Coverity-updates archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

New Defects reported by Coverity Scan for NetBSD-i386-user



Hi,

Please find the latest report on new defect(s) introduced to NetBSD-i386-user found with Coverity Scan.

1235 new defect(s) introduced to NetBSD-i386-user found with Coverity Scan.
69 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 1235 defect(s)


** CID 1428705:  Concurrent data access violations  (MISSING_LOCK)
/external/bsd/bind/dist/lib/isc/rwlock.c: 214 in isc_rwlock_init()


________________________________________________________________________________________________________
*** CID 1428705:  Concurrent data access violations  (MISSING_LOCK)
/external/bsd/bind/dist/lib/isc/rwlock.c: 214 in isc_rwlock_init()
208     		write_quota = RWLOCK_DEFAULT_WRITE_QUOTA;
209     	rwl->write_quota = write_quota;
210     #else
211     	rwl->type = isc_rwlocktype_read;
212     	rwl->original = isc_rwlocktype_none;
213     	rwl->active = 0;
>>>     CID 1428705:  Concurrent data access violations  (MISSING_LOCK)
>>>     Accessing "rwl->granted" without holding lock "isc_rwlock.lock". Elsewhere, "isc_rwlock.granted" is accessed with "isc_rwlock.lock" held 6 out of 7 times.
214     	rwl->granted = 0;
215     	rwl->readers_waiting = 0;
216     	rwl->writers_waiting = 0;
217     	if (read_quota == 0)
218     		read_quota = RWLOCK_DEFAULT_READ_QUOTA;
219     	rwl->read_quota = read_quota;

** CID 1428704:    (TAINTED_SCALAR)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 1064 in vgname_from_mda()
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 1077 in vgname_from_mda()


________________________________________________________________________________________________________
*** CID 1428704:    (TAINTED_SCALAR)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 1064 in vgname_from_mda()
1058     		return_NULL;
1059     
1060     	if (!(mdah = _raw_read_mda_header(fmt, dev_area)))
1061     		goto_out;
1062     
1063     	/* FIXME Cope with returning a list */
>>>     CID 1428704:    (TAINTED_SCALAR)
>>>     Assigning: "rlocn" = "mdah->raw_locns". Both are now tainted.
1064     	rlocn = mdah->raw_locns;
1065     
1066     	/*
1067     	 * If no valid offset, do not try to search for vgname
1068     	 */
1069     	if (!rlocn->offset)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 1077 in vgname_from_mda()
1071     
1072     	/* Do quick check for a vgname */
1073     	if (!dev_read(dev_area->dev, dev_area->start + rlocn->offset,
1074     		      NAME_LEN, buf))
1075     		goto_out;
1076     
>>>     CID 1428704:    (TAINTED_SCALAR)
>>>     Using tainted variable "buf[len]" as an index to pointer "_ctype_tab_ + 1".
1077     	while (buf[len] && !isspace(buf[len]) && buf[len] != '{' &&
1078     	       len < (NAME_LEN - 1))
1079     		len++;
1080     
1081     	buf[len] = '\0';
1082     
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 1084 in vgname_from_mda()
1078     	       len < (NAME_LEN - 1))
1079     		len++;
1080     
1081     	buf[len] = '\0';
1082     
1083     	/* Ignore this entry if the characters aren't permissible */
>>>     CID 1428704:    (TAINTED_SCALAR)
>>>     Passing tainted variable "buf" to a tainted sink.
1084     	if (!validate_name(buf))
1085     		goto_out;
1086     
1087     	/* We found a VG - now check the metadata */
1088     	if (rlocn->offset + rlocn->size > mdah->size)
1089     		wrap = (uint32_t) ((rlocn->offset + rlocn->size) - mdah->size);

** CID 1428703:  Error handling issues  (CHECKED_RETURN)
/external/gpl3/binutils/dist/bfd/elf-eh-frame.c: 1094 in add_eh_frame_hdr_terminator()


________________________________________________________________________________________________________
*** CID 1428703:  Error handling issues  (CHECKED_RETURN)
/external/gpl3/binutils/dist/bfd/elf-eh-frame.c: 1094 in add_eh_frame_hdr_terminator()
1088         }
1089     
1090       /* Add space for a CANTUNWIND terminator.  */
1091       if (!sec->rawsize)
1092         sec->rawsize = sec->size;
1093     
>>>     CID 1428703:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "bfd_set_section_size" without checking return value (as is done elsewhere 12 out of 15 times).
1094       bfd_set_section_size (sec->owner, sec, sec->size + 8);
1095     }
1096     
1097     /* Finish a pass over all .eh_frame_entry sections.  */
1098     
1099     bfd_boolean

