New Defects reported by Coverity Scan for RTEMS-Newlib
Corinna Vinschen
vinschen@redhat.com
Tue Feb 11 10:40:53 GMT 2025
Alexey?
On Feb 10 16:56, Joel Sherrill wrote:
> Coverity Scan has spotted a handful of issues with the recent string
> changes.
>
> --joel
>
> ---------- Forwarded message ---------
> From: <scan-admin@coverity.com>
> Date: Mon, Feb 10, 2025 at 4:27 PM
> Subject: New Defects reported by Coverity Scan for RTEMS-Newlib
> To: <joel.sherrill@gmail.com>
>
>
> Hi,
>
> Please find the latest report on new defect(s) introduced to RTEMS-Newlib
> found with Coverity Scan.
>
> 6 new defect(s) introduced to RTEMS-Newlib found with Coverity Scan.
>
>
> New defect(s) Reported-by: Coverity Scan
> Showing 6 of 6 defect(s)
>
>
> ** CID 474676: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/mempcpy.c:
> 68 in mempcpy()
>
>
> ________________________________________________________________________________________________________
> *** CID 474676: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/mempcpy.c:
> 68 in mempcpy()
> 62 while (!TOO_SMALL_BIG_BLOCK(len0))
> 63 {
> 64 *aligned_dst++ = *aligned_src++;
> 65 *aligned_dst++ = *aligned_src++;
> 66 *aligned_dst++ = *aligned_src++;
> 67 *aligned_dst++ = *aligned_src++;
> >>> CID 474676: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 68 len0 -= BIG_BLOCK_SIZE;
> 69 }
> 70
> 71 /* Copy one long word at a time if possible. */
> 72 while (!TOO_SMALL_LITTLE_BLOCK(len0))
> 73 {
>
> ** CID 474675: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/stpncpy.c:
> 64 in stpncpy()
>
>
> ________________________________________________________________________________________________________
> *** CID 474675: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/stpncpy.c:
> 64 in stpncpy()
> 58 aligned_src = (long*)src;
> 59
> 60 /* SRC and DEST are both LITTLE_BLOCK_SIZE aligned,
> 61 try to do LITTLE_BLOCK_SIZE sized copies. */
> 62 while (!TOO_SMALL_LITTLE_BLOCK (count) &&
> !DETECT_NULL(*aligned_src))
> 63 {
> >>> CID 474675: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "count", underflows the type of "count", which is type
> "size_t".
> 64 count -= LITTLE_BLOCK_SIZE;
> 65 *aligned_dst++ = *aligned_src++;
> 66 }
> 67
> 68 dst = (char*)aligned_dst;
> 69 src = (char*)aligned_src;
>
> ** CID 474674: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memccpy.c:
> 96 in memccpy()
>
>
> ________________________________________________________________________________________________________
> *** CID 474674: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memccpy.c:
> 96 in memccpy()
> 90 {
> 91 unsigned long buffer = (unsigned long)(*aligned_src);
> 92 buffer ^= mask;
> 93 if (DETECT_NULL(buffer))
> 94 break; /* endchar is found, go byte by byte from here */
> 95 *aligned_dst++ = *aligned_src++;
> >>> CID 474674: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 96 len0 -= LITTLE_BLOCK_SIZE;
> 97 }
> 98
> 99 /* Pick up any residual with a byte copier. */
> 100 dst = (unsigned char*)aligned_dst;
> 101 src = (unsigned char*)aligned_src;
>
> ** CID 474673: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memmove.c:
> 88 in memmove()
>
>
> ________________________________________________________________________________________________________
> *** CID 474673: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memmove.c:
> 88 in memmove()
> 82 aligned_src = (long*)src;
> 83
> 84 /* Copy one long word at a time if possible. */
> 85 while (!TOO_SMALL_LITTLE_BLOCK(length))
> 86 {
> 87 *--aligned_dst = *--aligned_src;
> >>> CID 474673: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "length", underflows the type of "length", which is type
> "size_t".
> 88 length -= LITTLE_BLOCK_SIZE;
> 89 }
> 90
> 91 /* Pick up any residual with a byte copier. */
> 92 dst = (char*)aligned_dst;
> 93 src = (char*)aligned_src;
>
> ** CID 474672: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memcpy.c:
> 72 in memcpy()
>
>
> ________________________________________________________________________________________________________
> *** CID 474672: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memcpy.c:
> 72 in memcpy()
> 66 while (!TOO_SMALL_BIG_BLOCK(len0))
> 67 {
> 68 *aligned_dst++ = *aligned_src++;
> 69 *aligned_dst++ = *aligned_src++;
> 70 *aligned_dst++ = *aligned_src++;
> 71 *aligned_dst++ = *aligned_src++;
> >>> CID 474672: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 72 len0 -= BIG_BLOCK_SIZE;
> 73 }
> 74
> 75 /* Copy one long word at a time if possible. */
> 76 while (!TOO_SMALL_LITTLE_BLOCK(len0))
> 77 {
>
> ** CID 470638: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/strncpy.c:
> 78 in strncpy()
>
>
> ________________________________________________________________________________________________________
> *** CID 470638: Integer handling issues (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/strncpy.c:
> 78 in strncpy()
> 72 aligned_src = (long*)src;
> 73
> 74 /* SRC and DEST are both "long int" aligned, try to do "long
> int"
> 75 sized copies. */
> 76 while (!TOO_SMALL_LITTLE_BLOCK(count) &&
> !DETECT_NULL(*aligned_src))
> 77 {
> >>> CID 470638: Integer handling issues (INTEGER_OVERFLOW)
> >>> Expression "count", underflows the type of "count", which is type
> "size_t".
> 78 count -= sizeof (long int);
> 79 *aligned_dst++ = *aligned_src++;
> 80 }
> 81
> 82 dst = (char*)aligned_dst;
> 83 src = (char*)aligned_src;
>
>
> ________________________________________________________________________________________________________
> To view the defects in Coverity Scan visit,
> https://scan.coverity.com/projects/rtems-newlib?tab=overview
>
> To manage Coverity Scan email notifications for "joel.sherrill@gmail.com",
> click
> https://scan.coverity.com/subscriptions/edit?email=joel.sherrill%40gmail.com&token=1d6de09a8cf588074bed902a634fe5bc
More information about the Newlib
mailing list