Fwd: New Defects reported by Coverity Scan for Das U-Boot

Tom Rini
2024-10-19T16:16:28Z

[-- Attachment #1: Type: text/plain, Size: 2521 bytes --]

Here's a short update.

---------- Forwarded message ---------
From: <scan-admin@coverity.com>
Date: Sat, Oct 19, 2024, 8:35 AM
Subject: New Defects reported by Coverity Scan for Das U-Boot
To: <tom.rini@gmail.com>

Hi,

Please find the latest report on new defect(s) introduced to Das U-Boot
found with Coverity Scan.

2 new defect(s) introduced to Das U-Boot found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the
recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)

** CID 510857: Memory - corruptions (OVERRUN)

________________________________________________________________________________________________________
*** CID 510857: Memory - corruptions (OVERRUN)
/test/boot/bootdev.c: 160 in bootdev_test_any()
154 */
155 if (CONFIG_IS_ENABLED(DSA_SANDBOX))
156 seq = "8";
157 else
158 seq = "6";
159
>>> CID 510857: Memory - corruptions (OVERRUN)
>>> Overrunning buffer pointed to by "seq" of 2 bytes by passing it to
a function which accesses it at byte offset 2.
160 ut_assertok(bootdev_find_by_any(seq, &dev, &mflags));
161 ut_asserteq(UCLASS_BOOTDEV, device_get_uclass_id(dev));
162 ut_asserteq(BOOTFLOW_METHF_SINGLE_DEV, mflags);
163 media = dev_get_parent(dev);
164 ut_asserteq(UCLASS_MMC, device_get_uclass_id(media));
165 ut_asserteq_str("mmc2", media->name);

** CID 510856: Control flow issues (UNREACHABLE)
/lib/binman.c: 142 in binman_init()

________________________________________________________________________________________________________
*** CID 510856: Control flow issues (UNREACHABLE)
/lib/binman.c: 142 in binman_init()
136 int binman_init(void)
137 {
138 int ret;
139
140 return 0;
141 binman = malloc(sizeof(struct binman_info));
>>> CID 510856: Control flow issues (UNREACHABLE)
>>> This code cannot be reached: "if (!binman)
return ((voi...".
142 if (!binman)
143 return log_msg_ret("space for binman", -ENOMEM);
144 ret = find_image_node(&binman->image);
145 if (ret)
146 return log_msg_ret("node", -ENOENT);
147 binman_set_rom_offset(ROM_OFFSET_NONE);

----- End forwarded message -----

--
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]