[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Anton Moryakov]

Report of the static analyzer:
The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow 
because its operands are not cast to a larger data type before performing arithmetic

Corrections explained:
Added casting reginfo->offset to long long

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 ubi-utils/mtdinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..850297b 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 		ret_locked = ret_bad = errno_locked = errno_bad = 0;
 
 	for (i = 0; i < reginfo->numblocks; ++i) {
-		start = reginfo->offset + i * reginfo->erasesize;
+		start = (long long)reginfo->offset + i * reginfo->erasesize;
 		printf(" %*i: %08lx ", width, i, start);
 
 		if (ret_locked != -1) {
-- 
2.30.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Anton Moryakov]

Report of the static analyzer:
The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow 
because its operands are not cast to a larger data type before performing arithmetic

Corrections explained:
Added casting reginfo->offset to long long

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 ubi-utils/mtdinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..850297b 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 		ret_locked = ret_bad = errno_locked = errno_bad = 0;
 
 	for (i = 0; i < reginfo->numblocks; ++i) {
-		start = reginfo->offset + i * reginfo->erasesize;
+		start = (long long)reginfo->offset + i * reginfo->erasesize;
 		printf(" %*i: %08lx ", width, i, start);
 
 		if (ret_locked != -1) {
-- 
2.30.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Zhihao Cheng]

在 2024/12/13 1:13, Anton Moryakov 写道:
> Report of the static analyzer:
> The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow
> because its operands are not cast to a larger data type before performing arithmetic
> 
> Corrections explained:
> Added casting reginfo->offset to long long
> 
> Triggers found by static analyzer Svace.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> ---
>   ubi-utils/mtdinfo.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
> index 7dff0de..850297b 100644
> --- a/ubi-utils/mtdinfo.c
> +++ b/ubi-utils/mtdinfo.c
> @@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
>   		ret_locked = ret_bad = errno_locked = errno_bad = 0;
>   
>   	for (i = 0; i < reginfo->numblocks; ++i) {
> -		start = reginfo->offset + i * reginfo->erasesize;

Hi Anton.
I think the expression 'i*reginfo->erasesize' could overflow too. 
Besides, 'unsigned long start' could be a 32-bit number on a 32-bit 
platform.
So, we should make 'start' be the 'unsigned long long' type, and then 
convert 'i' into 'unsigned long long' in expression 'i * 
reginfo->erasesize'. For example, start = reginfo->offset + (unsigned 
long long)i * reginfo->erasesize.
> +		start = (long long)reginfo->offset + i * reginfo->erasesize;
>   		printf(" %*i: %08lx ", width, i, start);
>   
>   		if (ret_locked != -1) {
> 


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Anton Moryakov]

Report of the static analyzer:
The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow 
because its operands are not cast to a larger data type before performing arithmetic

Corrections explained:
Added casting reginfo->offset to long long

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 ubi-utils/mtdinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..850297b 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 		ret_locked = ret_bad = errno_locked = errno_bad = 0;
 
 	for (i = 0; i < reginfo->numblocks; ++i) {
-		start = reginfo->offset + i * reginfo->erasesize;
+		start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
 		printf(" %*i: %08lx ", width, i, start);
 
 		if (ret_locked != -1) {
-- 
2.30.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Zhihao Cheng]

在 2024/12/13 21:15, Anton Moryakov 写道:
> Report of the static analyzer:
> The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow
> because its operands are not cast to a larger data type before performing arithmetic
> 
> Corrections explained:
> Added casting reginfo->offset to long long
> 
> Triggers found by static analyzer Svace.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> ---
>   ubi-utils/mtdinfo.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
> index 7dff0de..850297b 100644
> --- a/ubi-utils/mtdinfo.c
> +++ b/ubi-utils/mtdinfo.c
> @@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
>   		ret_locked = ret_bad = errno_locked = errno_bad = 0;
>   

Hi Anton.
Please make 'start' be the 'unsigned long long' type, otherwise type 
'unsigned long' could be 32-bit width on a 32-bit platform.

>   	for (i = 0; i < reginfo->numblocks; ++i) {
> -		start = reginfo->offset + i * reginfo->erasesize;
> +		start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
>   		printf(" %*i: %08lx ", width, i, start);
>   
>   		if (ret_locked != -1) {
> 


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Anton Moryakov]

Report of the static analyzer:
The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow 
because its operands are not cast to a larger data type before performing arithmetic

Corrections explained:
Added casting i and start to unsigned long long

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 ubi-utils/mtdinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..850297b 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 		ret_locked = ret_bad = errno_locked = errno_bad = 0;
 
 	for (i = 0; i < reginfo->numblocks; ++i) {
-		start = reginfo->offset + i * reginfo->erasesize;
+		(unsigned long long)start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
 		printf(" %*i: %08lx ", width, i, start);
 
 		if (ret_locked != -1) {
-- 
2.30.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Zhihao Cheng]

