Closed ColinIanKing closed 5 years ago
Hi Colin,
Thanks for highlighting.
This particular issue has been detected in the past and I believe this is a false positive.
Since both i and j will be in the range 0-3, the wrap_pos()
function will ensure wrap_pos(i+j)*4+j
will always evaluate to a value between 0 and 15.
Regards, Marcel
Closing this issue. Feel free to reopen again if necessary.
Regards, Marcel
Static analysis on function shift_rows() in source no-aesni/aesni_emu.c has found a potential out-of-bounds read on an array. The full coverity scan static analysis report is below:
251 static void shift_rows(union xmm_reg dst, const union xmm_reg src) 252 { 253 / cyclic shift last 3 rows of the input / 254 int j; 255 union xmm_reg tmp = src; 256 257 / bytes to matrix: 258 0 1 2 3 < columns (i) 259 ----------+ 260 0 4 8 C | 0 < rows (j) 261 1 5 9 D | 1 262 2 6 A E | 2 263 3 7 B F | 3 264 265 THIS IS THE KEY: progressively move elements to HIGHER 266 numbered columnar values within a row. 267 268 Each dword is a column with the MSB as the bottom element 269 i is the column index, selects the dword 270 j is the row index, 271 we shift row zero by zero, row 1 by 1 and row 2 by 2 and 272 row 3 by 3, cyclically */
273 for (j = 0; j < MAX_DWORDS_PER_XMM; j++) { 274 int i; 275
276 for (i = 0; i < MAX_DWORDS_PER_XMM; i++)
277 dst->byte[i4+j] = tmp.byte[wrap_pos(i+j)4+j];