** CID 1428702:    (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 88 in atfu_msgrcv_basic_body()
/tests/lib/libc/sys/t_msgrcv.c: 89 in atfu_msgrcv_basic_body()


________________________________________________________________________________________________________
*** CID 1428702:    (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 88 in atfu_msgrcv_basic_body()
82     	struct msg msg2 = { MSG_MTYPE_1, { 'x', 'y', 'z' } };
83     	int id;
84     
85     	id = msgget(MSG_KEY, IPC_CREAT | 0600);
86     	ATF_REQUIRE(id != -1);
87     
>>>     CID 1428702:    (OVERRUN)
>>>     Overrunning struct type msg of 8 bytes by passing it to a function which accesses it at byte offset 10 using argument "3U". [Note: The source code implementation of the function has been overridden by a builtin model.]
88     	(void)msgsnd(id, &msg1, MSG_LEN, IPC_NOWAIT);
89     	(void)msgrcv(id, &msg2, MSG_LEN, MSG_MTYPE_1, IPC_NOWAIT);
90     
91     	ATF_CHECK(msg1.buf[0] == msg2.buf[0]);
92     	ATF_CHECK(msg1.buf[1] == msg2.buf[1]);
93     	ATF_CHECK(msg1.buf[2] == msg2.buf[2]);
/tests/lib/libc/sys/t_msgrcv.c: 89 in atfu_msgrcv_basic_body()
83     	int id;
84     
85     	id = msgget(MSG_KEY, IPC_CREAT | 0600);
86     	ATF_REQUIRE(id != -1);
87     
88     	(void)msgsnd(id, &msg1, MSG_LEN, IPC_NOWAIT);
>>>     CID 1428702:    (OVERRUN)
>>>     Overrunning struct type msg of 8 bytes by passing it to a function which accesses it at byte offset 10 using argument "3U". [Note: The source code implementation of the function has been overridden by a builtin model.]
89     	(void)msgrcv(id, &msg2, MSG_LEN, MSG_MTYPE_1, IPC_NOWAIT);
90     
91     	ATF_CHECK(msg1.buf[0] == msg2.buf[0]);
92     	ATF_CHECK(msg1.buf[1] == msg2.buf[1]);
93     	ATF_CHECK(msg1.buf[2] == msg2.buf[2]);
94     

** CID 1428701:  Insecure data handling  (INTEGER_OVERFLOW)
/external/bsd/nvi/dist/common/exf.c: 1178 in file_backup()


________________________________________________________________________________________________________
*** CID 1428701:  Insecure data handling  (INTEGER_OVERFLOW)
/external/bsd/nvi/dist/common/exf.c: 1178 in file_backup()
1172     		goto err;
1173     	}
1174     
1175     	/* Copy the file's current contents to its backup value. */
1176     	while ((nr = read(rfd, buf, sizeof(buf))) > 0)
1177     		for (off = 0; nr != 0; nr -= nw, off += nw)
>>>     CID 1428701:  Insecure data handling  (INTEGER_OVERFLOW)
>>>     Overflowed or truncated value (or a value computed from an overflowed or truncated value) "nr" used as critical argument to function. [Note: The source code implementation of the function has been overridden by a builtin model.]
1178     			if ((nw = write(wfd, buf + off, nr)) < 0) {
1179     				estr = wfname;
1180     				goto err;
1181     			}
1182     	if (nr < 0) {
1183     		estr = name;

** CID 1428700:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 123 in atfu_msgrcv_block_body()


________________________________________________________________________________________________________
*** CID 1428700:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 123 in atfu_msgrcv_block_body()
117     
118     	pid = fork();
119     	ATF_REQUIRE(pid >= 0);
120     
121     	if (pid == 0) {
122     
>>>     CID 1428700:  Memory - corruptions  (OVERRUN)
>>>     Overrunning struct type msg of 8 bytes by passing it to a function which accesses it at byte offset 10 using argument "3U". [Note: The source code implementation of the function has been overridden by a builtin model.]
123     		if (msgrcv(id, &msg, MSG_LEN, MSG_MTYPE_1, 0) < 0)
124     			_exit(EXIT_FAILURE);
125     
126     		_exit(EXIT_SUCCESS);
127     	}
128     