在 2024/12/14 18:51, Anton Moryakov 写道:
> Report of the static analyzer:
> The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow
> because its operands are not cast to a larger data type before performing arithmetic
> 
> Corrections explained:
> Added casting i and start to unsigned long long
> 
> Triggers found by static analyzer Svace.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> ---
>   ubi-utils/mtdinfo.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
> index 7dff0de..850297b 100644
> --- a/ubi-utils/mtdinfo.c
> +++ b/ubi-utils/mtdinfo.c
> @@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
>   		ret_locked = ret_bad = errno_locked = errno_bad = 0;
>   
>   	for (i = 0; i < reginfo->numblocks; ++i) {
> -		start = reginfo->offset + i * reginfo->erasesize;
> +		(unsigned long long)start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
>   		printf(" %*i: %08lx ", width, i, start);
>   
>   		if (ret_locked != -1) {
> 

What I mean is modifying like following:

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..12d35eb 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -185,7 +185,7 @@ static void print_ubi_info(const struct mtd_info 
*mtd_info,
  static void print_region_map(const struct mtd_dev_info *mtd, int fd,
                              const region_info_t *reginfo)
  {
-       unsigned long start;
+       unsigned long long start;
         int i, width;
         int ret_locked, errno_locked, ret_bad, errno_bad;

@@ -203,7 +203,7 @@ static void print_region_map(const struct 
mtd_dev_info *mtd, int fd,
                 ret_locked = ret_bad = errno_locked = errno_bad = 0;

         for (i = 0; i < reginfo->numblocks; ++i) {
-               start = reginfo->offset + i * reginfo->erasesize;
+               start = reginfo->offset + (unsigned long long)i * 
reginfo->erasesize;
                 printf(" %*i: %08lx ", width, i, start);

                 if (ret_locked != -1) {

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Anton Moryakov]

Report of the static analyzer:
The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow
because its operands are not cast to a larger data type before performing arithmetic

Corrections explained:
Added casting i and start to unsigned long long

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 ubi-utils/mtdinfo.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
index 7dff0de..12d35eb 100644
--- a/ubi-utils/mtdinfo.c
+++ b/ubi-utils/mtdinfo.c
@@ -185,7 +185,7 @@ static void print_ubi_info(const struct mtd_info *mtd_info,
 static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 			     const region_info_t *reginfo)
 {
-	unsigned long start;
+	unsigned long long start;
 	int i, width;
 	int ret_locked, errno_locked, ret_bad, errno_bad;
 
@@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
 		ret_locked = ret_bad = errno_locked = errno_bad = 0;
 
 	for (i = 0; i < reginfo->numblocks; ++i) {
-		start = reginfo->offset + i * reginfo->erasesize;
+		start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
 		printf(" %*i: %08lx ", width, i, start);
 
 		if (ret_locked != -1) {
-- 
2.30.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH mtd-utils] ubi-utils: Fix integer overflow in mtdinfo.c

[Zhihao Cheng]

在 2024/12/14 20:31, Anton Moryakov 写道:
> Report of the static analyzer:
> The value of an arithmetic expression 'reginfo->offset + i * reginfo->erasesize' is a subject to overflow
> because its operands are not cast to a larger data type before performing arithmetic
> 
> Corrections explained:
> Added casting i and start to unsigned long long
> 
> Triggers found by static analyzer Svace.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> ---
>   ubi-utils/mtdinfo.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 

Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
> diff --git a/ubi-utils/mtdinfo.c b/ubi-utils/mtdinfo.c
> index 7dff0de..12d35eb 100644
> --- a/ubi-utils/mtdinfo.c
> +++ b/ubi-utils/mtdinfo.c
> @@ -185,7 +185,7 @@ static void print_ubi_info(const struct mtd_info *mtd_info,
>   static void print_region_map(const struct mtd_dev_info *mtd, int fd,
>   			     const region_info_t *reginfo)
>   {
> -	unsigned long start;
> +	unsigned long long start;
>   	int i, width;
>   	int ret_locked, errno_locked, ret_bad, errno_bad;
>   
> @@ -203,7 +203,7 @@ static void print_region_map(const struct mtd_dev_info *mtd, int fd,
>   		ret_locked = ret_bad = errno_locked = errno_bad = 0;
>   
>   	for (i = 0; i < reginfo->numblocks; ++i) {
> -		start = reginfo->offset + i * reginfo->erasesize;
> +		start = reginfo->offset + (unsigned long long)i * reginfo->erasesize;
>   		printf(" %*i: %08lx ", width, i, start);
>   
>   		if (ret_locked != -1) {
> 


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/