New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware - TF-A

5 Oct 2020


      Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
3 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)
** CID 362943:  Insecure data handling  (TAINTED_SCALAR)
________________________________________________________________________________________________________
*** CID 362943:  Insecure data handling  (TAINTED_SCALAR)
/common/fdt_fixup.c: 437 in fdt_adjust_gic_redist()
431     
432     	/*
433     	 * The redistributor is described in the second "reg" entry.
434     	 * So we have to skip one address and one size cell, then another
435     	 * address cell to get to the second size cell.
436     	 */
...
...
...
CID 362943:  Insecure data handling  (TAINTED_SCALAR)
Passing tainted variable "sc * 4" to a tainted sink.

437     	return fdt_setprop_inplace_namelen_partial(dtb, offset, "reg", 3,
438     						   (ac + sc + ac) * 4,
439     						   val, sc * 4);
** CID 362942:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/common/fdt_fixup.c: 428 in fdt_adjust_gic_redist()
________________________________________________________________________________________________________
*** CID 362942:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/common/fdt_fixup.c: 428 in fdt_adjust_gic_redist()
422     	}
423     
424     	if (sc == 1) {
425     		redist_size_32 = cpu_to_fdt32(nr_cores * gicr_frame_size);
426     		val = &redist_size_32;
427     	} else {
...
...
...
CID 362942:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
Potentially overflowing expression "nr_cores * gicr_frame_size" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "uint64_t" (64 bits, unsigned).

428     		redist_size_64 = cpu_to_fdt64(nr_cores * gicr_frame_size);
429     		val = &redist_size_64;
430     	}
431     
432     	/*
433     	 * The redistributor is described in the second "reg" entry.
** CID 362941:  Integer handling issues  (BAD_SHIFT)
/mbedtls/library/bignum.c: 1713 in mbedtls_int_div_int()
________________________________________________________________________________________________________
*** CID 362941:  Integer handling issues  (BAD_SHIFT)
/mbedtls/library/bignum.c: 1713 in mbedtls_int_div_int()
1707          * Normalize the divisor, d, and dividend, u0, u1
1708          */
1709         s = mbedtls_clz( d );
1710         d = d << s;
1711     
1712         u1 = u1 << s;
...
...
...
CID 362941:  Integer handling issues  (BAD_SHIFT)
In expression "u0 >> 64UL - s", right shifting by more than 63 bits has undefined behavior.  The shift amount, "64UL - s", is 64.

1713         u1 |= ( u0 >> ( biL - s ) ) & ( -(mbedtls_mpi_sint)s >> ( biL - 1 ) );
1714         u0 =  u0 << s;
1715     
1716         d1 = d >> biH;
1717         d0 = d & uint_halfword_mask;
1718
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0...