search

nasa / osal

The Core Flight System (cFS) Operating System Abstraction Layer (OSAL)
Apache License 2.0
557 stars 218 forks source link

Static analysis issues JSC 2.1 #1458

Closed chillfig closed 4 months ago

chillfig commented 7 months ago

Describe the bug Handful of static analysis issues. This report records the findings from the static analysis to facilitate their tracking.

To Reproduce N/A. These issues were communicated by JSC.

<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">

Source Folder Source Filename Source Line Source Object Disposition
Integer Overflow        
\osal\src\os\inc osapi-clock.h 218 tm Will Not Fix. Overflow is not considered a concern because tm would need to be over 29,227 years in microseconds.
Memset Bound Checking        
\osal\src\os\shared\src\osapi-condvar.c 69 memset   Will Not Fix. Using memset as sizeof(OS_condvar_table) ensures correct array size.
\osal\src\os\shared\src\osapi-condvar.c 294 memset   Will Not Fix. Using memset as sizeof(OS_condvar_prop_t) ensures correct array size.
Replace strlen with strnlen \osal\src\os\shared\src\osapi-condvar.c 301 strncpy   Will Fix. osal PR# 1465
Unchecked return value on Function/Truncation of Data Risk        
\osal\src\os\shared\src\osapi-errors.c 113 snprintf   Will Not Fix. No need to check snprintf return; OS_STATUS_STRING_LENGTH (12) is ample for all status values

Expected behavior Need to resolve these. Should resolve and/or disposition the higher ranked ones at minimum.

Code snips N/A

System observed on: N/A

Additional context N/A

Reporter Info Imported from JSC 2.1 static analysis