[coreboot] New Defects reported by Coverity Scan for coreboot

scan-admin at coverity.com scan-admin at coverity.com
Tue Apr 5 13:42:42 CEST 2016


Hi,

Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.

200 new defect(s) introduced to coreboot found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 200 defect(s)


** CID 1353327:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353327:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/als_opt3001.c: 34 in opt3001_i2c_write()
28      */
29     static int opt3001_i2c_write(const int reg, int data)
30     {
31     	int ret;
32     
33     	data = ((data << 8) & 0xFF00) | ((data >> 8) & 0x00FF);
>>>     CID 1353327:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C2" in call to "i2c_write16".
34     	ret = i2c_write16(I2C_PORT_ALS, OPT3001_I2C_ADDR, reg, data);
35     
36     	return ret;
37     }
38     
39     /**

** CID 1353326:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353326:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/als_opt3001.c: 18 in opt3001_i2c_read()
12      *  Read register from OPT3001 light sensor.
13      */
14     static int opt3001_i2c_read(const int reg, int *data_ptr)
15     {
16     	int ret;
17     
>>>     CID 1353326:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C2" in call to "i2c_read16".
18     	ret = i2c_read16(I2C_PORT_ALS, OPT3001_I2C_ADDR, reg, data_ptr);
19     	if (!ret)
20     		*data_ptr = ((*data_ptr << 8) & 0xFF00) |
21     				((*data_ptr >> 8) & 0x00FF);
22     
23     	return ret;

** CID 1353325:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 65 in bd99992gw_init()


________________________________________________________________________________________________________
*** CID 1353325:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 65 in bd99992gw_init()
59     	int i;
60     	int active_channel_count = 0;
61     	uint8_t pointer_reg = BD99992GW_REG_ADC1ADDR0;
62     
63     	/* Mark active channels from the board temp sensor table */
64     	for (i = 0; i < TEMP_SENSOR_COUNT; ++i)
>>>     CID 1353325:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4).
65     		if (temp_sensors[i].read == bd99992gw_get_val)
66     			active_channels[active_channel_count++] =
67     				temp_sensors[i].idx;
68     
69     	/* Make sure we don't have too many active channels. */
70     	ASSERT(active_channel_count <= ARRAY_SIZE(active_channels));

** CID 1353324:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init()


________________________________________________________________________________________________________
*** CID 1353324:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init()
68     
69     	/* Make sure we don't have too many active channels. */
70     	ASSERT(active_channel_count <= ARRAY_SIZE(active_channels));
71     
72     	/* Mark the first unused channel so we know where to stop searching */
73     	if (active_channel_count != ARRAY_SIZE(active_channels))
>>>     CID 1353324:  Memory - corruptions  (OVERRUN)
>>>     Overrunning array "active_channels" of 8 4-byte elements at element index 9 (byte offset 36) using index "active_channel_count" (which evaluates to 9).
74     		active_channels[active_channel_count] =
75     			BD99992GW_ADC_CHANNEL_NONE;
76     
77     	/* Now write pointer regs with channel to monitor */
78     	for (i = 0; i < active_channel_count; ++i)
79     		/* Write stop bit on last channel */

** CID 1353322:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353322:    (OVERRUN)
/3rdparty/chromeec/driver/charger/isl9237.c: 407 in console_command_amon_bmon()
401      * Get charger AMON and BMON current.
402      */
403     static int console_command_amon_bmon(int argc, char **argv)
404     {
405     	int adc, curr, val, ret;
406     
>>>     CID 1353322:    (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16".
407     	ret = i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER,
408     			 ISL9237_REG_CONTROL1, &val);
409     	if (ret)
410     		return ret;
411     
412     	/* Enable monitor */
/3rdparty/chromeec/driver/charger/isl9237.c: 417 in console_command_amon_bmon()
411     
412     	/* Enable monitor */
413     	val &= ~ISL9237_C1_DISABLE_MON;
414     	if (argc == 1 || (argc >= 2 && argv[1][0] == 'a')) {
415     		/* Switch to AMON */
416     		val &= ~ISL9237_C1_SELECT_BMON;
>>>     CID 1353322:    (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
417     		ret = i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER,
418     				  ISL9237_REG_CONTROL1, val);
419     		if (ret)
420     			return ret;
421     
422     		adc = adc_read_channel(ADC_AMON_BMON);
/3rdparty/chromeec/driver/charger/isl9237.c: 430 in console_command_amon_bmon()
424     		CPRINTF("AMON: %d uV, %d mA\n", adc, curr);
425     	}
426     
427     	if (argc == 1 || (argc >= 2 && argv[1][0] == 'b')) {
428     		/* Switch to BMON */
429     		val |= ISL9237_C1_SELECT_BMON;
>>>     CID 1353322:    (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
430     		ret = i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER,
431     				  ISL9237_REG_CONTROL1, val);
432     		if (ret)
433     			return ret;
434     
435     		adc = adc_read_channel(ADC_AMON_BMON);

