diff mbox series

[BlueZ,v2,10/11] tools/mesh: Fix integer overflow due to cast operation

Message ID 20240705085935.1255725-11-hadess@hadess.net (mailing list archive)
State New, archived
Headers show
Series Fix a number of static analysis issues #5 | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch warning WARNING:LONG_LINE: line length of 81 exceeds 80 columns #82: FILE: tools/mesh/mesh-db.c:532: + if (!jarray || json_object_get_type(jarray) != json_type_array || /github/workspace/src/src/13724603.patch total: 0 errors, 1 warnings, 25 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. /github/workspace/src/src/13724603.patch has style problems, please review. NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS.
tedd_an/GitLint fail WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search 4: B1 Line exceeds max length (118>80): "bluez-5.76/tools/mesh/mesh-db.c:551:3: cast_overflow: Truncation due to cast operation on "ele_cnt" from 32 to 8 bits." 5: B1 Line exceeds max length (175>80): "bluez-5.76/tools/mesh/mesh-db.c:551:3: overflow_sink: "ele_cnt", which might have overflowed, is passed to "remote_add_node((uint8_t const *)uuid, unicast, ele_cnt, key_idx)"." 6: B3 Line contains hard tab characters (\t): "549| continue;" 8: B3 Line contains hard tab characters (\t): "551|-> remote_add_node((const uint8_t *)uuid, unicast, ele_cnt," 9: B3 Line contains hard tab characters (\t): "552| key_idx);" 10: B3 Line contains hard tab characters (\t): "553| for (j = 1; j < key_cnt; j++) {"
tedd_an/IncrementalBuild success Incremental Build PASS

Commit Message

Bastien Nocera July 5, 2024, 8:57 a.m. UTC 
Error: INTEGER_OVERFLOW (CWE-190): [#def29] [important]
bluez-5.76/tools/mesh/mesh-db.c:551:3: cast_overflow: Truncation due to cast operation on "ele_cnt" from 32 to 8 bits.
bluez-5.76/tools/mesh/mesh-db.c:551:3: overflow_sink: "ele_cnt", which might have overflowed, is passed to "remote_add_node((uint8_t const *)uuid, unicast, ele_cnt, key_idx)".
549|			continue;
550|
551|->		remote_add_node((const uint8_t *)uuid, unicast, ele_cnt,
552|								key_idx);
553|		for (j = 1; j < key_cnt; j++) {
---
 tools/mesh/mesh-db.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/tools/mesh/mesh-db.c b/tools/mesh/mesh-db.c
index 1d047691d240..4c74e874986c 100644
--- a/tools/mesh/mesh-db.c
+++ b/tools/mesh/mesh-db.c
@@ -503,7 +503,8 @@  static void load_remotes(json_object *jcfg)
 		uint8_t uuid[16];
 		uint16_t unicast, key_idx;
 		const char *str;
-		int ele_cnt, key_cnt;
+		uint8_t ele_cnt;
+		int key_cnt;
 		int j;
 
 		jnode = json_object_array_get_idx(jnodes, i);
@@ -528,14 +529,12 @@  static void load_remotes(json_object *jcfg)
 			continue;
 
 		json_object_object_get_ex(jnode, "elements", &jarray);
-		if (!jarray || json_object_get_type(jarray) != json_type_array)
+		if (!jarray || json_object_get_type(jarray) != json_type_array ||
+		    json_object_array_length(jarray) > MAX_ELE_COUNT)
 			continue;
 
 		ele_cnt = json_object_array_length(jarray);
 
-		if (ele_cnt > MAX_ELE_COUNT)
-			continue;
-
 		json_object_object_get_ex(jnode, "netKeys", &jarray);
 		if (!jarray || json_object_get_type(jarray) != json_type_array)
 			continue;