[coreboot] New Defects reported by Coverity Scan for coreboot

scan-admin at coverity.com scan-admin at coverity.com
Tue Jan 16 17:02:32 CET 2018


Hi,

Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan.

29 new defect(s) introduced to coreboot found with Coverity Scan.
28 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 29 defect(s)


** CID 1385126:    (UNUSED_VALUE)
/src/mainboard/asus/am1i-a/romstage.c: 148 in board_BeforeAgesa()
/src/mainboard/asus/am1i-a/romstage.c: 154 in board_BeforeAgesa()


________________________________________________________________________________________________________
*** CID 1385126:    (UNUSED_VALUE)
/src/mainboard/asus/am1i-a/romstage.c: 148 in board_BeforeAgesa()
142     	/* Enable the AcpiMmio space */
143     	outb(0x24, 0xcd6);
144     	outb(0x1, 0xcd7);
145     
146     	/* Configure ClkDrvStr1 settings */
147     	addr32 = (u32 *)0xfed80e24;
>>>     CID 1385126:    (UNUSED_VALUE)
>>>     Assigning value from "*addr32" to "t32" here, but that stored value is overwritten before it can be used.
148     	t32 = *addr32;
149     	t32 = 0x030800aa;
150     	*addr32 = t32;
151     
152     	/* Configure MiscClkCntl1 settings */
153     	addr32 = (u32 *)0xfed80e40;
/src/mainboard/asus/am1i-a/romstage.c: 154 in board_BeforeAgesa()
148     	t32 = *addr32;
149     	t32 = 0x030800aa;
150     	*addr32 = t32;
151     
152     	/* Configure MiscClkCntl1 settings */
153     	addr32 = (u32 *)0xfed80e40;
>>>     CID 1385126:    (UNUSED_VALUE)
>>>     Assigning value from "*addr32" to "t32" here, but that stored value is overwritten before it can be used.
154     	t32 = *addr32;
155     	t32 = 0x000c4050;
156     	*addr32 = t32;
157     
158     	/* enable SIO LPC decode */
159     	dev = PCI_DEV(0, 0x14, 3);

** CID 1383919:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/partitioned_file.c: 201 in partitioned_file_reopen()


________________________________________________________________________________________________________
*** CID 1383919:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/partitioned_file.c: 201 in partitioned_file_reopen()
195     	}
196     
197     	const struct fmap_area *fmap_fmap_entry =
198     				fmap_find_area(file->fmap, SECTION_NAME_FMAP);
199     
200     	if (!fmap_fmap_entry)
>>>     CID 1383919:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "file" going out of scope leaks the storage it points to.
201     		return NULL;
202     
203     	if ((long)fmap_fmap_entry->offset != fmap_region_offset) {
204     		ERROR("FMAP's '%s' section doesn't point back to FMAP start (did something corrupt this file?)\n",
205     							SECTION_NAME_FMAP);
206     		partitioned_file_close(file);

** CID 1361275:    (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 839 in parse_subpart_dir()


________________________________________________________________________________________________________
*** CID 1361275:    (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 832 in parse_subpart_dir()
826     	memcpy(hdr.name, data + offset, sizeof(hdr.name));
827     	offset += sizeof(hdr.name);
828     
829     	validate_subpart_dir_without_checksum((struct subpart_dir *)&hdr, name);
830     
831     	assert(size > subpart_dir_size(&hdr));
>>>     CID 1361275:    (TAINTED_SCALAR)
>>>     Passing tainted variable "subpart_dir_size(&hdr)" to a tainted sink.
832     	alloc_buffer(subpart_dir_buf, subpart_dir_size(&hdr), "Subpart Dir");
833     	memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE);
834     
835     	/* Read Subpart Dir entries. */
836     	struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf);
837     	struct subpart_dir_entry *e = &subpart_dir->e[0];
/util/cbfstool/ifwitool.c: 839 in parse_subpart_dir()
833     	memcpy(buffer_get(subpart_dir_buf), &hdr, SUBPART_DIR_HEADER_SIZE);
834     
835     	/* Read Subpart Dir entries. */
836     	struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf);
837     	struct subpart_dir_entry *e = &subpart_dir->e[0];
838     	uint32_t i;
>>>     CID 1361275:    (TAINTED_SCALAR)
>>>     Using tainted variable "hdr.num_entries" as a loop boundary.
839     	for (i = 0; i < hdr.num_entries; i++) {
840     		memcpy(e[i].name, data + offset, sizeof(e[i].name));
841     		offset += sizeof(e[i].name);
842     		offset = read_member(data, offset, sizeof(e[i].offset),
843     				     &e[i].offset);
844     		offset = read_member(data, offset, sizeof(e[i].length),

