with Coverity Scan. 1 new defect(s) introduced to Das U-Boot found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 131256: Security best practices violations (STRING_OVERFLOW) /boot/pxe_utils.c: 468 in label_boot() ___________________________________________________________________________= _____________________________ *** CID 131256: Security best practices violations (STRING_OVERFLOW) /boot/pxe_utils.c: 468 in label_boot() 462 printf("Skipping %s for failure retrieving initrd\n", 463 label->name); 464 return 1; 465 } 466 =20 467 initrd_addr_str =3D env_get("ramdisk_addr_r"); >>> CID 131256: Security best practices violations (STRING_OVERFLOW) >>> You might overrun the 10-character fixed-size string "initrd_filesi= ze" by copying the return value of "simple_xtoa" without checking the lengt= h. 468 strcpy(initrd_filesize, simple_xtoa(size)); 469 =20 470 strncpy(initrd_str, initrd_addr_str, 18); 471 strcat(initrd_str, ":"); 472 strncat(initrd_str, initrd_filesize, 9); 473 } ___________________________________________________________________________= _____________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.n= et/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yoA22WlOQ-2By3= ieUvdbKmOyw68TMVT4Kip-2BBzfOGWXJ5yIiYplmPF9KAnKIja4Zd7tU-3DqDBS_EEm8SbLgSDs= aDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTs3WaBv80RE1DzruJJZi6BnrEYmnrpcEhMD7i6Nn71m= QEiN89q-2B05dnIrl-2F-2FLg-2FyyKhNlhf8f6j98klrBBZkTjKpvVHRnkKQV4P8RJHrC-2FTl= H-2FnR3hd-2B-2FB4Xs9jPdh0o38re9-2FCcUQKHUJRCJuEiM0XGs5hL9sNTUyuPqeCqFN29A-3= D-3D To manage Coverity Scan email notifications for "tom.rini@gmail.com", cli= ck https://u15810271.ct.sendgrid.net/ls/click?upn=3DHRESupC-2F2Czv4BOaCWWCy= 7my0P0qcxCbhZ31OYv50yped04pjJnmXOsUBtKYNIXxWeIHzDeopm-2BEWQ6S6K-2FtUHv9ZTk8= qZbuzkkz9sa-2BJFw4elYDyedRVZOC-2ButxjBZdouVmTGuWB6Aj6G7lm7t25-2Biv1B-2B9082= pHzCCex2kqMs-3DijCU_EEm8SbLgSDsaDZif-2Bv7ch8WqhKpLoKErHi4nXpwDNTs3WaBv80RE1= DzruJJZi6BnLcSIt4qRszMu8-2Fc6KHwE4eIspInu-2BW-2BBj23zAvCJHJy3kqoIbz4ydm6YAo= 63IB6MH66h52-2BUSdSSZFOCcaOcTEKYnCZ7XyrLuHLqrOy9IJQ0bUxbb-2F7xYHStimToW4RrC= 0VtoGZ4LNyOVS-2FVJOdQaw-3D-3D ----- End forwarded message ----- --=20 Tom --gRH+qzXGttQm6w+q Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmGSoK8ACgkQFHw5/5Y0 tyx65QwAozVyON+xVMoRqVIm67gHZRPV0ib0pLDWOit3orqkFhyN+DqGbAtGMUZK qepYA0MA5epBCffW46cCtKAz9+H4cGRAFljGf17bPthqDPJgieBK79kibX8pfkUn OXxG0LAR7QxP9mLMoFWXO2iwvueJdlAWX5WslNbaNEe+6ZIpx7dwh/BAlosmlWWX y2OaoCY+3zWuzXYccEoQWQbtPgy8kGUiNQr0uOccST27CfgLY/t4zWuPgzd7GX5y b4l6adbFvB7MoqtrGwosaXlVTjUfoObFxwljGSYuXmeaWL+yEuzX4/VQyruiQ61j Ckelx0xEHsH99tz9JXiIlyFmbS9B2PveFv2lB/XsLQqprZS4V2anwlHykXC/lm58 A7Q8ebRJn27hHAzGBTbOxStRbpz/ihFwumYVyu9c5WAZcBs2wWrYyb5ZRSjuIkWq Mfa2PcCUq+wA3ZdYKiCHUP+2I0RMCSWjzq1w6E1p1tLK7/yFe9m6r0Uj2NCssza6 +DSL19QQ =dEuX -----END PGP SIGNATURE----- --gRH+qzXGttQm6w+q--