#2930 closed defect (fixed)

Coverity Reports Out of Bounds Read in drvmgr_print.c

Reported by: Joel Sherrill Owned by: Daniel Hellstrom
Priority: normal Milestone: 5.1
Component: score Version: 5
Severity: normal Keywords:
Cc: Blocked By:
Blocking:

Description

https://scan5.coverity.com/reports.htm#v29808/p10069/fileInstanceId=109359850&defectInstanceId=30967449&mergedDefectId=1399730

354 printf(" DRIVER ID: 0x%llx\n", drv->drv_id);

  1. Condition drv->name, taking true branch.

355 printf(" NAME: %s\n", drv->name ? drv->name : "NO_NAME");
356 printf(" BUS TYPE: %d\n", drv->bus_type);
357 printf(" OPERATIONS:\n");

  1. alias: Assigning: ppfunc = &drv->ops->init[0]. ppfunc now points to element 0 of drv->ops->init (which consists of 4 4-byte elements).
  2. Condition i < 6U /* sizeof (struct drvmgr_drv_ops) / sizeof (void (*)(void)) */, taking true branch.
  3. Condition i < 6U /* sizeof (struct drvmgr_drv_ops) / sizeof (void (*)(void)) */, taking true branch.
  4. cond_at_most: Checking i < 6U implies that i may be up to 5 on the true branch.

358 for (i = 0, ppfunc = (fun_ptr *)&drv->ops->init[0];
359 i < DRVMGR_OPS_NUM(struct drvmgr_drv_ops); i++)

  1. Jumping back to the beginning of the loop.


CID 1399730 (#1 of 1): Out-of-bounds read (OVERRUN)

  1. overrun-local: Overrunning array of 4 4-byte elements at element index 5 (byte offset 20) by dereferencing pointer ppfunc + i.

360 printf(" %s %p\n", drv_ops_names[i], ppfunc[i]);
361 printf(" NO. DEVICES: %d\n", drv->dev_cnt);
362

Change History (4)

comment:1 Changed on Mar 15, 2017 at 4:03:24 PM by Joel Sherrill

Owner: changed from joel.sherrill@… to Daniel Hellstrom
Status: newassigned

comment:2 Changed on May 11, 2017 at 7:31:02 AM by Sebastian Huber

Milestone: 4.124.12.0

comment:3 Changed on Aug 29, 2017 at 7:09:36 AM by Daniel Hellstrom <daniel@…>

Resolution: fixed
Status: assignedclosed

In 3663be53/rtems:

drvmgr: clean up info_drv print

Fixes #2930

comment:4 Changed on Nov 9, 2017 at 6:27:14 AM by Sebastian Huber

Milestone: 4.12.05.1

Milestone renamed

Note: See TracTickets for help on using tickets.