New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware - TF-A

20 Sep 2026


      Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
5 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 5 of 5 defect(s)
** CID 506049:       Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568           in parse_pcrs_find()
_____________________________________________________________________________________________
*** CID 506049:         Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568             in parse_pcrs_find()
562     	if (ret != TPM_SUCCESS) {
563     		return ret;
564     	}
565     
566     	iter_read_u32_be(&iter, &count);
567
...
...
...
CID 506049:         Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "count" as a loop boundary.

568     	for (uint32_t i = 0U; i < count; i++) {
569     		iter_read_u16_be(&iter, &hash_id);
570     		iter_read_u8(&iter, &sizeof_select);
571     		if (iter.error_state != TPM_SUCCESS) {
572     			return iter.error_state;
573     		}
** CID 506048:       Memory - corruptions  (OVERRUN)
_____________________________________________________________________________________________
*** CID 506048:         Memory - corruptions  (OVERRUN)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 1071             in tpm_has_alg()
1065     	}
1066     
1067     	item[0].alg_id = alg_id;
1068     	item[0].enabled = false;
1069     	item[1].alg_id = TPM_ALG_NULL;
1070     	item[1].enabled = false;
...
...
...
CID 506048:         Memory - corruptions  (OVERRUN)
Overrunning array "item" of 2 4-byte elements by passing it to a function which accesses it at element index 63 (byte offset 255).

1071     	ret = tpm_getcap_query_algs(chip, item);
1072     	if (ret != TPM_SUCCESS) {
1073     		return ret;
1074     	}
1075     
1076     	*out_supported = item[0].enabled;
** CID 506047:       Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444           in parse_algs_find()
_____________________________________________________________________________________________
*** CID 506047:         Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444             in parse_algs_find()
438     	if (ret != TPM_SUCCESS) {
439     		return ret;
440     	}
441     
442     	iter_read_u32_be(&iter, &count);
443
...
...
...
CID 506047:         Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "count" as a loop boundary.

444     	for (uint32_t i = 0U; i < count; i++) {
445     		iter_read_u16_be(&iter, &alg);
446     		iter_read_u32_be(&iter, &props);
447     		if (iter.error_state != TPM_SUCCESS) {
448     			return iter.error_state;
449     		}
** CID 506046:       Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386           in parse_algs()
_____________________________________________________________________________________________
*** CID 506046:         Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386             in parse_algs()
380     	if (ret != TPM_SUCCESS) {
381     		return ret;
382     	}
383     
384     	iter_read_u32_be(&iter, &count);
385
...
...
...
CID 506046:         Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "count" as a loop boundary.

386     	for (uint32_t i = 0U; i < count; i++) {
387     		iter_read_u16_be(&iter, &alg);
388     		iter_read_u32_be(&iter, &properties);
389     		if (iter.error_state != TPM_SUCCESS) {
390     			return iter.error_state;
391     		}
** CID 506045:       Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498           in parse_pcrs()
_____________________________________________________________________________________________
*** CID 506045:         Insecure data handling  (TAINTED_SCALAR)
/home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498             in parse_pcrs()
492     	if (ret != TPM_SUCCESS) {
493     		return ret;
494     	}
495     
496     	iter_read_u32_be(&iter, &count);
497
...
...
...
CID 506045:         Insecure data handling  (TAINTED_SCALAR)
Using tainted variable "count" as a loop boundary.

498     	for (uint32_t i = 0U; i < count; i++) {
499     		iter_read_u16_be(&iter, &hash);
500     		iter_read_u8(&iter, &sizeof_select);
501     		if (iter.error_state != TPM_SUCCESS) {
502     			return iter.error_state;
503     		}
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/arm-software-arm-trusted-firmware?tab=ove...