** CID 1353321:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353321:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/charger/isl9237.c: 58 in raw_write16()
52     {
53     	return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
54     }
55     
56     static inline int raw_write16(int offset, int value)
57     {
>>>     CID 1353321:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
58     	return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
59     }
60     
61     static int isl9237_set_current(uint16_t current)
62     {
63     	return raw_write16(ISL9237_REG_CHG_CURRENT, CURRENT_TO_REG(current));

** CID 1353320:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353320:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/charger/isl9237.c: 53 in raw_read16()
47     {
48     	return i2c_read8(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
49     }
50     
51     static inline int raw_read16(int offset, int *value)
52     {
>>>     CID 1353320:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16".
53     	return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
54     }
55     
56     static inline int raw_write16(int offset, int value)
57     {
58     	return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);

** CID 1353317:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()


________________________________________________________________________________________________________
*** CID 1353317:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()
147     	struct ec_response_temp_sensor_get_info *r = args->response;
148     	int id = p->id;
149     
150     	if (id >= TEMP_SENSOR_COUNT)
151     		return EC_RES_ERROR;
152     
>>>     CID 1353317:    (OVERRUN)
>>>     Overrunning array "temp_sensors" of 4 20-byte elements at element index 14 (byte offset 280) using index "id" (which evaluates to 14).
153     	strzcpy(r->sensor_name, temp_sensors[id].name, sizeof(r->sensor_name));
154     	r->sensor_type = temp_sensors[id].type;
155     
156     	args->response_size = sizeof(*r);
157     
158     	return EC_RES_SUCCESS;
159     }
160     DECLARE_HOST_COMMAND(EC_CMD_TEMP_SENSOR_GET_INFO,
161     		     temp_sensor_command_get_info,
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()
147     	struct ec_response_temp_sensor_get_info *r = args->response;
148     	int id = p->id;
149     
150     	if (id >= TEMP_SENSOR_COUNT)
151     		return EC_RES_ERROR;
152     
>>>     CID 1353317:    (OVERRUN)
>>>     Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "id" (which evaluates to 4).
153     	strzcpy(r->sensor_name, temp_sensors[id].name, sizeof(r->sensor_name));
154     	r->sensor_type = temp_sensors[id].type;
155     
156     	args->response_size = sizeof(*r);
157     
158     	return EC_RES_SUCCESS;
159     }
160     DECLARE_HOST_COMMAND(EC_CMD_TEMP_SENSOR_GET_INFO,
161     		     temp_sensor_command_get_info,

** CID 1353316:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()


________________________________________________________________________________________________________
*** CID 1353316:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()
108     		if (rv)
109     			rv1 = rv;
110     
111     		switch (rv) {
112     		case EC_SUCCESS:
113     			ccprintf("%d K = %d C", t, K_TO_C(t));
>>>     CID 1353316:    (OVERRUN)
>>>     Overrunning array "thermal_params" of 4 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14).
114     			if (thermal_params[i].temp_fan_off &&
115     			    thermal_params[i].temp_fan_max)
116     				ccprintf("  %d%%",
117     					 thermal_fan_percent(
118     						 thermal_params[i].temp_fan_off,
119     						 thermal_params[i].temp_fan_max,
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()
108     		if (rv)
109     			rv1 = rv;
110     
111     		switch (rv) {
112     		case EC_SUCCESS:
113     			ccprintf("%d K = %d C", t, K_TO_C(t));
>>>     CID 1353316:    (OVERRUN)
>>>     Overrunning array "thermal_params" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4).
114     			if (thermal_params[i].temp_fan_off &&
115     			    thermal_params[i].temp_fan_max)
116     				ccprintf("  %d%%",
117     					 thermal_fan_percent(
118     						 thermal_params[i].temp_fan_off,
119     						 thermal_params[i].temp_fan_max,

