[coreboot] New Defects reported by Coverity Scan for coreboot
scan-admin at coverity.com
scan-admin at coverity.com
Tue Aug 2 13:33:20 CEST 2016
Hi,
Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.
56 new defect(s) introduced to coreboot found with Coverity Scan.
52 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 20 of 56 defect(s)
** CID 1361056: Memory - illegal accesses (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_LAMAR/agesa/amdlib.c: 1411 in IdsErrorStop()
________________________________________________________________________________________________________
*** CID 1361056: Memory - illegal accesses (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_LAMAR/agesa/amdlib.c: 1411 in IdsErrorStop()
1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode};
1406 UINT16 offset = 0;
1407 UINT16 j;
1408
1409 while(1) {
1410 offset %= sizeof(struct POST) / 2;
>>> CID 1361056: Memory - illegal accesses (OVERRUN)
>>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)".
1411 WriteIo32(80, *((UINT32*)(&post+offset)));
1412 ++offset;
1413 for (j=0; j<250; ++j) {
1414 ReadIo8(80);
1415 }
1416 }
** CID 1361055: (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_OLIVEHILLPLUS/agesa/amdlib.c: 1411 in IdsErrorStop()
/dev/cb-build/coreboot-coverity.0/ODE_E21XX/agesa/amdlib.c: 1411 in IdsErrorStop()
/dev/cb-build/coreboot-coverity.0/AMD_DB_FT3B_LC/agesa/amdlib.c: 1411 in IdsErrorStop()
________________________________________________________________________________________________________
*** CID 1361055: (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_OLIVEHILLPLUS/agesa/amdlib.c: 1411 in IdsErrorStop()
1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode};
1406 UINT16 offset = 0;
1407 UINT16 j;
1408
1409 while(1) {
1410 offset %= sizeof(struct POST) / 2;
>>> CID 1361055: (OVERRUN)
>>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)".
1411 WriteIo32(80, *((UINT32*)(&post+offset)));
1412 ++offset;
1413 for (j=0; j<250; ++j) {
1414 ReadIo8(80);
1415 }
1416 }
/dev/cb-build/coreboot-coverity.0/ODE_E21XX/agesa/amdlib.c: 1411 in IdsErrorStop()
1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode};
1406 UINT16 offset = 0;
1407 UINT16 j;
1408
1409 while(1) {
1410 offset %= sizeof(struct POST) / 2;
>>> CID 1361055: (OVERRUN)
>>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)".
1411 WriteIo32(80, *((UINT32*)(&post+offset)));
1412 ++offset;
1413 for (j=0; j<250; ++j) {
1414 ReadIo8(80);
1415 }
1416 }
/dev/cb-build/coreboot-coverity.0/AMD_DB_FT3B_LC/agesa/amdlib.c: 1411 in IdsErrorStop()
1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode};
1406 UINT16 offset = 0;
1407 UINT16 j;
1408
1409 while(1) {
1410 offset %= sizeof(struct POST) / 2;
>>> CID 1361055: (OVERRUN)
>>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)".
1411 WriteIo32(80, *((UINT32*)(&post+offset)));
1412 ++offset;
1413 for (j=0; j<250; ++j) {
1414 ReadIo8(80);
1415 }
1416 }
** CID 1361054: Memory - illegal accesses (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_BETTONG/agesa/amdlib.c: 1411 in IdsErrorStop()
________________________________________________________________________________________________________
*** CID 1361054: Memory - illegal accesses (OVERRUN)
/dev/cb-build/coreboot-coverity.0/AMD_BETTONG/agesa/amdlib.c: 1411 in IdsErrorStop()
1405 } post = {0xDEAD, FileCode, 0xDEAD, FileCode};
1406 UINT16 offset = 0;
1407 UINT16 j;
1408
1409 while(1) {
1410 offset %= sizeof(struct POST) / 2;
>>> CID 1361054: Memory - illegal accesses (OVERRUN)
>>> Overrunning array of 3 4-byte elements at element index 15 (byte offset 60) by dereferencing pointer "(UINT32 *)(&post + offset)".