** CID 1361274:  Insecure data handling  (TAINTED_SCALAR)


________________________________________________________________________________________________________
*** CID 1361274:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 718 in alloc_bpdt_buffer()
712     {
713     	struct bpdt_header bpdt_header;
714     	assert((offset + BPDT_HEADER_SIZE) < size);
715     	bpdt_read_header((uint8_t *)data + offset, &bpdt_header, name);
716     
717     	/* Buffer to read BPDT header and entries. */
>>>     CID 1361274:  Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted variable "get_bpdt_size(&bpdt_header)" to a tainted sink.
718     	alloc_buffer(b, get_bpdt_size(&bpdt_header), name);
719     
720     	struct bpdt *bpdt = buffer_get(b);
721     	memcpy(&bpdt->h, &bpdt_header, BPDT_HEADER_SIZE);
722     
723     	/*

** CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/util/cbfstool/ifwitool.c: 1301 in init_subpart_dir_entry()


________________________________________________________________________________________________________
*** CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/util/cbfstool/ifwitool.c: 1301 in init_subpart_dir_entry()
1295     static size_t init_subpart_dir_entry(struct subpart_dir_entry *e,
1296     				     struct buffer *b, size_t offset)
1297     {
1298     	memset(e, 0, sizeof(*e));
1299     
1300     	assert(strlen(b->name) <= sizeof(e->name));
>>>     CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
>>>     Calling strncpy with a maximum size argument of 12 bytes on destination array "e->name" of size 12 bytes might leave the destination string unterminated.
1301     	strncpy((char *)e->name, (char *)b->name, sizeof(e->name));
1302     	e->offset = offset;
1303     	e->length = buffer_size(b);
1304     
1305     	return (offset + buffer_size(b));
1306     }

** CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()
346     			pspdir[4+4*i+2] = 1;
347     			pspdir[4+4*i+3] = 0;
348     		} else if (fw_table[i].filename != NULL) {
349     			pspdir[4+4*i+0] = fw_table[i].type;
350     
351     			fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.]
352     			fstat(fd, &fd_stat);
353     			pspdir[4+4*i+1] = (uint32_t)fd_stat.st_size;
354     
355     			pspdir[4+4*i+2] = pos + rom_base_address;
356     			pspdir[4+4*i+3] = 0;
357     

** CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()
289     	int i;
290     	uint32_t rom_base_address = 0xFFFFFFFF - rom_size + 1;
291     
292     	for (i = 0; fw_table[i].type != AMD_FW_INVALID; i++) {
293     		if (fw_table[i].filename != NULL) {
294     			fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fd" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.]
295     			fstat(fd, &fd_stat);
296     
297     			switch (fw_table[i].type) {
298     			case AMD_FW_IMC:
299     				pos = ALIGN(pos, 0x10000U);
300     				romsig[1] = pos + rom_base_address;

** CID 1353021:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 366 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353021:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 366 in integrate_psp_firmwares()
360     					" will not fit %s.  Exiting.\n",
361     					rom_size, fw_table[i].filename);
362     				free(base);
363     				exit(1);
364     			}
365     
>>>     CID 1353021:  Error handling issues  (CHECKED_RETURN)
>>>     "read(int, void *, size_t)" returns the number of bytes read, but it is ignored.
366     			read(fd, (void *)(base + pos), (size_t)fd_stat.st_size);
367     
368     			pos += fd_stat.st_size;
369     			close(fd);
370     			pos = ALIGN(pos, 0x100U);
371     		} else {

