From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40131) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVwJh-0003el-71 for qemu-devel@nongnu.org; Thu, 12 Mar 2015 02:09:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YVwJe-0001Ik-1X for qemu-devel@nongnu.org; Thu, 12 Mar 2015 02:09:57 -0400 Received: from mout.web.de ([212.227.15.14]:61279) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YVwJd-0001Ic-Nv for qemu-devel@nongnu.org; Thu, 12 Mar 2015 02:09:53 -0400 Message-ID: <55012DAB.7080007@web.de> Date: Thu, 12 Mar 2015 07:09:47 +0100 From: Jan Kiszka MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="6KaMiTsGjeaHd0TfcQLFvljj0NIpwu2I4" Subject: [Qemu-devel] Coverity model of g_malloc_n & Co. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Markus Armbruster Cc: qemu-devel This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6KaMiTsGjeaHd0TfcQLFvljj0NIpwu2I4 Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: quoted-printable Hi Markus, due to a lack of publicly available documentation on the Coverity modeling language (or my blindness to find it), I was about to steal some patterns from QEMU (to improve the kmalloc model for the kernel). I think I stumbled over some inconsistency: Don't we need to allocate the calculated size here, not the passed one? diff --git a/scripts/coverity-model.c b/scripts/coverity-model.c index 58356af..cdda259 100644 --- a/scripts/coverity-model.c +++ b/scripts/coverity-model.c @@ -123,7 +123,7 @@ void *g_malloc_n(size_t nmemb, size_t size) __coverity_negative_sink__(nmemb); __coverity_negative_sink__(size); sz =3D nmemb * size; - ptr =3D __coverity_alloc__(size); + ptr =3D __coverity_alloc__(sz); __coverity_mark_as_uninitialized_buffer__(ptr); __coverity_mark_as_afm_allocated__(ptr, "g_free"); return ptr; @@ -137,7 +137,7 @@ void *g_malloc0_n(size_t nmemb, size_t size) __coverity_negative_sink__(nmemb); __coverity_negative_sink__(size); sz =3D nmemb * size; - ptr =3D __coverity_alloc__(size); + ptr =3D __coverity_alloc__(sz); __coverity_writeall0__(ptr); __coverity_mark_as_afm_allocated__(ptr, "g_free"); return ptr; @@ -151,7 +151,7 @@ void *g_realloc_n(void *ptr, size_t nmemb, size_t siz= e) __coverity_negative_sink__(size); sz =3D nmemb * size; __coverity_escape__(ptr); - ptr =3D __coverity_alloc__(size); + ptr =3D __coverity_alloc__(sz); /* * Memory beyond the old size isn't actually initialized. Can't * model that. See Coverity's realloc() model If so, I can file a proper patch later. Jan --6KaMiTsGjeaHd0TfcQLFvljj0NIpwu2I4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlUBLasACgkQitSsb3rl5xSk+QCgoWzvv6rHYEFm6FV6wNm/SjpZ e5cAnjAkVqsuYfgsiPZkClf9rr+NmMAe =zseH -----END PGP SIGNATURE----- --6KaMiTsGjeaHd0TfcQLFvljj0NIpwu2I4--