Coverity-updates archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
New Defects reported by Coverity Scan for NetBSD-i386-user
Hi,
Please find the latest report on new defect(s) introduced to NetBSD-i386-user found with Coverity Scan.
5 new defect(s) introduced to NetBSD-i386-user found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)
** CID 978595: (REVERSE_NEGATIVE)
/sbin/fsck_lfs/segwrite.c: 521 in lfs_update_single()
/sbin/fsck_lfs/segwrite.c: 536 in lfs_update_single()
________________________________________________________________________________________________________
*** CID 978595: (REVERSE_NEGATIVE)
/sbin/fsck_lfs/segwrite.c: 521 in lfs_update_single()
515 /*
516 * Update segment usage information, based on old size
517 * and location.
518 */
519 if (daddr > 0) {
520 u_int32_t oldsn = lfs_dtosn(fs, daddr);
>>> CID 978595: (REVERSE_NEGATIVE)
>>> You might be using variable "lbn" before verifying that it is >= 0.
521 if (lbn >= 0 && lbn < ULFS_NDADDR)
522 osize = ip->i_lfs_fragsize[lbn];
523 else
524 osize = lfs_sb_getbsize(fs);
525 LFS_SEGENTRY(sup, fs, oldsn, bp);
526 sup->su_nbytes -= osize;
/sbin/fsck_lfs/segwrite.c: 536 in lfs_update_single()
530 }
531 /*
532 * Now that this block has a new address, and its old
533 * segment no longer owns it, we can forget about its
534 * old size.
535 */
>>> CID 978595: (REVERSE_NEGATIVE)
>>> You might be using variable "lbn" before verifying that it is >= 0.
536 if (lbn >= 0 && lbn < ULFS_NDADDR)
537 ip->i_lfs_fragsize[lbn] = size;
538 }
539
540 /*
541 * Update the metadata that points to the blocks listed in the FINFO
** CID 1327233: Error handling issues (CHECKED_RETURN)
/sys/rump/librump/rumpkern/rump_syscalls.c: 6420 in rump___sysimpl_clock_nanosleep()
________________________________________________________________________________________________________
*** CID 1327233: Error handling issues (CHECKED_RETURN)
/sys/rump/librump/rumpkern/rump_syscalls.c: 6420 in rump___sysimpl_clock_nanosleep()
6414 memset(&callarg, 0, sizeof(callarg));
6415 SPARG(&callarg, clock_id) = clock_id;
6416 SPARG(&callarg, flags) = flags;
6417 SPARG(&callarg, rqtp) = rqtp;
6418 SPARG(&callarg, rmtp) = rmtp;
6419
>>> CID 1327233: Error handling issues (CHECKED_RETURN)
>>> Calling "rumpclient_syscall" without checking return value (as is done elsewhere 25 out of 26 times).
6420 rsys_syscall(SYS_clock_nanosleep, &callarg, sizeof(callarg), retval);
6421 if (sizeof(int) > sizeof(register_t))
6422 rv = *(int *)retval;
6423 else
6424 rv = *retval;
6425 return rv;
** CID 1327234: Memory - illegal accesses (OVERRUN)
________________________________________________________________________________________________________
*** CID 1327234: Memory - illegal accesses (OVERRUN)
/external/mit/lua/dist/src/lvm.c: 121 in luaV_tointeger()
115 if (ttisinteger(obj)) {
116 UNUSED(mode);
117 #endif
118 *p = ivalue(obj);
119 return 1;
120 }
>>> CID 1327234: Memory - illegal accesses (OVERRUN)
>>> Overrunning array of 16 bytes at byte offset 16 by dereferencing pointer "(char const *)((char *)&((union GCUnion *)obj->value_.gc)->ts + 16U)".
121 else if (cvt2num(obj) &&
122 luaO_str2num(svalue(obj), &v) == vslen(obj) + 1) {
123 obj = &v;
124 goto again; /* convert result from 'luaO_str2num' to an integer */
125 }
126 return 0; /* conversion failed */
** CID 1327235: (RESOURCE_LEAK)
/usr.bin/make/var.c: 4087 in Var_Subst()
/usr.bin/make/var.c: 4096 in Var_Subst()
________________________________________________________________________________________________________
*** CID 1327235: (RESOURCE_LEAK)
/usr.bin/make/var.c: 4087 in Var_Subst()
4081 str += length;
4082
4083 /*
4084 * Copy all the characters from the variable value straight
4085 * into the new string.
4086 */
>>> CID 1327235: (RESOURCE_LEAK)
>>> Overwriting "length" in "length = strlen(val)" leaks the storage that "length" points to.
4087 length = strlen(val);
4088 Buf_AddBytes(&buf, length, val);
4089 trailingBslash = length > 0 && val[length - 1] == '\\';
4090 }
4091 free(freeIt);
4092 freeIt = NULL;
/usr.bin/make/var.c: 4096 in Var_Subst()
4090 }
4091 free(freeIt);
4092 freeIt = NULL;
4093 }
4094 }
4095
>>> CID 1327235: (RESOURCE_LEAK)
>>> Variable "length" going out of scope leaks the storage it points to.
4096 return Buf_DestroyCompact(&buf);
4097 }
4098
4099 /*-
4100 *-----------------------------------------------------------------------
4101 * Var_GetTail --
** CID 1327236: (RESOURCE_LEAK)
/usr.bin/make/cond.c: 846 in get_mpt_arg()
/usr.bin/make/cond.c: 835 in get_mpt_arg()
________________________________________________________________________________________________________
*** CID 1327236: (RESOURCE_LEAK)
/usr.bin/make/cond.c: 846 in get_mpt_arg()
840 val++;
841
842 /*
843 * For consistency with the other functions we can't generate the
844 * true/false here.
845 */
>>> CID 1327236: (RESOURCE_LEAK)
>>> Overwriting "length" in "length = (*val ? 2 : 1)" leaks the storage that "length" points to.
846 length = *val ? 2 : 1;
847 if (freeIt)
848 free(freeIt);
849 return length;
850 }
851
/usr.bin/make/cond.c: 835 in get_mpt_arg()
829 * we subtract one because 'length' is calculated from 'cp - 1'.
830 */
831 *linePtr = cp - 1 + length;
832
833 if (val == var_Error) {
834 free(freeIt);
>>> CID 1327236: (RESOURCE_LEAK)
>>> Variable "length" going out of scope leaks the storage it points to.
835 return -1;
836 }
837
838 /* A variable is empty when it just contains spaces... 4/15/92, christos */
839 while (isspace(*(unsigned char *)val))
840 val++;
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/netbsd-i386-user?tab=overview
To manage Coverity Scan email notifications for "coverity-updates%netbsd.org@localhost", click https://scan.coverity.com/subscriptions/edit?email=coverity-updates%40netbsd.org&token=487286ca1a9a4f4bd485d16f66b5e782
Home |
Main Index |
Thread Index |
Old Index