** CID 1428699:  Null pointer dereferences  (FORWARD_NULL)
/usr/obj/i386-i386/src/usr.sbin/ndiscvt.i386-i386/inf-token.c: 1414 in ndiscvt_restart()


________________________________________________________________________________________________________
*** CID 1428699:  Null pointer dereferences  (FORWARD_NULL)
/usr/obj/i386-i386/src/usr.sbin/ndiscvt.i386-i386/inf-token.c: 1414 in ndiscvt_restart()
1408      * @note This function does not reset the start condition to @c INITIAL .
1409      */
1410         void yyrestart  (FILE * input_file )
1411     {
1412         
1413     	if ( ! YY_CURRENT_BUFFER ){
>>>     CID 1428699:  Null pointer dereferences  (FORWARD_NULL)
>>>     Dereferencing null pointer "yy_buffer_stack".
1414             yyensure_buffer_stack ();
1415     		YY_CURRENT_BUFFER_LVALUE =
1416                 yy_create_buffer( yyin, YY_BUF_SIZE );
1417     	}
1418     
1419     	yy_init_buffer( YY_CURRENT_BUFFER, input_file );

** CID 1428698:  Error handling issues  (CHECKED_RETURN)
/usr/xsrc/external/mit/libdrm/dist/nouveau/abi16.c: 234 in abi16_delete()


________________________________________________________________________________________________________
*** CID 1428698:  Error handling issues  (CHECKED_RETURN)
/usr/xsrc/external/mit/libdrm/dist/nouveau/abi16.c: 234 in abi16_delete()
228     		drmCommandWrite(drm->fd, DRM_NOUVEAU_CHANNEL_FREE,
229     				&req, sizeof(req));
230     	} else {
231     		struct drm_nouveau_gpuobj_free req;
232     		req.channel = obj->parent->handle;
233     		req.handle  = obj->handle;
>>>     CID 1428698:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "drmCommandWrite" without checking return value (as is done elsewhere 8 out of 9 times).
234     		drmCommandWrite(drm->fd, DRM_NOUVEAU_GPUOBJ_FREE,
235     				&req, sizeof(req));
236     	}
237     }
238     
239     drm_private bool

** CID 1428697:  Program hangs  (LOCK)
/external/bsd/bind/dist/lib/dns/rbtdb.c: 8050 in getsigningtime64()


________________________________________________________________________________________________________
*** CID 1428697:  Program hangs  (LOCK)
/external/bsd/bind/dist/lib/dns/rbtdb.c: 8050 in getsigningtime64()
8044     
8045     	result = ISC_R_SUCCESS;
8046     
8047      unlock:
8048     	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
8049     
>>>     CID 1428697:  Program hangs  (LOCK)
>>>     Returning without unlocking "rbtdb->node_locks[i].lock".
8050     	return (result);
8051     }
8052     
8053     static void
8054     resigned(dns_db_t *db, dns_rdataset_t *rdataset, dns_dbversion_t *version)
8055     {

** CID 1428696:  Program hangs  (ORDER_REVERSAL)
/external/bsd/bind/dist/lib/dns/zone.c: 18084 in setnsec3param()


________________________________________________________________________________________________________
*** CID 1428696:  Program hangs  (ORDER_REVERSAL)
/external/bsd/bind/dist/lib/dns/zone.c: 18084 in setnsec3param()
18078     	np = &npe->params;
18079     
18080     	dns_rdataset_init(&prdataset);
18081     	dns_rdataset_init(&nrdataset);
18082     	dns_diff_init(zone->mctx, &diff);
18083     
>>>     CID 1428696:  Program hangs  (ORDER_REVERSAL)
>>>     Calling "__libc_mutex_lock" acquires lock "dns_zone.dblock".
18084     	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
18085     	if (zone->db != NULL) {
18086     		dns_db_attach(zone->db, &db);
18087     		dns_db_currentversion(db, &oldver);
18088     		result = dns_db_newversion(db, &newver);
18089     		if (result != ISC_R_SUCCESS) {

