Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Coverity CID: 220426] Out-of-bounds access in tests/lib/c_lib/src/main.c #33810

Closed
zephyrbot opened this issue Mar 29, 2021 · 0 comments · Fixed by #34889
Closed

[Coverity CID: 220426] Out-of-bounds access in tests/lib/c_lib/src/main.c #33810

zephyrbot opened this issue Mar 29, 2021 · 0 comments · Fixed by #34889
Assignees
Labels
bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug
Milestone

Comments

@zephyrbot
Copy link
Collaborator

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/169144afa1826511ee6ec3f53d590b2c0d39d3d4/tests/lib/c_lib/src/main.c#L536

Category: Memory - corruptions
Function: test_memstr
Component: Tests
CID: 220426

Details:

memcpy(&arr[i], num, 0);

530         zassert_is_null(memchr(str, 'a', 0), "memchr 0 error");
531         zassert_not_null(memchr(str, 'e', 10), "memchr serach e");
532         zassert_is_null(memchr(str, 'e', 1), "memchr e error");
533    
534         for (i = 0; i < 20; i++) {
535             for (j = 0; j < 20; j++) {
>>>     CID 220426:  Memory - corruptions  (OVERRUN)
>>>     Calling "memcpy" with "&arr[i]" and "0U" is suspicious because the function call may access "arr" at byte "i + 18446744073709551615U". [Note: The source code implementation of the function has been overridden by a builtin model.]
536                 memcpy(&arr[i], num, 0);
537                 ret = memcmp(&num[j], &arr[i], 0);
538                 zassert_true((ret == 0), "memcpy failed");
539                 memcpy(&arr[i], &num[j], 1);
540                 ret = memcmp(&num[j], &arr[i], 1);
541                 zassert_true((ret == 0), "memcpy failed");

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v29271/p12996

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

@zephyrbot zephyrbot added bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug labels Mar 29, 2021
@nashif nashif assigned xiaofst and unassigned nashif Mar 29, 2021
@enjiamai enjiamai assigned enjiamai and unassigned xiaofst Apr 3, 2021
@enjiamai enjiamai assigned yingmingx and unassigned enjiamai Apr 21, 2021
yingmingx pushed a commit to yingmingx/zephyr that referenced this issue May 10, 2021
1. Refine some testcases for testing some libc functions, include
strlen(),strcmp(),strncmp(),memcmp(),memstr(),memcpy(),memmove()
strtol(),strtoul().
2. Change some code to make the code style consistent.

Fixes zephyrproject-rtos#33794
Fixes zephyrproject-rtos#33810
Fixes zephyrproject-rtos#33806

Signed-off-by: Ying ming <mingx.ying@intel.com>
@galak galak added this to the v2.6.0 milestone May 11, 2021
nashif pushed a commit that referenced this issue May 12, 2021
1. Refine some testcases for testing some libc functions, include
strlen(),strcmp(),strncmp(),memcmp(),memstr(),memcpy(),memmove()
strtol(),strtoul().
2. Change some code to make the code style consistent.

Fixes #33794
Fixes #33810
Fixes #33806

Signed-off-by: Ying ming <mingx.ying@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

6 participants