** CID 1353315:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()


________________________________________________________________________________________________________
*** CID 1353315:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()
100     static int command_temps(int argc, char **argv)
101     {
102     	int t, i;
103     	int rv, rv1 = EC_SUCCESS;
104     
105     	for (i = 0; i < TEMP_SENSOR_COUNT; ++i) {
>>>     CID 1353315:    (OVERRUN)
>>>     Overrunning array "temp_sensors" of 4 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14).
106     		ccprintf("  %-20s: ", temp_sensors[i].name);
107     		rv = temp_sensor_read(i, &t);
108     		if (rv)
109     			rv1 = rv;
110     
111     		switch (rv) {
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()
100     static int command_temps(int argc, char **argv)
101     {
102     	int t, i;
103     	int rv, rv1 = EC_SUCCESS;
104     
105     	for (i = 0; i < TEMP_SENSOR_COUNT; ++i) {
>>>     CID 1353315:    (OVERRUN)
>>>     Overrunning array "temp_sensors" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4).
106     		ccprintf("  %-20s: ", temp_sensors[i].name);
107     		rv = temp_sensor_read(i, &t);
108     		if (rv)
109     			rv1 = rv;
110     
111     		switch (rv) {

** CID 1353314:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read()
/3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read()


________________________________________________________________________________________________________
*** CID 1353314:    (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read()
20     	const struct temp_sensor_t *sensor;
21     
22     	if (id < 0 || id >= TEMP_SENSOR_COUNT)
23     		return EC_ERROR_INVAL;
24     	sensor = temp_sensors + id;
25     
>>>     CID 1353314:    (OVERRUN)
>>>     Overrunning array of 4 20-byte elements at element index 14 (byte offset 280) by dereferencing pointer "sensor".
26     	return sensor->read(sensor->idx, temp_ptr);
27     }
28     
29     static void update_mapped_memory(void)
30     {
31     	int i, t;
/3rdparty/chromeec/common/temp_sensor.c: 26 in temp_sensor_read()
20     	const struct temp_sensor_t *sensor;
21     
22     	if (id < 0 || id >= TEMP_SENSOR_COUNT)
23     		return EC_ERROR_INVAL;
24     	sensor = temp_sensors + id;
25     
>>>     CID 1353314:    (OVERRUN)
>>>     Overrunning array of 4 20-byte elements at element index 4 (byte offset 80) by dereferencing pointer "sensor".
26     	return sensor->read(sensor->idx, temp_ptr);
27     }
28     
29     static void update_mapped_memory(void)
30     {
31     	int i, t;

** CID 1353310:    (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353310:    (OVERRUN)
/3rdparty/chromeec/board/glados/battery.c: 50 in board_cut_off_battery()
44     	/* Ship mode command must be sent twice to take effect */
45     	buf[0] = SB_MANUFACTURER_ACCESS & 0xff;
46     	buf[1] = PARAM_CUT_OFF_LOW;
47     	buf[2] = PARAM_CUT_OFF_HIGH;
48     
49     	i2c_lock(I2C_PORT_BATTERY, 1);
>>>     CID 1353310:    (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_xfer".
50     	rv = i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0,
51     		      I2C_XFER_SINGLE);
52     	rv |= i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0,
53     		       I2C_XFER_SINGLE);
54     	i2c_lock(I2C_PORT_BATTERY, 0);
55     
/3rdparty/chromeec/board/glados/battery.c: 52 in board_cut_off_battery()
46     	buf[1] = PARAM_CUT_OFF_LOW;
47     	buf[2] = PARAM_CUT_OFF_HIGH;
48     
49     	i2c_lock(I2C_PORT_BATTERY, 1);
50     	rv = i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0,
51     		      I2C_XFER_SINGLE);
>>>     CID 1353310:    (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_xfer".
52     	rv |= i2c_xfer(I2C_PORT_BATTERY, BATTERY_ADDR, buf, 3, NULL, 0,
53     		       I2C_XFER_SINGLE);
54     	i2c_lock(I2C_PORT_BATTERY, 0);
55     
56     	return rv;
57     }

** CID 1353309:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 260 in gpio_command_get()


________________________________________________________________________________________________________
*** CID 1353309:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 260 in gpio_command_get()
254     		args->response_size = sizeof(r_v1->get_count);
255     		break;
256     	case EC_GPIO_GET_INFO:
257     		if (p_v1->get_info.index >= GPIO_COUNT)
258     			return EC_RES_ERROR;
259     
>>>     CID 1353309:  Memory - corruptions  (OVERRUN)
>>>     Assigning: "i" = "(*p_v1).get_info.index". The value of "i" may now be up to 80.
260     		i = p_v1->get_info.index;
261     		len = strlen(g[i].name);
262     		memcpy(r_v1->get_info.name, g[i].name, len+1);
263     		r_v1->get_info.val = gpio_get_level(i);
264     		r_v1->get_info.flags = g[i].flags;
265     		args->response_size = sizeof(r_v1->get_info);