** CID 1428695:  Memory - corruptions  (OVERRUN)
/tests/kernel/t_sysv.c: 396 in receiver()


________________________________________________________________________________________________________
*** CID 1428695:  Memory - corruptions  (OVERRUN)
/tests/kernel/t_sysv.c: 396 in receiver()
390     		err(1, "receiver: msgget");
391     
392     	for (loop = 0; loop < maxloop; loop++) {
393     		/*
394     		 * Receive the first message, print it, and send an ACK.
395     		 */
>>>     CID 1428695:  Memory - corruptions  (OVERRUN)
>>>     Overrunning struct type mymsg of 260 bytes by passing it to a function which accesses it at byte offset 263 using argument "256U". [Note: The source code implementation of the function has been overridden by a builtin model.]
396     		if (msgrcv(msqid, &m, MESSAGE_TEXT_LEN, MTYPE_1, 0) != MESSAGE_TEXT_LEN)
397     			err(1, "receiver: msgrcv 1");
398     
399     		printf("%s\n", m.mtext);
400     		if (strcmp(m.mtext, m1_str) != 0)
401     			err(1, "receiver: message 1 data isn't correct");

** CID 1428694:  Incorrect expression  (SIZEOF_MISMATCH)
/usr.sbin/sysinst/partman.c: 2745 in partman()


________________________________________________________________________________________________________
*** CID 1428694:  Incorrect expression  (SIZEOF_MISMATCH)
/usr.sbin/sysinst/partman.c: 2745 in partman()
2739     			remove_vnd_options();
2740     		else if (!(vnds = calloc(sizeof(*vnds), MAX_VND)))
2741     			have_vnd = 0;
2742     
2743     		if (!have_cgd)
2744     			remove_cgd_options();
>>>     CID 1428694:  Incorrect expression  (SIZEOF_MISMATCH)
>>>     Passing argument "4U" to function "calloc" that returns a pointer of type "cgds_t *" is suspicious because a multiple of "sizeof (cgds_t) /*72*/" is expected.
2745     		else if (!(cgds = calloc(sizeof(*vnds), MAX_CGD)))
2746     			have_cgd = 0;
2747     
2748     		if (!have_lvm)
2749     			remove_lvm_options();
2750     		else if (!(lvms = calloc(sizeof(*lvms), MAX_LVM_VG)))

** CID 1428693:  Program hangs  (ORDER_REVERSAL)
/external/bsd/bind/dist/lib/dns/zone.c: 17888 in keydone()


________________________________________________________________________________________________________
*** CID 1428693:  Program hangs  (ORDER_REVERSAL)
/external/bsd/bind/dist/lib/dns/zone.c: 17888 in keydone()
17882     
17883     	ENTER;
17884     
17885     	dns_rdataset_init(&rdataset);
17886     	dns_diff_init(zone->mctx, &diff);
17887     
>>>     CID 1428693:  Program hangs  (ORDER_REVERSAL)
>>>     Calling "__libc_mutex_lock" acquires lock "dns_zone.dblock".
17888     	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
17889     	if (zone->db != NULL) {
17890     		dns_db_attach(zone->db, &db);
17891     		dns_db_currentversion(db, &oldver);
17892     		result = dns_db_newversion(db, &newver);
17893     		if (result != ISC_R_SUCCESS) {

** CID 1428692:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 317 in atfu_msgrcv_truncate_body()


________________________________________________________________________________________________________
*** CID 1428692:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 317 in atfu_msgrcv_truncate_body()
311     	struct msgsmall msg2 = { MSG_MTYPE_1, { 'x', 'y' } };
312     	int id;
313     
314     	id = msgget(MSG_KEY, IPC_CREAT | 0600);
315     	ATF_REQUIRE(id != -1);
316     
>>>     CID 1428692:  Memory - corruptions  (OVERRUN)
>>>     Overrunning struct type msg of 8 bytes by passing it to a function which accesses it at byte offset 10 using argument "3U". [Note: The source code implementation of the function has been overridden by a builtin model.]
317     	(void)msgsnd(id, &msg1, MSG_LEN, IPC_NOWAIT);
318     	(void)msgrcv(id, &msg2, MSG_SMALLLEN,
319     	    MSG_MTYPE_1, IPC_NOWAIT | MSG_NOERROR);
320     
321     	ATF_CHECK(msg1.buf[0] == msg2.buf[0]);
322     	ATF_CHECK(msg1.buf[1] == msg2.buf[1]);

** CID 1428691:  Insecure data handling  (TAINTED_SCALAR)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 391 in _find_vg_rlocn()