1411 WriteIo32(80, *((UINT32*)(&post+offset)));
1412 ++offset;
1413 for (j=0; j<250; ++j) {
1414 ReadIo8(80);
1415 }
1416 }
** CID 1353785: (OVERRUN)
/3rdparty/chromeec/common/fan.c: 380 in hc_pwm_set_fan_duty()
/3rdparty/chromeec/common/fan.c: 373 in hc_pwm_set_fan_duty()
________________________________________________________________________________________________________
*** CID 1353785: (OVERRUN)
/3rdparty/chromeec/common/fan.c: 380 in hc_pwm_set_fan_duty()
374 set_duty_cycle(fan, p_v0->percent);
375
376 return EC_RES_SUCCESS;
377 }
378
379 fan = p_v1->fan_idx;
>>> CID 1353785: (OVERRUN)
>>> Checking "fan >= 2" implies that "fan" and "p_v1->fan_idx" may be up to 1 on the false branch.
380 if (fan >= CONFIG_FANS)
381 return EC_RES_ERROR;
382
383 set_duty_cycle(fan, p_v1->percent);
384
385 return EC_RES_SUCCESS;
/3rdparty/chromeec/common/fan.c: 373 in hc_pwm_set_fan_duty()
367 {
368 const struct ec_params_pwm_set_fan_duty_v1 *p_v1 = args->params;
369 const struct ec_params_pwm_set_fan_duty_v0 *p_v0 = args->params;
370 int fan;
371
372 if (args->version == 0) {
>>> CID 1353785: (OVERRUN)
>>> Checking "fan < 2" implies that "fan" may be up to 1 on the true branch.
373 for (fan = 0; fan < CONFIG_FANS; fan++)
374 set_duty_cycle(fan, p_v0->percent);
375
376 return EC_RES_SUCCESS;
377 }
378
** CID 1353782: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/common/fan.c: 307 in dptf_set_fan_duty_target()
________________________________________________________________________________________________________
*** CID 1353782: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/common/fan.c: 307 in dptf_set_fan_duty_target()
301 if (pct < 0 || pct > 100) {
302 /* TODO(crosbug.com/p/23803) */
303 for (fan = 0; fan < CONFIG_FANS; fan++)
304 set_thermal_control_enabled(fan, 1);
305 } else {
306 /* TODO(crosbug.com/p/23803) */
>>> CID 1353782: Memory - corruptions (OVERRUN)
>>> Checking "fan < 2" implies that "fan" may be up to 1 on the true branch.
307 for (fan = 0; fan < CONFIG_FANS; fan++)
308 set_duty_cycle(fan, pct);
309 }
310 }
311
312 /*****************************************************************************/
** CID 1353361: Code maintainability issues (UNUSED_VALUE)
/3rdparty/chromeec/driver/accelgyro_bmi160.c: 382 in set_data_rate()
________________________________________________________________________________________________________
*** CID 1353361: Code maintainability issues (UNUSED_VALUE)
/3rdparty/chromeec/driver/accelgyro_bmi160.c: 382 in set_data_rate()
376 if (s->type == MOTIONSENSE_TYPE_MAG)
377 moc->batch_size = 0;
378 #endif
379 return ret;
380 } else if (data->odr == 0) {
381 /* back from suspend mode. */
>>> CID 1353361: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "raw_write8(s->addr, 126, 0x10U | (s->type << 2) | 1U)" to "ret" here, but that stored value is overwritten before it can be used.
382 ret = raw_write8(s->addr, BMI160_CMD_REG,
383 BMI160_CMD_MODE_NORMAL(s->type));
384 msleep(wakeup_time[s->type]);
385 }
386 ctrl_reg = BMI160_CONF_REG(s->type);
387 reg_val = BMI160_ODR_TO_REG(rate);
** CID 1353360: Code maintainability issues (UNUSED_VALUE)
/3rdparty/chromeec/driver/pmu_tps65090.c: 680 in command_pmu()
________________________________________________________________________________________________________
*** CID 1353360: Code maintainability issues (UNUSED_VALUE)
/3rdparty/chromeec/driver/pmu_tps65090.c: 680 in command_pmu()
674 ccputs("Invalid repeat count\n");
675 return EC_ERROR_INVAL;
676 }
677 }
678
679 for (loop = 0; loop < repeat; loop++) {
>>> CID 1353360: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "print_pmu_info()" to "rv" here, but that stored value is overwritten before it can be used.
