New Defects from Coverity

[Joel Sherrill]

Just passing these along so someone more familiar with these twosource
files can look at the reports.

--joel

---------- Forwarded message ---------
From: <scan-admin@coverity.com>
Date: Fri, Oct 3, 2025 at 3:55 PM
Subject: New Defects reported by Coverity Scan for RTEMS-Newlib
To: <joel.sherrill@gmail.com>


Hi,

Please find the latest report on new defect(s) introduced to *RTEMS-Newlib*
found with Coverity Scan.

   - *New Defects Found:* 3
   - 14 defect(s), reported by Coverity Scan earlier, were marked fixed in
   the recent build analyzed by Coverity Scan.
   - *Defects Shown:* Showing 3 of 3 defect(s)

Defect Details

** CID 896146:       Insecure data handling  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/time/strftime.c:
1469           in __strftime()


_____________________________________________________________________________________________
*** CID 896146:         Insecure data handling  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/time/strftime.c:
1469             in __strftime()
1463           else
1464     	break;
1465         }
1466       if (maxsize)
1467         s[count] = CQ('\0');
1468
>>>     CID 896146:         Insecure data handling  (INTEGER_OVERFLOW)
>>>     "count", which might have underflowed, is returned from the function.
1469       return count;
1470     }
1471
1472     size_t
1473     strftime (CHAR *__restrict s,
1474     	size_t maxsize,

** CID 896145:       Integer handling issues  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/stdio/vfscanf.c:
1343           in __ssvfscanf_r()


_____________________________________________________________________________________________
*** CID 896145:         Integer handling issues  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/stdio/vfscanf.c:
1343             in __ssvfscanf_r()
1337     	  if (width == 0 || width > sizeof (buf) - 1)
1338     #else
1339     	  /* size_t is unsigned, hence this optimisation */
1340     	  if (width - 1 > sizeof (buf) - 2)
1341     #endif
1342     	    {
>>>     CID 896145:         Integer handling issues  (INTEGER_OVERFLOW)
>>>     Expression "width - 349U", where "width" is known to be equal to 0, underflows the type of "width - 349U", which is type "unsigned int".
1343     	      width_left = width - (sizeof (buf) - 1);
1344     	      width = sizeof (buf) - 1;
1345     	    }
1346     	  flags |= SIGNOK | NDIGITS | NZDIGITS | NNZDIGITS;
1347     	  for (p = buf; width; width--)
1348     	    {

** CID 896144:       Integer handling issues  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/stdio/vfscanf.c:
1343           in __ssvfiscanf_r()


_____________________________________________________________________________________________
*** CID 896144:         Integer handling issues  (INTEGER_OVERFLOW)
/home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/stdio/vfscanf.c:
1343             in __ssvfiscanf_r()
1337     	  if (width == 0 || width > sizeof (buf) - 1)
1338     #else
1339     	  /* size_t is unsigned, hence this optimisation */
1340     	  if (width - 1 > sizeof (buf) - 2)
1341     #endif
1342     	    {
>>>     CID 896144:         Integer handling issues  (INTEGER_OVERFLOW)
>>>     Expression "width - 39U", where "width" is known to be equal to 0, underflows the type of "width - 39U", which is type "unsigned int".
1343     	      width_left = width - (sizeof (buf) - 1);
1344     	      width = sizeof (buf) - 1;
1345     	    }
1346     	  flags |= SIGNOK | NDIGITS | NZDIGITS | NNZDIGITS;
1347     	  for (p = buf; width; width--)
1348     	    {



View Defects in Coverity Scan
<https://scan.coverity.com/projects/rtems-newlib?tab=overview>

Best regards,

The Coverity Scan Admin Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/newlib/attachments/20251003/65bfeb1e/attachment.htm>