| Message ID | 20240510121355.3241456-3-hadess@hadess.net (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1e22fd9adbb3283f1a081b94248e97b662256d54 |
| Headers | show |
| Series | Fix a number of static analysis issues | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| tedd_an/CheckPatch | success | CheckPatch PASS |
| tedd_an/GitLint | fail | WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search 4: B1 Line exceeds max length (94>80): "bluez-5.75/attrib/gatt.c:1016:2: known_value_assign: "last" = "65535", its value is now 65535." 5: B1 Line exceeds max length (216>80): "bluez-5.75/attrib/gatt.c:1087:2: overflow_const: Expression "dd->start", which is equal to 65536, where "last + 1" is known to be equal to 65536, overflows the type that receives it, an unsigned integer 16 bits wide." 6: B3 Line contains hard tab characters (\t): "1085| }" 8: B3 Line contains hard tab characters (\t): "1087|-> dd->start = last + 1;" 10: B3 Line contains hard tab characters (\t): "1089| if (last < dd->end && !uuid_found) {" |
| tedd_an/IncrementalBuild | success | Incremental Build PASS |
diff --git a/attrib/gatt.c b/attrib/gatt.c index b496dd1ebd95..3cedae9d167a 100644 --- a/attrib/gatt.c +++ b/attrib/gatt.c @@ -1076,10 +1076,12 @@ static void desc_discovered_cb(guint8 status, const guint8 *ipdu, att_data_list_free(list); /* - * If last handle is lower from previous start handle then it is smth - * wrong. Let's stop search, otherwise we might enter infinite loop. + * If last handle is lower from previous start handle or if iterating + * to the next handle from the last possible offset would overflow, then + * something is wrong. Let's stop search, otherwise we might enter + * infinite loop. */ - if (last < dd->start) { + if (last < dd->start || last == G_MAXUINT16) { err = ATT_ECODE_UNLIKELY; goto done; }
Error: INTEGER_OVERFLOW (CWE-190): [#def30] bluez-5.75/attrib/gatt.c:1016:2: known_value_assign: "last" = "65535", its value is now 65535. bluez-5.75/attrib/gatt.c:1087:2: overflow_const: Expression "dd->start", which is equal to 65536, where "last + 1" is known to be equal to 65536, overflows the type that receives it, an unsigned integer 16 bits wide. 1085| } 1086| 1087|-> dd->start = last + 1; 1088| 1089| if (last < dd->end && !uuid_found) { --- attrib/gatt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)