680 rv = print_pmu_info();
681 usleep(1000);
682 }
683
684 rv = pmu_read(IRQ1_REG, &value);
685 if (rv)
** CID 1353357: Control flow issues (UNREACHABLE)
/3rdparty/chromeec/common/charge_manager.c: 625 in charge_manager_make_change()
________________________________________________________________________________________________________
*** CID 1353357: Control flow issues (UNREACHABLE)
/3rdparty/chromeec/common/charge_manager.c: 625 in charge_manager_make_change()
619 */
620 #ifndef CONFIG_CHARGE_MANAGER_DRP_CHARGING
621 if (dualrole_capability[port] != CAP_DEDICATED)
622 #endif
623 return;
624 /* Clear override only if a charge is present on the port */
>>> CID 1353357: Control flow issues (UNREACHABLE)
>>> This code cannot be reached: "i = 0;".
625 for (i = 0; i < CHARGE_SUPPLIER_COUNT; ++i)
626 if (available_charge[i][port].current > 0) {
627 clear_override = 1;
628 break;
629 }
630 /*
** CID 1353355: (UNINIT)
/3rdparty/chromeec/board/oak/board.c: 470 in vbus_task()
/3rdparty/chromeec/board/oak/board.c: 464 in vbus_task()
/3rdparty/chromeec/board/oak/board.c: 458 in vbus_task()
/3rdparty/chromeec/board/oak/board.c: 446 in vbus_task()
________________________________________________________________________________________________________
*** CID 1353355: (UNINIT)
/3rdparty/chromeec/board/oak/board.c: 470 in vbus_task()
464 if (reg != bc12[port].device_type) {
465 bc12[port].device_type = reg;
466 wake++;
467 }
468
469 reg = pi3usb9281_get_charger_status(port);
>>> CID 1353355: (UNINIT)
>>> Using uninitialized value "bc12[port].charger_status".
470 if (reg != bc12[port].charger_status) {
471 bc12[port].charger_status = reg;
472 wake++;
473 }
474
475 if (wake)
/3rdparty/chromeec/board/oak/board.c: 464 in vbus_task()
458 if (reg != bc12[port].interrupt) {
459 bc12[port].interrupt = reg;
460 wake++;
461 }
462
463 reg = pi3usb9281_get_device_type(port);
>>> CID 1353355: (UNINIT)
>>> Using uninitialized value "bc12[port].device_type".
464 if (reg != bc12[port].device_type) {
465 bc12[port].device_type = reg;
466 wake++;
467 }
468
469 reg = pi3usb9281_get_charger_status(port);
/3rdparty/chromeec/board/oak/board.c: 458 in vbus_task()
452 bc12[port].vbus |= 1 << port;
453 else
454 bc12[port].vbus &= ~(1 << port);
455
456 wake = 0;
457 reg = pi3usb9281_get_interrupts(port);
>>> CID 1353355: (UNINIT)
>>> Using uninitialized value "bc12[port].interrupt".
458 if (reg != bc12[port].interrupt) {
459 bc12[port].interrupt = reg;
460 wake++;
461 }
462
463 reg = pi3usb9281_get_device_type(port);
/3rdparty/chromeec/board/oak/board.c: 446 in vbus_task()
440 vbus = !gpio_get_level(port ? GPIO_USB_C1_VBUS_WAKE_L :
441 GPIO_USB_C0_VBUS_WAKE_L);
442 #else
443 vbus = tcpm_get_vbus_level(port);
444 #endif
445 /* check if VBUS changed */
>>> CID 1353355: (UNINIT)
>>> Using uninitialized value "bc12[port].vbus".
446 if (((bc12[port].vbus >> port) & 1) == vbus)
447 continue;
448 /* wait 1.2 seconds and check BC 1.2 status */
449 msleep(1200);
450
451 if (vbus)
** CID 1353346: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init()
________________________________________________________________________________________________________
*** CID 1353346: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/chip/lm4/pwm.c: 63 in pwm_init()
57
58 static void pwm_init(void)
59 {
60 int i;
61
62 for (i = 0; i < PWM_CH_COUNT; ++i)
>>> CID 1353346: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "pwm_channels" of 1 8-byte elements at element index 1 (byte offset 8) using index "i" (which evaluates to 1).