** CID 1353020:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353020:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()
346     			pspdir[4+4*i+2] = 1;
347     			pspdir[4+4*i+3] = 0;
348     		} else if (fw_table[i].filename != NULL) {
349     			pspdir[4+4*i+0] = fw_table[i].type;
350     
351     			fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353020:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.]
352     			fstat(fd, &fd_stat);
353     			pspdir[4+4*i+1] = (uint32_t)fd_stat.st_size;
354     
355     			pspdir[4+4*i+2] = pos + rom_base_address;
356     			pspdir[4+4*i+3] = 0;
357     

** CID 1353019:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 321 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353019:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 321 in integrate_firmwares()
315     					" will not fit %s.  Exiting.\n",
316     					rom_size, fw_table[i].filename);
317     				free(base);
318     				exit(1);
319     			}
320     
>>>     CID 1353019:  Error handling issues  (CHECKED_RETURN)
>>>     "read(int, void *, size_t)" returns the number of bytes read, but it is ignored.
321     			read(fd, (void *)(base + pos), (size_t)fd_stat.st_size);
322     
323     			pos += fd_stat.st_size;
324     			close(fd);
325     			pos = ALIGN(pos, 0x100U);
326     		}

** CID 1353018:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353018:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()
289     	int i;
290     	uint32_t rom_base_address = 0xFFFFFFFF - rom_size + 1;
291     
292     	for (i = 0; fw_table[i].type != AMD_FW_INVALID; i++) {
293     		if (fw_table[i].filename != NULL) {
294     			fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353018:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "fstat(fd, &fd_stat)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.]
295     			fstat(fd, &fd_stat);
296     
297     			switch (fw_table[i].type) {
298     			case AMD_FW_IMC:
299     				pos = ALIGN(pos, 0x10000U);
300     				romsig[1] = pos + rom_base_address;

** CID 1347335:    (UNINIT)
/util/cbfstool/elfheaders.c: 1000 in write_phdrs()
/util/cbfstool/elfheaders.c: 1002 in write_phdrs()
/util/cbfstool/elfheaders.c: 1003 in write_phdrs()
/util/cbfstool/elfheaders.c: 1004 in write_phdrs()


________________________________________________________________________________________________________
*** CID 1347335:    (UNINIT)
/util/cbfstool/elfheaders.c: 1000 in write_phdrs()
994     		} else {
995     			/* Accumulate file size and memsize. The assumption
996     			 * is that each section is either NOBITS or full
997     			 * (sh_size == file size). This is standard in that
998     			 * an ELF section doesn't have a file size component. */
999     			if (sec->shdr.sh_flags & SHF_EXECINSTR)
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_flags".
1000     				phdr.p_flags |= PF_X | PF_R;
1001     			if (sec->shdr.sh_flags & SHF_WRITE)
1002     				phdr.p_flags |= PF_W;
1003     			phdr.p_filesz += buffer_size(&sec->content);
1004     			phdr.p_memsz += sec->shdr.sh_size;
1005     		}
/util/cbfstool/elfheaders.c: 1002 in write_phdrs()
996     			 * is that each section is either NOBITS or full
997     			 * (sh_size == file size). This is standard in that
998     			 * an ELF section doesn't have a file size component. */
999     			if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000     				phdr.p_flags |= PF_X | PF_R;
1001     			if (sec->shdr.sh_flags & SHF_WRITE)
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_flags".
1002     				phdr.p_flags |= PF_W;
1003     			phdr.p_filesz += buffer_size(&sec->content);
1004     			phdr.p_memsz += sec->shdr.sh_size;
1005     		}
1006     	}
1007     
/util/cbfstool/elfheaders.c: 1003 in write_phdrs()
997     			 * (sh_size == file size). This is standard in that
998     			 * an ELF section doesn't have a file size component. */
999     			if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000     				phdr.p_flags |= PF_X | PF_R;
1001     			if (sec->shdr.sh_flags & SHF_WRITE)
1002     				phdr.p_flags |= PF_W;
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_filesz".
1003     			phdr.p_filesz += buffer_size(&sec->content);
1004     			phdr.p_memsz += sec->shdr.sh_size;
1005     		}
1006     	}
1007     
1008     	/* Write out the last phdr. */
/util/cbfstool/elfheaders.c: 1004 in write_phdrs()
998     			 * an ELF section doesn't have a file size component. */
999     			if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000     				phdr.p_flags |= PF_X | PF_R;
1001     			if (sec->shdr.sh_flags & SHF_WRITE)
1002     				phdr.p_flags |= PF_W;
1003     			phdr.p_filesz += buffer_size(&sec->content);
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_memsz".
1004     			phdr.p_memsz += sec->shdr.sh_size;
1005     		}
1006     	}
1007     
1008     	/* Write out the last phdr. */
1009     	if (num_needs_write != num_written) {

