[tom.rini@gmail.com: Fwd: New Defects reported by Coverity Scan for Das U-Boot]

[Tom Rini <trini@konsulko.com>]

[-- Attachment #1: Type: text/plain, Size: 7498 bytes --]

Here's the latest report.

---------- Forwarded message ---------
From: <scan-admin@coverity.com>
Date: Tue, Jul 25, 2023 at 5:29 PM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <tom.rini@gmail.com>


Hi,

Please find the latest report on new defect(s) introduced to Das
U-Boot found with Coverity Scan.

5 new defect(s) introduced to Das U-Boot found with Coverity Scan.
30 defect(s), reported by Coverity Scan earlier, were marked fixed in
the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)


** CID 463147:  Insecure data handling  (TAINTED_SCALAR)


________________________________________________________________________________________________________
*** CID 463147:  Insecure data handling  (TAINTED_SCALAR)
/common/fdt_support.c: 1115 in fdt_copy_fixed_partitions()
1109                            res = fdt_setprop_string(blob, suboff, "label",
1110
ofnode_read_string(subnode, "label"));
1111                            if (res)
1112                                    return res;
1113
1114                            reg = ofnode_get_property(subnode, "reg", &len);
>>>     CID 463147:  Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted expression "len" to "fdt_setprop", which uses it as an offset.
1115                            res = fdt_setprop(blob, suboff, "reg",
reg, len);
1116                            if (res)
1117                                    return res;
1118                    }
1119
1120                    /* go to next fixed-partitions node */

** CID 463146:  Null pointer dereferences  (NULL_RETURNS)


________________________________________________________________________________________________________
*** CID 463146:  Null pointer dereferences  (NULL_RETURNS)
/common/fdt_support.c: 1115 in fdt_copy_fixed_partitions()
1109                            res = fdt_setprop_string(blob, suboff, "label",
1110
ofnode_read_string(subnode, "label"));
1111                            if (res)
1112                                    return res;
1113
1114                            reg = ofnode_get_property(subnode, "reg", &len);
>>>     CID 463146:  Null pointer dereferences  (NULL_RETURNS)
>>>     Dereferencing a pointer that might be "NULL" "reg" when calling "fdt_setprop".
1115                            res = fdt_setprop(blob, suboff, "reg",
reg, len);
1116                            if (res)
1117                                    return res;
1118                    }
1119
1120                    /* go to next fixed-partitions node */

** CID 463145:  Error handling issues  (CHECKED_RETURN)
/lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb()


________________________________________________________________________________________________________
*** CID 463145:  Error handling issues  (CHECKED_RETURN)
/lib/efi_loader/efi_firmware.c: 176 in efi_firmware_get_lsv_from_dtb()
170             fdt_for_each_subnode(offset, fdt, parent) {
171                     efi_guid_t guid;
172
173                     guid_str = fdt_getprop(fdt, offset,
"image-type-id", &len);
174                     if (!guid_str)
175                             continue;
>>>     CID 463145:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "uuid_str_to_bin" without checking return value (as is done elsewhere 7 out of 8 times).
176                     uuid_str_to_bin(guid_str, guid.b, UUID_STR_FORMAT_GUID);
177
178                     val = fdt_getprop(fdt, offset, "image-index", &len);
179                     if (!val)
180                             continue;
181                     index = fdt32_to_cpu(*val);

** CID 463144:    (CHECKED_RETURN)
/boot/expo.c: 257 in expo_apply_theme()
/boot/expo.c: 258 in expo_apply_theme()
/boot/expo.c: 259 in expo_apply_theme()


________________________________________________________________________________________________________
*** CID 463144:    (CHECKED_RETURN)
/boot/expo.c: 257 in expo_apply_theme()
251             struct expo_theme *theme = &exp->theme;
252             int ret;
253
254             log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256             memset(theme, '\0', sizeof(struct expo_theme));
>>>     CID 463144:    (CHECKED_RETURN)
>>>     Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
257             ofnode_read_u32(node, "font-size", &theme->font_size);
258             ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
259             ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261             list_for_each_entry(scn, &exp->scene_head, sibling) {
262                     ret = scene_apply_theme(scn, theme);
/boot/expo.c: 258 in expo_apply_theme()
252             int ret;
253
254             log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256             memset(theme, '\0', sizeof(struct expo_theme));
257             ofnode_read_u32(node, "font-size", &theme->font_size);
>>>     CID 463144:    (CHECKED_RETURN)
>>>     Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
258             ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
259             ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261             list_for_each_entry(scn, &exp->scene_head, sibling) {
262                     ret = scene_apply_theme(scn, theme);
263                     if (ret)
/boot/expo.c: 259 in expo_apply_theme()
253
254             log_debug("Applying theme %s\n", ofnode_get_name(node));
255
256             memset(theme, '\0', sizeof(struct expo_theme));
257             ofnode_read_u32(node, "font-size", &theme->font_size);
258             ofnode_read_u32(node, "menu-inset", &theme->menu_inset);
>>>     CID 463144:    (CHECKED_RETURN)
>>>     Calling "ofnode_read_u32" without checking return value (as is done elsewhere 33 out of 41 times).
259             ofnode_read_u32(node, "menuitem-gap-y", &theme->menuitem_gap_y);
260
261             list_for_each_entry(scn, &exp->scene_head, sibling) {
262                     ret = scene_apply_theme(scn, theme);
263                     if (ret)
264                             return log_msg_ret("app", ret);
265             }
266
267             return 0;

** CID 463143:  Control flow issues  (DEADCODE)
/test/dm/part.c: 124 in do_get_info_test()


________________________________________________________________________________________________________
*** CID 463143:  Control flow issues  (DEADCODE)
/test/dm/part.c: 124 in do_get_info_test()
118
119             memset(&p, 0, sizeof(p));
120
121             ret = part_get_info_by_type(dev_desc, part, part_type, &p);
122             printf("part_get_info_by_type(%d, 0x%x) = %d\n", part,
part_type, ret);
123             if (ut_assertok(ret)) {
>>>     CID 463143:  Control flow issues  (DEADCODE)
>>>     Execution cannot reach this statement: "return 0;".
124                     return 0;
125             }
126
127             ut_asserteq(reference->start, p.start);
128             ut_asserteq(reference->size, p.size);
129             ut_asserteq(reference->sys_ind, p.sys_ind);


________________________________________________________________________________________________________

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]