________________________________________________________________________________________________________
*** CID 1428691:  Insecure data handling  (TAINTED_SCALAR)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 391 in _find_vg_rlocn()
385     	/* FIXME Loop through rlocns two-at-a-time.  List null-terminated. */
386     	/* FIXME Ignore if checksum incorrect!!! */
387     	if (!dev_read(dev_area->dev, dev_area->start + rlocn->offset,
388     		      sizeof(vgnamebuf), vgnamebuf))
389     		goto_bad;
390     
>>>     CID 1428691:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "vgnamebuf[len]" as an index to pointer "_ctype_tab_ + 1".
391     	if (!strncmp(vgnamebuf, vgname, len = strlen(vgname)) &&
392     	    (isspace(vgnamebuf[len]) || vgnamebuf[len] == '{')) {
393     		return rlocn;
394     	}
395     
396           bad:

** CID 1428690:  Insecure data handling  (TAINTED_SCALAR)


________________________________________________________________________________________________________
*** CID 1428690:  Insecure data handling  (TAINTED_SCALAR)
/external/gpl2/lvm2/dist/lib/format1/disk-rep.c: 399 in __read_disk()
393     
394     	if (!_read_lvs(dl)) {
395     		log_error("Failed to read LV's from %s", name);
396     		goto bad;
397     	}
398     
>>>     CID 1428690:  Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted variable "dl->pvd" to a tainted sink.
399     	if (!_read_extents(dl)) {
400     		log_error("Failed to read extents from %s", name);
401     		goto bad;
402     	}
403     
404     	log_very_verbose("Found %s in %sVG %s", name,

** CID 1428689:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 169 in atfu_msgrcv_err_body()


________________________________________________________________________________________________________
*** CID 1428689:  Memory - corruptions  (OVERRUN)
/tests/lib/libc/sys/t_msgrcv.c: 169 in atfu_msgrcv_err_body()
163     
164     	errno = 0;
165     
166     	ATF_REQUIRE_ERRNO(ENOMSG, msgrcv(id, &msg,
167     		MSG_LEN, MSG_MTYPE_1, IPC_NOWAIT) == -1);
168     
>>>     CID 1428689:  Memory - corruptions  (OVERRUN)
>>>     Overrunning struct type msg of 8 bytes by passing it to a function which accesses it at byte offset 10 using argument "3U". [Note: The source code implementation of the function has been overridden by a builtin model.]
169     	ATF_REQUIRE(msgsnd(id, &msg, MSG_LEN, IPC_NOWAIT) == 0);
170     
171     	errno = 0;
172     
173     	ATF_REQUIRE_ERRNO(EFAULT, msgrcv(id, (void *)-1,
174     		MSG_LEN, MSG_MTYPE_1, IPC_NOWAIT) == -1);

** CID 1428688:    (INTEGER_OVERFLOW)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 581 in _vg_write_raw()
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 599 in _vg_write_raw()


________________________________________________________________________________________________________
*** CID 1428688:    (INTEGER_OVERFLOW)
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 581 in _vg_write_raw()
575     
576     	log_debug("Writing %s metadata to %s at %" PRIu64 " len %" PRIu64,
577     		  vg->name, dev_name(mdac->area.dev), mdac->area.start +
578     		  mdac->rlocn.offset, mdac->rlocn.size - new_wrap);
579     
580     	/* Write text out, circularly */
>>>     CID 1428688:    (INTEGER_OVERFLOW)
>>>     Subtract operation overflows on operands "mdac->rlocn.size" and "new_wrap". Example values for operands: "mdac->rlocn.size" = 1194321920, "new_wrap" = 4702867459.
581     	if (!dev_write(mdac->area.dev, mdac->area.start + mdac->rlocn.offset,
582     		       (size_t) (mdac->rlocn.size - new_wrap),
583     		       fidtc->raw_metadata_buf))
584     		goto_out;
585     
586     	if (new_wrap) {
/external/gpl2/lvm2/dist/lib/format_text/format-text.c: 599 in _vg_write_raw()
593     			       (size_t) new_wrap,
594     			       fidtc->raw_metadata_buf +
595     			       mdac->rlocn.size - new_wrap))
596     			goto_out;
597     	}
598     
>>>     CID 1428688:    (INTEGER_OVERFLOW)
>>>     Subtract operation overflows on operands "mdac->rlocn.size" and "new_wrap". Example values for operands: "mdac->rlocn.size" = 2218785304, "new_wrap" = 4294967296.
599     	mdac->rlocn.checksum = calc_crc(INITIAL_CRC, fidtc->raw_metadata_buf,
600     					(uint32_t) (mdac->rlocn.size -
601     						    new_wrap));
602     	if (new_wrap)
603     		mdac->rlocn.checksum = calc_crc(mdac->rlocn.checksum,
604     						fidtc->raw_metadata_buf +