** CID 1302457:  Control flow issues  (MISSING_RESTORE)
/util/cbfstool/flashmap/fmap.c: 485 in fmap_append_area_test()


________________________________________________________________________________________________________
*** CID 1302457:  Control flow issues  (MISSING_RESTORE)
/util/cbfstool/flashmap/fmap.c: 485 in fmap_append_area_test()
479     	if ((*fmap)->nareas != 1) {
480     		printf("FAILURE: failed to increment number of areas\n");
481     		goto fmap_append_area_test_exit;
482     	}
483     
484     	status = pass;
>>>     CID 1302457:  Control flow issues  (MISSING_RESTORE)
>>>     Jumped to here, skipping restore.
485     fmap_append_area_test_exit:
486     	return status;
487     }
488     
489     static int fmap_find_area_test(struct fmap *fmap)
490     {

** CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
/util/cbfstool/flashmap/fmap.c: 601 in fmap_find_test()


________________________________________________________________________________________________________
*** CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
/util/cbfstool/flashmap/fmap.c: 601 in fmap_find_test()
595     		printf("FAILURE: bsearch returned false positive\n");
596     		goto fmap_find_test_exit;
597     	}
598     
599     	/* simple test case: fmap at (total_size / 2) + 1 */
600     	offset = (total_size / 2) + 1;
>>>     CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fmap_size(fmap)" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.]
601     	memcpy(&buf[offset], fmap, fmap_size(fmap));
602     
603     	if ((unsigned)fmap_find(buf, total_size - 1) != offset) {
604     		printf("FAILURE: lsearch failed to find fmap\n");
605     		goto fmap_find_test_exit;
606     	}

** CID 1302453:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()


________________________________________________________________________________________________________
*** CID 1302453:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557     	}
558     	free(my_str);
559     	free(str);
560     
561     	status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302453:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "my_str" going out of scope leaks the storage it points to.
563     	return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {

** CID 1302452:    (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()


________________________________________________________________________________________________________
*** CID 1302452:    (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557     	}
558     	free(my_str);
559     	free(str);
560     
561     	status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302452:    (RESOURCE_LEAK)
>>>     Variable "str" going out of scope leaks the storage it points to.
563     	return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557     	}
558     	free(my_str);
559     	free(str);
560     
561     	status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302452:    (RESOURCE_LEAK)
>>>     Variable "str" going out of scope leaks the storage it points to.
563     	return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {

** CID 1302451:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 240 in fmap_print()


________________________________________________________________________________________________________
*** CID 1302451:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 240 in fmap_print()
234     		kv_pair_fmt(pair, "area_flags_raw", "0x%02x",
235     				fmap->areas[i].flags);
236     
237     		/* Print descriptive strings for flags rather than the field */
238     		flags = fmap->areas[i].flags;
239     		if ((str = fmap_flags_to_string(flags)) == NULL)
>>>     CID 1302451:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "pair" going out of scope leaks the storage it points to.
240     			return -1;
241     		kv_pair_fmt(pair, "area_flags", "%s", str);
242     		free(str);
243     
244     		kv_pair_print(pair);
245     		kv_pair_free(pair);

