zephyrproject-rtos / zephyr

Primary Git Repository for the Zephyr Project. Zephyr is a new generation, scalable, optimized, secure RTOS for multiple hardware architectures.
https://docs.zephyrproject.org
Apache License 2.0
10.96k stars 6.67k forks source link

[Coverity CID :208201] Out-of-bounds write in soc/xtensa/intel_apl_adsp/soc.c #22648

Closed zephyrbot closed 4 years ago

zephyrbot commented 4 years ago

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/e089906b339aad4cd1b6589a3b6ce94782d93f54/soc/xtensa/intel_apl_adsp/soc.c#L186

Category: Memory - corruptions Function: z_soc_irq_connect_dynamic Component: Other CID: 208201

Details:

179             ret = -EINVAL;
180             goto irq_connect_out;
181         }
182    
183         table_idx += cavs_irq;
184    
>>>     CID 208201:    (OVERRUN)
>>>     Overrunning array "_sw_isr_table" of 32 8-byte elements at element index 54 (byte offset 439) using index "table_idx" (which evaluates to 54).
185         _sw_isr_table[table_idx].arg = parameter;
186         _sw_isr_table[table_idx].isr = routine;
187    
188     irq_connect_out:
189         return ret;
190     }
180             goto irq_connect_out;
181         }
182    
183         table_idx += cavs_irq;
184    
185         _sw_isr_table[table_idx].arg = parameter;
>>>     CID 208201:    (OVERRUN)
>>>     Overrunning array "_sw_isr_table" of 32 8-byte elements at element index 54 (byte offset 439) using index "table_idx" (which evaluates to 54).
186         _sw_isr_table[table_idx].isr = routine;
187    
188     irq_connect_out:
189         return ret;
190     }
191     #endif

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v32951/p12996.

Note: This issue was created automatically. Priority was set based on classification of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

dcpleung commented 4 years ago

Size of _sw_isr_table[] depends on CONFIG_NUM_IRQS which is defined in include/arch/xtensa/irq.h. In this case, CONFIG_NUM_IRQS=149 which means _sw_isr_tables[] has 149 entries. No idea where Coverity got number 32.