search

zephyriot / zephyr-issues

0 stars 0 forks source link

Static code scan (coverity) issues seen #2297

Open nashif opened 7 years ago

nashif commented 7 years ago

Reported by Shilpashree L C:

As per the Coverity scan analyses on Aug 03,2017, there were some potential defects that were found in /subsys/bluetooth/ file has mentioned below. Please fix or provide comments to square it off in coverity : https://scan9.coverity.com/reports.htm#v31655/p12996

||CID|| ||Type|| ||Category|| ||File|| ||Function|| |170741| |Out-of-bounds access| |Memory - corruptions| |/subsys/bluetooth/host/gatt.c| |bt_gatt_service_register| |173651| |Dereference null return value| |Null pointer dereferences| |/subsys/bluetooth/host/mesh/access.c| |bt_mesh_model_send| |173631| |Dereference null return value| |Null pointer dereferences| |/subsys/bluetooth/host/mesh/cfg.c| |hb_send| |173644| |Wrong sizeof argument| |Incorrect expression| |/subsys/bluetooth/host/mesh/health.c| |health_get_current| |171562| |Side effect in assertion| |Incorrect expression| |/subsys/bluetooth/controller/ll_sw/ctrl.c| |role_disable| |171563| |Same on both sides| |Incorrect expression| |/subsys/bluetooth/controller/ticker/ticker.c| |ticker_job_insert|

(Imported from Jira ZEP-2466)

nashif commented 7 years ago

by Johan Hedberg:

170741 is a false positive (someone else need to update coverity since I've apparently lost write access there)

nashif commented 7 years ago

by Johan Hedberg:

173631 is also a false positive (validity of hb_pub.net_idx is checked before assigning to it, i.e. calling bt_mesh_subnet_get on it is guaranteed to succeed)

nashif commented 7 years ago

by Johan Hedberg:

173651 is also a false positive (same kind of issue as 173631)

nashif commented 7 years ago

by Johan Hedberg:

173644 was already fixed in the upstream master branch

nashif commented 7 years ago

by Johan Hedberg:

The remaining ones are Bluetooth controller issues, so I'll reassign this to the correct persons

nashif commented 7 years ago

by Carles Cufi:

Vinayak Kariappa Chettimada the last 2 rows in the table are in code written by you, can you take a look?

nashif commented 7 years ago

by Shilpashree L C:

173631 171563 171562 are still shown in latest coverity scan as of Aug 29, 2017.

nashif commented 7 years ago

by Johan Hedberg:

I already mentioned earlier in my comment that 173631 is a false positive, however no one marked it as such in coverity. I didn't have write permissions to coverity back then, but now I do, so I've marked it appropriately there. For the other two I'll let Vinayak Kariappa Chettimada answer.

nashif commented 7 years ago

by Carles Cufi:

Vinayak Kariappa Chettimada can you take a look at the controller issues please?

nashif commented 7 years ago

by Vinayak Kariappa Chettimada:

171562, is intentional. But I do not have the rights to update in Coverity. 171563, Fixed and sent PR #1337 (https://github.com/zephyrproject-rtos/zephyr/pull/1337)