korg/bluez
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/bluetooth/bluez.git synced 2024-11-27 06:04:32 +08:00
Code Issues Packages Projects Releases Wiki Activity

emulator: Fix integer truncation warnings

Browse Source 
Error: INTEGER_OVERFLOW (CWE-190): [#def1] [important]
emulator/amp.c:693:2: cast_overflow: Truncation due to cast operation on "(remain_assoc_len > 248) ? 248 : remain_assoc_len" from 32 to 16 bits.
emulator/amp.c:693:2: overflow_assign: "fragment_len" is assigned from "(remain_assoc_len > 248) ? 248 : remain_assoc_len".
emulator/amp.c:698:2: overflow_sink: "fragment_len", which might have overflowed, is passed to "memcpy(rsp.assoc_fragment, amp->local_assoc + len_so_far, fragment_len)". [Note: The source code implementation of the function has been overridden by a builtin model.]
696|	rsp.phy_handle = cmd->phy_handle;
697|	rsp.remain_assoc_len = cpu_to_le16(remain_assoc_len);
698|->	memcpy(rsp.assoc_fragment, amp->local_assoc + len_so_far,
699|							fragment_len);
700|

Error: INTEGER_OVERFLOW (CWE-190): [#def2] [important]
emulator/amp.c:701:2: cast_overflow: Truncation due to cast operation on "4 + fragment_len" from 32 to 8 bits.
emulator/amp.c:701:2: overflow_sink: "4 + fragment_len", which might have overflowed, is passed to "cmd_complete(amp, 5130, &rsp, 4 + fragment_len)".
699|							fragment_len);
700|
701|->	cmd_complete(amp, BT_HCI_CMD_READ_LOCAL_AMP_ASSOC,
702|						&rsp, 4 + fragment_len);
703|   }

Error: INTEGER_OVERFLOW (CWE-190): [#def4] [important]
emulator/bthost.c:3309:3: cast_overflow: Truncation due to cast operation on "len - offset" from 32 to 8 bits.
emulator/bthost.c:3309:3: overflow_assign: "cp->data_len" is assigned from "len - offset".
emulator/bthost.c:3317:2: overflow_sink: "cp->data_len", which might have overflowed, is passed to "memcpy(cp->data, data + offset, cp->data_len)". [Note: The source code implementation of the function has been overridden by a builtin model.]
3315|		}
3316|
3317|->		memcpy(cp->data, data + offset, cp->data_len);
3318|
3319|		send_command(bthost, BT_HCI_CMD_LE_SET_PA_DATA, buf,
This commit is contained in:
Bastien Nocera 2024-07-05 10:57:35 +02:00 committed by Luiz Augusto von Dentz
parent 0b52ecca60
commit 1d73dc6a1a
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
emulator/amp.c
View File

@ -680,7 +680,8 @@ static void cmd_read_local_amp_assoc(struct bt_amp *amp,
{
const struct bt_hci_cmd_read_local_amp_assoc *cmd = data;
struct bt_hci_rsp_read_local_amp_assoc rsp;
uint16_t len_so_far, remain_assoc_len, fragment_len;
uint16_t len_so_far, remain_assoc_len;
size_t fragment_len;
if (cmd->phy_handle != amp->phy_handle) {
cmd_status(amp, BT_HCI_ERR_INVALID_PARAMETERS,

8
emulator/bthost.c
View File

@ -3290,6 +3290,7 @@ static void set_pa_data(struct bthost *bthost, const uint8_t *data,
{
struct bt_hci_cmd_le_set_pa_data *cp;
uint8_t buf[sizeof(*cp) + BT_PA_MAX_DATA_LEN];
size_t data_len;
cp = (void *)buf;
@ -3299,14 +3300,14 @@ static void set_pa_data(struct bthost *bthost, const uint8_t *data,
cp->handle = 1;
if (len - offset > BT_PA_MAX_DATA_LEN) {
cp->data_len = BT_PA_MAX_DATA_LEN;
data_len = BT_PA_MAX_DATA_LEN;
if (!offset)
cp->operation = 0x01;
else
cp->operation = 0x00;
} else {
cp->data_len = len - offset;
data_len = len - offset;
if (!offset)
cp->operation = 0x03;
@ -3314,7 +3315,8 @@ static void set_pa_data(struct bthost *bthost, const uint8_t *data,
cp->operation = 0x02;
}
memcpy(cp->data, data + offset, cp->data_len);
memcpy(cp->data, data + offset, data_len);
cp->data_len = data_len;
send_command(bthost, BT_HCI_CMD_LE_SET_PA_DATA, buf,
sizeof(*cp) + cp->data_len);