** CID 1428687:  Memory - corruptions  (OVERRUN)
/tests/kernel/t_sysv.c: 286 in atfu_msg_body()


________________________________________________________________________________________________________
*** CID 1428687:  Memory - corruptions  (OVERRUN)
/tests/kernel/t_sysv.c: 286 in atfu_msg_body()
280     	for (loop = 0; loop < maxloop; loop++) {
281     		/*
282     		 * Send the first message to the receiver and wait for the ACK.
283     		 */
284     		m.mtype = MTYPE_1;
285     		strcpy(m.mtext, m1_str);
>>>     CID 1428687:  Memory - corruptions  (OVERRUN)
>>>     Overrunning struct type mymsg of 260 bytes by passing it to a function which accesses it at byte offset 263 using argument "256U". [Note: The source code implementation of the function has been overridden by a builtin model.]
286     		ATF_REQUIRE_MSG(msgsnd(sender_msqid, &m, MESSAGE_TEXT_LEN,
287     		    0) != -1, "sender: msgsnd 1: %d", errno);
288     
289     		ATF_REQUIRE_MSG(msgrcv(sender_msqid, &m, MESSAGE_TEXT_LEN,
290     				       MTYPE_1_ACK, 0) == MESSAGE_TEXT_LEN,
291     		    "sender: msgrcv 1 ack: %d", errno);

** CID 1428686:  Error handling issues  (CHECKED_RETURN)
/external/gpl3/binutils/dist/bfd/elflink.c: 11170 in bfd_elf_final_link()


________________________________________________________________________________________________________
*** CID 1428686:  Error handling issues  (CHECKED_RETURN)
/external/gpl3/binutils/dist/bfd/elflink.c: 11170 in bfd_elf_final_link()
11164     	      input_section->flags &= ~SEC_HAS_CONTENTS;
11165     	    }
11166     
11167     	  attr_size = bfd_elf_obj_attr_size (abfd);
11168     	  if (attr_size)
11169     	    {
>>>     CID 1428686:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "bfd_set_section_size" without checking return value (as is done elsewhere 12 out of 15 times).
11170     	      bfd_set_section_size (abfd, o, attr_size);
11171     	      attr_section = o;
11172     	      /* Skip this section later on.  */
11173     	      o->map_head.link_order = NULL;
11174     	    }
11175     	  else


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRb2JZfDAOAZcqzsy8LMBKBjZiXDg7WCnKqBB1q-2FtZ4dvE2p1AmNMmYII14NbCr9wIc-3D_XWm3CUIFU8ffmjzuNhQ8cIHoQgXzXkm61Fmjr59D05UW3gU5dcYqcVMkkkVjQh1NEXz8cEAx6vZ4vs4QeaVG5jR-2B-2FEkkOPPpHcxv8TQRZTOkrcoHxEmJfj8r5Y04nxQcE9XaKJL2XQuB1TOpwy63UBQF3SMyv-2BbvZV1pq7Sc2sKylRyx3Au0zavfidlTKTOATa-2FtkLNoD8lx4CwOPNogiwXqGj8Ziurz-2BKyD0EgtA4A-3D

To manage Coverity Scan email notifications for "coverity-updates%netbsd.org@localhost", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4m7U7Yoel-2F6MYPxol7ToiLwYIjoNbVQOCAwEeTNJofEDwTlN0JRhKMyijhpnAObR-2FlLVG-2Fr3EBKWgiICNdX1HPA6Ws0-2F1wHBf2tG9AnMDB8g-3D_XWm3CUIFU8ffmjzuNhQ8cIHoQgXzXkm61Fmjr59D05UW3gU5dcYqcVMkkkVjQh1NEXz8cEAx6vZ4vs4QeaVG5sRjDhAyiwxEHxqPSW15LtiWtvPy5Yo4BzK6JsVMf-2B4Wkg3V9jh94euZfO7QfwPol34BfX1cYsJayerl32-2FLfavWdNZo1x-2BUNFTK3Kft02OvnvAvf01aojNEZUNvnObNR3nZtj9q8CoT0Ytate6YPVA-3D



Home | Main Index | Thread Index | Old Index