| Message ID | 20240805140840.1606239-4-hadess@hadess.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix a number of static analysis issues #6 | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| tedd_an/CheckPatch | success | CheckPatch PASS |
| tedd_an/GitLint | fail | WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search 4: B1 Line exceeds max length (172>80): "bluez-5.77/profiles/health/mcap.c:390:2: tainted_data_argument: The check "sent < size" contains the tainted expression "sent" which causes "size" to be considered tainted." 5: B1 Line exceeds max length (154>80): "bluez-5.77/profiles/health/mcap.c:391:3: overflow: The expression "size - sent" is deemed overflowed because at least one of its arguments has overflowed." 6: B1 Line exceeds max length (155>80): "bluez-5.77/profiles/health/mcap.c:391:3: overflow_sink: "size - sent", which might have underflowed, is passed to "write(sock, buf_b + sent, size - sent)"." 8: B3 Line contains hard tab characters (\t): "390| while (sent < size) {" 9: B3 Line contains hard tab characters (\t): "391|-> int n = write(sock, buf_b + sent, size - sent);" 10: B3 Line contains hard tab characters (\t): "392| if (n < 0)" 11: B3 Line contains hard tab characters (\t): "393| return -1;" |
| tedd_an/IncrementalBuild | success | Incremental Build PASS |
diff --git a/profiles/health/mcap.c b/profiles/health/mcap.c index 2e4214a6984f..b3bf403e74d2 100644 --- a/profiles/health/mcap.c +++ b/profiles/health/mcap.c @@ -389,7 +389,7 @@ int mcap_send_data(int sock, const void *buf, uint32_t size) while (sent < size) { int n = write(sock, buf_b + sent, size - sent); - if (n < 0) + if (n < 0 || n > SSIZE_MAX - sent) return -1; sent += n; }
Error: INTEGER_OVERFLOW (CWE-190): [#def13] [important] bluez-5.77/profiles/health/mcap.c:390:2: tainted_data_argument: The check "sent < size" contains the tainted expression "sent" which causes "size" to be considered tainted. bluez-5.77/profiles/health/mcap.c:391:3: overflow: The expression "size - sent" is deemed overflowed because at least one of its arguments has overflowed. bluez-5.77/profiles/health/mcap.c:391:3: overflow_sink: "size - sent", which might have underflowed, is passed to "write(sock, buf_b + sent, size - sent)". 389| 390| while (sent < size) { 391|-> int n = write(sock, buf_b + sent, size - sent); 392| if (n < 0) 393| return -1; --- profiles/health/mcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)