63 fan_channel_setup(pwm_channels[i].channel,
64 (pwm_channels[i].flags &
65 PWM_CONFIG_HAS_RPM_MODE)
66 ? FAN_USE_RPM_MODE : 0);
67 }
68
69 /* The chip-specific fan module initializes before this. */
** CID 1353342: (OVERRUN)
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
/3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty()
________________________________________________________________________________________________________
*** CID 1353342: (OVERRUN)
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
35 for (ch = 0; ch < PWM_CH_COUNT; ch++)
36 print_channel(ch);
37 return EC_SUCCESS;
38 }
39
40 ch = strtoi(argv[1], &e, 0);
>>> CID 1353342: (OVERRUN)
>>> Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 2 (inclusive) on the false branch.
41 if (*e || ch < 0 || ch >= PWM_CH_COUNT)
42 return EC_ERROR_PARAM1;
43
44 if (argc > 2) {
45 percent = strtoi(argv[2], &e, 0);
46 if (*e || percent > 100) {
/3rdparty/chromeec/common/pwm.c: 41 in cc_pwm_duty()
35 for (ch = 0; ch < PWM_CH_COUNT; ch++)
36 print_channel(ch);
37 return EC_SUCCESS;
38 }
39
40 ch = strtoi(argv[1], &e, 0);
>>> CID 1353342: (OVERRUN)
>>> Checking "ch >= PWM_CH_COUNT" implies that "ch" is between 0 and 2 (inclusive) on the false branch.
41 if (*e || ch < 0 || ch >= PWM_CH_COUNT)
42 return EC_ERROR_PARAM1;
43
44 if (argc > 2) {
45 percent = strtoi(argv[2], &e, 0);
46 if (*e || percent > 100) {
/3rdparty/chromeec/common/pwm.c: 35 in cc_pwm_duty()
29 int percent = 0;
30 int ch;
31 char *e;
32
33 if (argc < 2) {
34 ccprintf("PWM channels:\n");
>>> CID 1353342: (OVERRUN)
>>> Checking "ch < PWM_CH_COUNT" implies that "ch" may be up to 2 on the true branch.
35 for (ch = 0; ch < PWM_CH_COUNT; ch++)
36 print_channel(ch);
37 return EC_SUCCESS;
38 }
39
40 ch = strtoi(argv[1], &e, 0);
** CID 1353340: (OVERRUN)
________________________________________________________________________________________________________
*** CID 1353340: (OVERRUN)
/3rdparty/chromeec/common/adc.c: 49 in command_adc()
43 if (v == ADC_READ_ERROR)
44 return EC_ERROR_UNKNOWN;
45 ccprintf(" %s = %d\n", adc_channels[i].name, v);
46 return EC_SUCCESS;
47 } else {
48 /* Otherwise print them all */
>>> CID 1353340: (OVERRUN)
>>> Overrunning array "data" of 8 bytes by passing it to a function which accesses it at byte offset 12.
49 if (adc_read_all_channels(data))
50 return EC_ERROR_UNKNOWN;
51 for (i = 0; i < ADC_CH_COUNT; ++i)
52 ccprintf(" %s = %d\n", adc_channels[i].name, data[i]);
53 return EC_SUCCESS;
54 }
/3rdparty/chromeec/common/adc.c: 49 in command_adc()
43 if (v == ADC_READ_ERROR)
44 return EC_ERROR_UNKNOWN;
45 ccprintf(" %s = %d\n", adc_channels[i].name, v);
46 return EC_SUCCESS;
47 } else {
48 /* Otherwise print them all */
>>> CID 1353340: (OVERRUN)
>>> Overrunning array "data" of 12 bytes by passing it to a function which accesses it at byte offset 12.
