Re: New Defects reported by Coverity Scan for RTEMS-Newlib

Alexey?

On Feb 10 16:56, Joel Sherrill wrote:
> Coverity Scan has spotted a handful of issues with the recent string
> changes.
> 
> --joel
> 
> ---------- Forwarded message ---------
> From: <[email protected]>
> Date: Mon, Feb 10, 2025 at 4:27 PM
> Subject: New Defects reported by Coverity Scan for RTEMS-Newlib
> To: <[email protected]>
> 
> 
> Hi,
> 
> Please find the latest report on new defect(s) introduced to RTEMS-Newlib
> found with Coverity Scan.
> 
> 6 new defect(s) introduced to RTEMS-Newlib found with Coverity Scan.
> 
> 
> New defect(s) Reported-by: Coverity Scan
> Showing 6 of 6 defect(s)
> 
> 
> ** CID 474676:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/mempcpy.c:
> 68 in mempcpy()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 474676:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/mempcpy.c:
> 68 in mempcpy()
> 62           while (!TOO_SMALL_BIG_BLOCK(len0))
> 63             {
> 64               *aligned_dst++ = *aligned_src++;
> 65               *aligned_dst++ = *aligned_src++;
> 66               *aligned_dst++ = *aligned_src++;
> 67               *aligned_dst++ = *aligned_src++;
> >>>     CID 474676:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 68               len0 -= BIG_BLOCK_SIZE;
> 69             }
> 70
> 71           /* Copy one long word at a time if possible.  */
> 72           while (!TOO_SMALL_LITTLE_BLOCK(len0))
> 73             {
> 
> ** CID 474675:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/stpncpy.c:
> 64 in stpncpy()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 474675:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/stpncpy.c:
> 64 in stpncpy()
> 58           aligned_src = (long*)src;
> 59
> 60           /* SRC and DEST are both LITTLE_BLOCK_SIZE aligned,
> 61       try to do LITTLE_BLOCK_SIZE sized copies.  */
> 62           while (!TOO_SMALL_LITTLE_BLOCK (count) &&
> !DETECT_NULL(*aligned_src))
> 63      {
> >>>     CID 474675:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "count", underflows the type of "count", which is type
> "size_t".
> 64        count -= LITTLE_BLOCK_SIZE;
> 65        *aligned_dst++ = *aligned_src++;
> 66      }
> 67
> 68           dst = (char*)aligned_dst;
> 69           src = (char*)aligned_src;
> 
> ** CID 474674:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memccpy.c:
> 96 in memccpy()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 474674:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memccpy.c:
> 96 in memccpy()
> 90             {
> 91               unsigned long buffer = (unsigned long)(*aligned_src);
> 92               buffer ^=  mask;
> 93               if (DETECT_NULL(buffer))
> 94                 break; /* endchar is found, go byte by byte from here */
> 95               *aligned_dst++ = *aligned_src++;
> >>>     CID 474674:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 96               len0 -= LITTLE_BLOCK_SIZE;
> 97             }
> 98
> 99            /* Pick up any residual with a byte copier.  */
> 100           dst = (unsigned char*)aligned_dst;
> 101           src = (unsigned char*)aligned_src;
> 
> ** CID 474673:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memmove.c:
> 88 in memmove()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 474673:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memmove.c:
> 88 in memmove()
> 82               aligned_src = (long*)src;
> 83
> 84               /* Copy one long word at a time if possible.  */
> 85               while (!TOO_SMALL_LITTLE_BLOCK(length))
> 86                 {
> 87                   *--aligned_dst = *--aligned_src;
> >>>     CID 474673:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "length", underflows the type of "length", which is type
> "size_t".
> 88                   length -= LITTLE_BLOCK_SIZE;
> 89                 }
> 90
> 91               /* Pick up any residual with a byte copier.  */
> 92               dst = (char*)aligned_dst;
> 93               src = (char*)aligned_src;
> 
> ** CID 474672:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memcpy.c:
> 72 in memcpy()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 474672:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/memcpy.c:
> 72 in memcpy()
> 66           while (!TOO_SMALL_BIG_BLOCK(len0))
> 67             {
> 68               *aligned_dst++ = *aligned_src++;
> 69               *aligned_dst++ = *aligned_src++;
> 70               *aligned_dst++ = *aligned_src++;
> 71               *aligned_dst++ = *aligned_src++;
> >>>     CID 474672:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "len0", underflows the type of "len0", which is type
> "size_t".
> 72               len0 -= BIG_BLOCK_SIZE;
> 73             }
> 74
> 75           /* Copy one long word at a time if possible.  */
> 76           while (!TOO_SMALL_LITTLE_BLOCK(len0))
> 77             {
> 
> ** CID 470638:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/strncpy.c:
> 78 in strncpy()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 470638:  Integer handling issues  (INTEGER_OVERFLOW)
> /home/joel/rtems-cron-coverity/newlib-cygwin/newlib/libc/string/strncpy.c:
> 78 in strncpy()
> 72           aligned_src = (long*)src;
> 73
> 74           /* SRC and DEST are both "long int" aligned, try to do "long
> int"
> 75       sized copies.  */
> 76           while (!TOO_SMALL_LITTLE_BLOCK(count) &&
> !DETECT_NULL(*aligned_src))
> 77      {
> >>>     CID 470638:  Integer handling issues  (INTEGER_OVERFLOW)
> >>>     Expression "count", underflows the type of "count", which is type
> "size_t".
> 78        count -= sizeof (long int);
> 79        *aligned_dst++ = *aligned_src++;
> 80      }
> 81
> 82           dst = (char*)aligned_dst;
> 83           src = (char*)aligned_src;
> 
> 
> ________________________________________________________________________________________________________
> To view the defects in Coverity Scan visit,
> https://scan.coverity.com/projects/rtems-newlib?tab=overview
> 
>   To manage Coverity Scan email notifications for "[email protected]",
> click
> https://scan.coverity.com/subscriptions/edit?email=joel.sherrill%40gmail.com&token=1d6de09a8cf588074bed902a634fe5bc