New Defects reported by Coverity Scan for batctl - linux-merge - lists.open-mesh.org

20 Apr 2015


      Hi,
Please find the latest report on new defect(s) introduced to batctl found with Coverity Scan.
2 new defect(s) introduced to batctl found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 2 of 2 defect(s)
** CID 109676:  Insecure data handling  (TAINTED_SCALAR)
/tcpdump.c: 176 in batctl_tvlv_parse_tt_v1()
________________________________________________________________________________________________________
*** CID 109676:  Insecure data handling  (TAINTED_SCALAR)
/tcpdump.c: 176 in batctl_tvlv_parse_tt_v1()
170     
171     	printf("\tTVLV TTv1: %s [%c] ttvn=%hhu vlan_num=%hu entry_num=%hu\n",
172     	       type, tvlv->flags & BATADV_TT_FULL_TABLE ? 'F' : '.',
173     	       tvlv->ttvn, num_vlan, num_entry);
174     
175     	vlan = (struct batadv_tvlv_tt_vlan_data *)(tvlv + 1);
...
...
...
CID 109676:  Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "num_vlan" as a loop boundary.

176     	for (i = 0; i < num_vlan; i++) {
177     		printf("\t\tVLAN ID %hd, crc %#.8x\n",
178     		       BATADV_PRINT_VID(ntohs(vlan->vid)),
179     		       ntohl(vlan->crc));
180     		vlan++;
181     	}
** CID 109675:  Insecure data handling  (TAINTED_SCALAR)
/tcpdump.c: 286 in dump_batman_ucast_tvlv()
________________________________________________________________________________________________________
*** CID 109675:  Insecure data handling  (TAINTED_SCALAR)
/tcpdump.c: 286 in dump_batman_ucast_tvlv()
280     	       get_name_by_macaddr(dst, read_opt),
281     	       buff_len - sizeof(struct ether_header), tvlv_len,
282     	       tvlv_packet->ttl);
283     
284     	ptr = (uint8_t *)(tvlv_packet + 1);
285
...
...
...
CID 109675:  Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "tvlv_len" as a loop boundary.

286     	while (tvlv_len >= (ssize_t)sizeof(*tvlv_hdr)) {
287     		tvlv_hdr = (struct batadv_tvlv_hdr *)ptr;
288     
289     		/* data after TVLV header */
290     		ptr = (uint8_t *)(tvlv_hdr + 1);
291     		tvlv_len -= sizeof(*tvlv_hdr);
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/2297?tab=overview
To manage Coverity Scan email notifications for "linux-merge@lists.open-mesh.org", click https://scan.coverity.com/subscriptions/edit?email=linux-merge%40lists.open-... .