49 if (adc_read_all_channels(data))
50 return EC_ERROR_UNKNOWN;
51 for (i = 0; i < ADC_CH_COUNT; ++i)
52 ccprintf(" %s = %d\n", adc_channels[i].name, data[i]);
53 return EC_SUCCESS;
54 }
/3rdparty/chromeec/common/adc.c: 49 in command_adc()
43 if (v == ADC_READ_ERROR)
44 return EC_ERROR_UNKNOWN;
45 ccprintf(" %s = %d\n", adc_channels[i].name, v);
46 return EC_SUCCESS;
47 } else {
48 /* Otherwise print them all */
>>> CID 1353340: (OVERRUN)
>>> Overrunning array "data" of 4 bytes by passing it to a function which accesses it at byte offset 12.
49 if (adc_read_all_channels(data))
50 return EC_ERROR_UNKNOWN;
51 for (i = 0; i < ADC_CH_COUNT; ++i)
52 ccprintf(" %s = %d\n", adc_channels[i].name, data[i]);
53 return EC_SUCCESS;
54 }
** CID 1353339: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/adc.c: 52 in command_adc()
________________________________________________________________________________________________________
*** CID 1353339: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/adc.c: 52 in command_adc()
46 return EC_SUCCESS;
47 } else {
48 /* Otherwise print them all */
49 if (adc_read_all_channels(data))
50 return EC_ERROR_UNKNOWN;
51 for (i = 0; i < ADC_CH_COUNT; ++i)
>>> CID 1353339: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "adc_channels" of 4 20-byte elements at element index 4 (byte offset 80) using index "i" (which evaluates to 4).
52 ccprintf(" %s = %d\n", adc_channels[i].name, data[i]);
53 return EC_SUCCESS;
54 }
55 }
56 DECLARE_CONSOLE_COMMAND(adc, command_adc,
57 "[name]",
58 "Print ADC channel(s)",
59 NULL);
** CID 1353338: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/adc.c: 25 in find_adc_channel_by_name()
________________________________________________________________________________________________________
*** CID 1353338: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/adc.c: 25 in find_adc_channel_by_name()
19 int i;
20
21 if (!name || !*name)
22 return ADC_CH_COUNT;
23
24 for (i = 0; i < ADC_CH_COUNT; i++, ch++) {
>>> CID 1353338: Memory - illegal accesses (OVERRUN)
>>> Overrunning array of 4 20-byte elements at element index 4 (byte offset 80) by dereferencing pointer "ch".
25 if (!strcasecmp(name, ch->name))
26 return i;
27 }
28
29 return ADC_CH_COUNT;
30 }
** CID 1353324: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init()
________________________________________________________________________________________________________
*** CID 1353324: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/driver/temp_sensor/bd99992gw.c: 74 in bd99992gw_init()
68
69 /* Make sure we don't have too many active channels. */
70 ASSERT(active_channel_count <= ARRAY_SIZE(active_channels));
71
72 /* Mark the first unused channel so we know where to stop searching */
73 if (active_channel_count != ARRAY_SIZE(active_channels))
>>> CID 1353324: Memory - corruptions (OVERRUN)
>>> Overrunning array "active_channels" of 8 4-byte elements at element index 9 (byte offset 36) using index "active_channel_count" (which evaluates to 9).
74 active_channels[active_channel_count] =
75 BD99992GW_ADC_CHANNEL_NONE;
76
77 /* Now write pointer regs with channel to monitor */
78 for (i = 0; i < active_channel_count; ++i)
79 /* Write stop bit on last channel */
** CID 1353321: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 1353321: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/driver/charger/isl9237.c: 58 in raw_write16()
52 {
53 return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
54 }
55
56 static inline int raw_write16(int offset, int value)
57 {
>>> CID 1353321: Memory - corruptions (OVERRUN)
>>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_write16".
58 return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
59 }
60
61 static int isl9237_set_current(uint16_t current)
62 {
63 return raw_write16(ISL9237_REG_CHG_CURRENT, CURRENT_TO_REG(current));
** CID 1353320: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 1353320: Memory - corruptions (OVERRUN)
/3rdparty/chromeec/driver/charger/isl9237.c: 53 in raw_read16()
47 {
48 return i2c_read8(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
49 }
50
51 static inline int raw_read16(int offset, int *value)
52 {
>>> CID 1353320: Memory - corruptions (OVERRUN)
>>> Overrunning callee's array of size 2 by passing argument "MEC1322_I2C3" in call to "i2c_read16".
