Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Coverity CID :215261] Explicit null dereferenced in subsys/emul/emul_bmi160.c #29703

Closed
zephyrbot opened this issue Nov 2, 2020 · 1 comment · Fixed by #29799
Closed

[Coverity CID :215261] Explicit null dereferenced in subsys/emul/emul_bmi160.c #29703

zephyrbot opened this issue Nov 2, 2020 · 1 comment · Fixed by #29799
Assignees
Labels
bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug

Comments

@zephyrbot
Copy link
Collaborator

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/c9a2a5e7fb0194bfb168f5aa1a0a83c73f62acb3/subsys/emul/emul_bmi160.c#L213

Category: Null pointer dereferences
Function: bmi160_emul_io_spi
Component: Other
CID: 215261

Details:

199                 regn = *(uint8_t *)tx->buf;
200                 switch (txd->len) {
201                 case 1:
202                     if (regn & BMI160_REG_READ) {
203                         regn &= BMI160_REG_MASK;
204                         val = reg_read(cfg, regn);
>>>     CID 215261:    (FORWARD_NULL)
>>>     Dereferencing null pointer "rxd".
205                         *(uint8_t *)rxd->buf = val;
206                     } else {
207                         val = *(uint8_t *)txd->buf;
208                         reg_write(cfg, regn, val);
209                     }
210                     break;
207                         val = *(uint8_t *)txd->buf;
208                         reg_write(cfg, regn, val);
209                     }
210                     break;
211                 case BMI160_SAMPLE_SIZE:
212                     if (regn & BMI160_REG_READ) {
>>>     CID 215261:    (FORWARD_NULL)
>>>     Dereferencing null pointer "rxd".
213                         sample_read(data, rxd->buf);
214                     } else {
215                         LOG_INF("Unknown sample write");
216                     }
217                     break;
218                 default:

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v32951/p12996.

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

@zephyrbot zephyrbot added bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug labels Nov 2, 2020
sjg20 added a commit to sjg20/zephyr that referenced this issue Nov 4, 2020
If a read is requested without a read buffer, the emulator currently
crashes. Fix this by adding a check.

Fixes: zephyrproject-rtos#29703
Fixes: zephyrproject-rtos#29702
Fixes: zephyrproject-rtos#29017
Fixes: zephyrproject-rtos#29016

Signed-off-by: Simon Glass <[email protected]>
@sjg20
Copy link
Collaborator

sjg20 commented Nov 4, 2020

#29799

MaureenHelm pushed a commit that referenced this issue Nov 19, 2020
If a read is requested without a read buffer, the emulator currently
crashes. Fix this by adding a check.

Fixes: #29703
Fixes: #29702
Fixes: #29017
Fixes: #29016

Signed-off-by: Simon Glass <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants