Re: Coverity 652910 Uninitialized pointer read

Hi Heinrich,

On Thu, Aug 20, 2026 at 1:35 PM Heinrich Schuchardt <[email protected]> wrote:
>
>
> Hello Igor,
>
> Covertiy complains that avb_replace() might be called with and
> uninitialzed value of dm_verity_mode.
>
> I think to fix the issue following change is needed:
>
> $ git diff
> diff --git a/lib/libavb/avb_cmdline.c b/lib/libavb/avb_cmdline.c
> index 842629abe0e..f2d2e350d6b 100644
> --- a/lib/libavb/avb_cmdline.c
> +++ b/lib/libavb/avb_cmdline.c
> @@ -333,7 +333,7 @@ AvbSlotVerifyResult avb_append_options(
>           // Should never get here because MANAGED_RESTART_AND_EIO is
>           // remapped by avb_manage_hashtree_error_mode().
>           avb_assert_not_reached();
> -        break;
> +        return AVB_SLOT_VERIFY_RESULT_ERROR_IO;
>         case AVB_HASHTREE_ERROR_MODE_PANIC:
>           verity_mode = "panicking";
>           dm_verity_mode = "panic_on_corruption";
>
> Do you know where the upstream code lives that we copied?
>
> Probably we want to fix upstream first.

The upstream code lives in the AOSP external/avb repository:
https://android.googlesource.com/platform/external/avb/

It's primarily Google-maintained, with only occasional contributions from
OEMs/partners and the community - so based on my past experience,
getting a patch accepted upstream there can be difficult, if not impossible.

Patches need to be submitted via the Gerrit instance at:
https://android-review.googlesource.com/

>
> Best regards
>
> Heinrich


-- 
Best regards - Atentamente - Meilleures salutations

Igor Opaniuk

mailto: [email protected]
skype: igor.opanyuk
https://www.linkedin.com/in/iopaniuk