| Message ID | 20250202-outofboundsread1573409-v1-1-5e3dd97a24a6@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | iio: light: Add check for array bounds in veml6075_read_int_time_ms | expand |
On Sun Feb 2, 2025 at 11:49 AM CET, Karan Sanghavi wrote: > The array contains only 5 elements, but the index calculated by > veml6075_read_int_time_index can range from 0 to 7, > which could lead to out-of-bounds access. The check prevents this issue. > > Coverity Issue > CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) > overrun-local: Overrunning array veml6075_it_ms of 5 4-byte > elements at element index 7 (byte offset 31) using > index int_index (which evaluates to 7) > > Fixes: 3b82f43238ae ("iio: light: add VEML6075 UVA and UVB light sensor driver") > Signed-off-by: Karan Sanghavi <karansanghvi98@gmail.com> > --- > drivers/iio/light/veml6075.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/light/veml6075.c b/drivers/iio/light/veml6075.c > index 05d4c0e9015d..a892330582f4 100644 > --- a/drivers/iio/light/veml6075.c > +++ b/drivers/iio/light/veml6075.c > @@ -210,7 +210,7 @@ static int veml6075_read_int_time_ms(struct veml6075_data *data, int *val) > > guard(mutex)(&data->lock); > int_index = veml6075_read_int_time_index(data); > - if (int_index < 0) > + if (int_index < 0 || int_index >= ARRAY_SIZE(veml6075_it_ms)) > return int_index; > > *val = veml6075_it_ms[int_index]; > > --- > base-commit: df4b2bbff898227db0c14264ac7edd634e79f755 > change-id: 20250202-outofboundsread1573409-378997439be1 > > Best regards, Hi Karan, Thanks for your patch. That could never happen because the device does not support those values: it only delivers values between 0 and 4 for that field because it does not support more integration times. Even though the check does not do anything in reality, it does not hurt either, and I would like to avoid future noise from coverity. Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
On Sun Feb 2, 2025 at 6:09 PM CET, Javier Carrasco wrote: > On Sun Feb 2, 2025 at 11:49 AM CET, Karan Sanghavi wrote: > > The array contains only 5 elements, but the index calculated by > > veml6075_read_int_time_index can range from 0 to 7, > > which could lead to out-of-bounds access. The check prevents this issue. > > > > Coverity Issue > > CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) > > overrun-local: Overrunning array veml6075_it_ms of 5 4-byte > > elements at element index 7 (byte offset 31) using > > index int_index (which evaluates to 7) > > > > Fixes: 3b82f43238ae ("iio: light: add VEML6075 UVA and UVB light sensor driver") > > Signed-off-by: Karan Sanghavi <karansanghvi98@gmail.com> > > --- > > drivers/iio/light/veml6075.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/iio/light/veml6075.c b/drivers/iio/light/veml6075.c > > index 05d4c0e9015d..a892330582f4 100644 > > --- a/drivers/iio/light/veml6075.c > > +++ b/drivers/iio/light/veml6075.c > > @@ -210,7 +210,7 @@ static int veml6075_read_int_time_ms(struct veml6075_data *data, int *val) > > > > guard(mutex)(&data->lock); > > int_index = veml6075_read_int_time_index(data); > > - if (int_index < 0) > > + if (int_index < 0 || int_index >= ARRAY_SIZE(veml6075_it_ms)) > > return int_index; > > > > *val = veml6075_it_ms[int_index]; > > > > --- > > base-commit: df4b2bbff898227db0c14264ac7edd634e79f755 > > change-id: 20250202-outofboundsread1573409-378997439be1 > > > > Best regards, > > > Hi Karan, > > Thanks for your patch. That could never happen because the device does > not support those values: it only delivers values between 0 and 4 for > that field because it does not support more integration times. > > Even though the check does not do anything in reality, it does not hurt > either, and I would like to avoid future noise from coverity. > > Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Second thought: you are not returning an error code, only a value between 5 and 7. 5 and 6 are even valid return codes. Please complete your patch to return a sensible error code. Best regards, Javier Carrasco
diff --git a/drivers/iio/light/veml6075.c b/drivers/iio/light/veml6075.c index 05d4c0e9015d..a892330582f4 100644 --- a/drivers/iio/light/veml6075.c +++ b/drivers/iio/light/veml6075.c @@ -210,7 +210,7 @@ static int veml6075_read_int_time_ms(struct veml6075_data *data, int *val) guard(mutex)(&data->lock); int_index = veml6075_read_int_time_index(data); - if (int_index < 0) + if (int_index < 0 || int_index >= ARRAY_SIZE(veml6075_it_ms)) return int_index; *val = veml6075_it_ms[int_index];
The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7, which could lead to out-of-bounds access. The check prevents this issue. Coverity Issue CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN) overrun-local: Overrunning array veml6075_it_ms of 5 4-byte elements at element index 7 (byte offset 31) using index int_index (which evaluates to 7) Fixes: 3b82f43238ae ("iio: light: add VEML6075 UVA and UVB light sensor driver") Signed-off-by: Karan Sanghavi <karansanghvi98@gmail.com> --- drivers/iio/light/veml6075.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- base-commit: df4b2bbff898227db0c14264ac7edd634e79f755 change-id: 20250202-outofboundsread1573409-378997439be1 Best regards,