53 return i2c_read16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
54 }
55
56 static inline int raw_write16(int offset, int value)
57 {
58 return i2c_write16(I2C_PORT_CHARGER, I2C_ADDR_CHARGER, offset, value);
** CID 1353317: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()
________________________________________________________________________________________________________
*** CID 1353317: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 153 in temp_sensor_command_get_info()
147 struct ec_response_temp_sensor_get_info *r = args->response;
148 int id = p->id;
149
150 if (id >= TEMP_SENSOR_COUNT)
151 return EC_RES_ERROR;
152
>>> CID 1353317: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "temp_sensors" of 5 20-byte elements at element index 14 (byte offset 280) using index "id" (which evaluates to 14).
153 strzcpy(r->sensor_name, temp_sensors[id].name, sizeof(r->sensor_name));
154 r->sensor_type = temp_sensors[id].type;
155
156 args->response_size = sizeof(*r);
157
158 return EC_RES_SUCCESS;
159 }
160 DECLARE_HOST_COMMAND(EC_CMD_TEMP_SENSOR_GET_INFO,
161 temp_sensor_command_get_info,
** CID 1353316: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()
________________________________________________________________________________________________________
*** CID 1353316: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 114 in command_temps()
108 if (rv)
109 rv1 = rv;
110
111 switch (rv) {
112 case EC_SUCCESS:
113 ccprintf("%d K = %d C", t, K_TO_C(t));
>>> CID 1353316: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "thermal_params" of 5 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14).
114 if (thermal_params[i].temp_fan_off &&
115 thermal_params[i].temp_fan_max)
116 ccprintf(" %d%%",
117 thermal_fan_percent(
118 thermal_params[i].temp_fan_off,
119 thermal_params[i].temp_fan_max,
** CID 1353315: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()
________________________________________________________________________________________________________
*** CID 1353315: Memory - illegal accesses (OVERRUN)
/3rdparty/chromeec/common/temp_sensor.c: 106 in command_temps()
100 static int command_temps(int argc, char **argv)
101 {
102 int t, i;
103 int rv, rv1 = EC_SUCCESS;
104
105 for (i = 0; i < TEMP_SENSOR_COUNT; ++i) {
>>> CID 1353315: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "temp_sensors" of 5 20-byte elements at element index 14 (byte offset 280) using index "i" (which evaluates to 14).
106 ccprintf(" %-20s: ", temp_sensors[i].name);
107 rv = temp_sensor_read(i, &t);
108 if (rv)
109 rv1 = rv;
110
111 switch (rv) {
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbLuoVetFLSjdonCi1EjfHRqWGQvojmmkYaBE-2BPJiTQvQ-3D-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5botd9mmh-2BTEyxkzNNj-2BlANbAHVCDWkVBAnBftzd9hVY0xH8WodrqAyArf39k2KdkNyg8viR7R8MM4r0hGyTFSTCuDCC0wl8JWsfWLB-2Fov66lwAF0aOfryaOvN6o0t3fhB31hg1tq3H0IKUS68Sdczw-2BKlvPW6RyYhJfiNGO0VxayI8vgVz6bkO6rLJ0SbqELU-3D
To manage Coverity Scan email notifications for "coreboot at coreboot.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4e-2BpBzwOa5gzBZa9dWpDbzfofODnVj1enK2UkK0-2BgCCqyeem8IVKvTxSaOFkteZFcnohwvb2rnYNjswGryEWCURnUk6WHU42sbOmtOjD-2Bx5c-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5botd9mmh-2BTEyxkzNNj-2BlANEreOa61btmDVAAO4VNsJnxTAzHM11FMEVbhCzdszBh-2FSUYAeH8-2B3ImAarPJMOBhL-2BrCUhWMkDkU2brxQEyOxyQ067L3BC-2B6CLXfkDeLtCIwhKe4hS-2BXyrDZWiVzb75DYYhv6PSmGH94Imtb7EF7TrZvOmSbLrHn0IM9zl-2FG5zyY-3D
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.coreboot.org/pipermail/coreboot/attachments/20160802/cdff6be5/attachment.html>
More information about the coreboot
mailing list