** CID 1241818:  Memory - illegal accesses  (OVERRUN)
/src/vendorcode/amd/cimx/rd890/nbPcieLib.c: 1359 in PcieLibGetPortInfo()


________________________________________________________________________________________________________
*** CID 1241818:  Memory - illegal accesses  (OVERRUN)
/src/vendorcode/amd/cimx/rd890/nbPcieLib.c: 1359 in PcieLibGetPortInfo()
1353       case  GPP3a_CORE:
1354         pGppCfgInfoTable = (GPP_CFG_INFO*)FIX_PTR_ADDR (&GppCfgInfoTable[CoreConfig - 1], NULL);
1355         NativePortId = PcieLibNativePortId (PortId, pConfig);
1356         if (NativePortId == 0xf) {
1357           return NULL;
1358         }
>>>     CID 1241818:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 6 8-byte elements at element index 4294967295 (byte offset 34359738360) by dereferencing pointer "pGppCfgInfoTable".
1359         pPortInfo = &pGppCfgInfoTable->PortInfoPtr[NativePortId - 4];
1360         break;
1361       default:
1362         return NULL;
1363       }
1364       return (PORT_INFO*)FIX_PTR_ADDR (pPortInfo, NULL);

** CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 653 in Bt2_MatchFinder_Skip()


________________________________________________________________________________________________________
*** CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 653 in Bt2_MatchFinder_Skip()
647     static void Bt2_MatchFinder_Skip(struct CMatchFinder *p, uint32_t num)
648     {
649       do
650       {
651         SKIP_HEADER(2)
652         HASH2_CALC;
>>>     CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "hashValue" as an index to pointer "p->hash".
653         curMatch = p->hash[hashValue];
654         p->hash[hashValue] = p->pos;
655         SKIP_FOOTER
656       }
657       while (--num != 0);
658     }

** CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 489 in Bt2_MatchFinder_GetMatches()


________________________________________________________________________________________________________
*** CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 489 in Bt2_MatchFinder_GetMatches()
483     
484     static uint32_t Bt2_MatchFinder_GetMatches(struct CMatchFinder *p, uint32_t *distances)
485     {
486       uint32_t offset;
487       GET_MATCHES_HEADER(2)
488       HASH2_CALC;
>>>     CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "hashValue" as an index to pointer "p->hash".
489       curMatch = p->hash[hashValue];
490       p->hash[hashValue] = p->pos;
491       offset = 0;
492       GET_MATCHES_FOOTER(offset, 1)
493     }
494     


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbLuoVetFLSjdonCi1EjfHRqWGQvojmmkYaBE-2BPJiTQvQ-3D-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5aBueK59y7L7-2BNMCFvIZ3L6lm-2FUdKbAyTBHTJ2r-2FDyRuUnsQjE3WJpI8KUI0TLmvJQ3kvgnicpsJWLgdZPM8x67GU0imNbxaQ2qhvlGYnD0B981ECxfeqe-2BBvqlOCQeih6C1seuoi-2F7w5OvokScGIB2ID5xqTgaxTj9w83qvVlkTGtZzvV41Pblq37tC-2Bqrkls-3D

To manage Coverity Scan email notifications for "coreboot at coreboot.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4e-2BpBzwOa5gzBZa9dWpDbzfofODnVj1enK2UkK0-2BgCCqfkfgGF5ECMwHI0-2FVznrU953Dvw3Ddjop950pccFQ-2Br0qaXkQSgAjbZsF6g7Yem3Y-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5aBueK59y7L7-2BNMCFvIZ3L6YY3ye9-2Fm90c6W-2B7iNDrMJ1SaloChr6CoHzHLPwmBcNiN6J7vd2U5lh3-2ByOW8oLjG1C85-2F1HR3rI9K5xnbqdjL-2FIDhaC7S3fGHVTHctN3kyie2l2NQu-2BqlxnkyRv9XKz9ZPQwGBqdyhA4HSBw5HeVV8268w-2FCYVAZgTFugG8U7LA-3D




More information about the coreboot mailing list