** CID 1353308:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 261 in gpio_command_get()


________________________________________________________________________________________________________
*** CID 1353308:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 261 in gpio_command_get()
255     		break;
256     	case EC_GPIO_GET_INFO:
257     		if (p_v1->get_info.index >= GPIO_COUNT)
258     			return EC_RES_ERROR;
259     
260     		i = p_v1->get_info.index;
>>>     CID 1353308:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g + i".
261     		len = strlen(g[i].name);
262     		memcpy(r_v1->get_info.name, g[i].name, len+1);
263     		r_v1->get_info.val = gpio_get_level(i);
264     		r_v1->get_info.flags = g[i].flags;
265     		args->response_size = sizeof(r_v1->get_info);
266     		break;

** CID 1353307:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 169 in command_gpio_get()


________________________________________________________________________________________________________
*** CID 1353307:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 169 in command_gpio_get()
163     		ccprintf("  %d%c %s\n", v, (changed ? '*' : ' '), g->name);
164     
165     		return EC_SUCCESS;
166     	}
167     
168     	/* Otherwise print them all */
>>>     CID 1353307:  Memory - corruptions  (OVERRUN)
>>>     Checking "i < GPIO_COUNT" implies that "i" may be up to 80 on the true branch.
169     	for (i = 0; i < GPIO_COUNT; i++, g++) {
170     		if (!g->mask)
171     			continue;  /* Skip unsupported signals */
172     
173     		v = gpio_get_level(i);
174     		changed = last_val_changed(i, v);

** CID 1353306:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 170 in command_gpio_get()


________________________________________________________________________________________________________
*** CID 1353306:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 170 in command_gpio_get()
164     
165     		return EC_SUCCESS;
166     	}
167     
168     	/* Otherwise print them all */
169     	for (i = 0; i < GPIO_COUNT; i++, g++) {
>>>     CID 1353306:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g".
170     		if (!g->mask)
171     			continue;  /* Skip unsupported signals */
172     
173     		v = gpio_get_level(i);
174     		changed = last_val_changed(i, v);
175     		ccprintf("  %d%c %s\n", v, (changed ? '*' : ' '), g->name);

** CID 1353305:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 33 in find_signal_by_name()


________________________________________________________________________________________________________
*** CID 1353305:  Memory - illegal accesses  (OVERRUN)
/3rdparty/chromeec/common/gpio.c: 33 in find_signal_by_name()
27     	int i;
28     
29     	if (!name || !*name)
30     		return GPIO_COUNT;
31     
32     	for (i = 0; i < GPIO_COUNT; i++, g++) {
>>>     CID 1353305:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 78 16-byte elements at element index 80 (byte offset 1280) by dereferencing pointer "g".
33     		if (g->mask && !strcasecmp(name, g->name))
34     			return i;
35     	}
36     
37     	return GPIO_COUNT;
38     }

** CID 1353293:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353293:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/battery/smart.c: 32 in sbc_write()
26     {
27     	return i2c_read16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param);
28     }
29     
30     test_mockable int sbc_write(int cmd, int param)
31     {
>>>     CID 1353293:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
32     	return i2c_write16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param);
33     }
34     
35     test_mockable int sb_read(int cmd, int *param)
36     {
37     #ifdef CONFIG_BATTERY_CUT_OFF

** CID 1353292:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353292:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/battery/smart.c: 27 in sbc_read()
21     #define BATTERY_NO_RESPONSE_TIMEOUT	(1000*MSEC)
22     
23     static int fake_state_of_charge = -1;
24     
25     test_mockable int sbc_read(int cmd, int *param)
26     {
>>>     CID 1353292:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16".
27     	return i2c_read16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param);
28     }
29     
30     test_mockable int sbc_write(int cmd, int param)
31     {
32     	return i2c_write16(I2C_PORT_CHARGER, CHARGER_ADDR, cmd, param);

** CID 1353291:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1353291:  Memory - corruptions  (OVERRUN)
/3rdparty/chromeec/driver/battery/smart.c: 69 in sb_write()
63     	if (battery_is_cut_off())
64     		return EC_RES_ACCESS_DENIED;
65     #endif
66     #ifdef CONFIG_SMBUS
67     	return smbus_write_word(I2C_PORT_BATTERY, BATTERY_ADDR, cmd, param);
68     #else
>>>     CID 1353291:  Memory - corruptions  (OVERRUN)
>>>     Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
69     	return i2c_write16(I2C_PORT_BATTERY, BATTERY_ADDR, cmd, param);
70     #endif
71     }
72     
73     int sb_read_string(int port, int slave_addr, int offset, uint8_t *data,
74     	int len)


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/coreboot?tab=overview

To manage Coverity Scan email notifications for "coreboot at coreboot.org", click https://scan.coverity.com/subscriptions/edit?email=coreboot%40coreboot.org&token=49533df725f93b78361afb7b89ccde93




More information about the coreboot mailing list