Hi,

Please find the latest report on new defect(s) introduced to coreboot found 
with Coverity Scan.

29 new defect(s) introduced to coreboot found with Coverity Scan.
28 defect(s), reported by Coverity Scan earlier, were marked fixed in the 
recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 29 defect(s)


** CID 1385126:    (UNUSED_VALUE)
/src/mainboard/asus/am1i-a/romstage.c: 148 in board_BeforeAgesa()
/src/mainboard/asus/am1i-a/romstage.c: 154 in board_BeforeAgesa()


________________________________________________________________________________________________________
*** CID 1385126:    (UNUSED_VALUE)
/src/mainboard/asus/am1i-a/romstage.c: 148 in board_BeforeAgesa()
142             /* Enable the AcpiMmio space */
143             outb(0x24, 0xcd6);
144             outb(0x1, 0xcd7);
145     
146             /* Configure ClkDrvStr1 settings */
147             addr32 = (u32 *)0xfed80e24;
>>>     CID 1385126:    (UNUSED_VALUE)
>>>     Assigning value from "*addr32" to "t32" here, but that stored value is 
>>> overwritten before it can be used.
148             t32 = *addr32;
149             t32 = 0x030800aa;
150             *addr32 = t32;
151     
152             /* Configure MiscClkCntl1 settings */
153             addr32 = (u32 *)0xfed80e40;
/src/mainboard/asus/am1i-a/romstage.c: 154 in board_BeforeAgesa()
148             t32 = *addr32;
149             t32 = 0x030800aa;
150             *addr32 = t32;
151     
152             /* Configure MiscClkCntl1 settings */
153             addr32 = (u32 *)0xfed80e40;
>>>     CID 1385126:    (UNUSED_VALUE)
>>>     Assigning value from "*addr32" to "t32" here, but that stored value is 
>>> overwritten before it can be used.
154             t32 = *addr32;
155             t32 = 0x000c4050;
156             *addr32 = t32;
157     
158             /* enable SIO LPC decode */
159             dev = PCI_DEV(0, 0x14, 3);

** CID 1383919:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/partitioned_file.c: 201 in partitioned_file_reopen()


________________________________________________________________________________________________________
*** CID 1383919:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/partitioned_file.c: 201 in partitioned_file_reopen()
195             }
196     
197             const struct fmap_area *fmap_fmap_entry =
198                                     fmap_find_area(file->fmap, 
SECTION_NAME_FMAP);
199     
200             if (!fmap_fmap_entry)
>>>     CID 1383919:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "file" going out of scope leaks the storage it points to.
201                     return NULL;
202     
203             if ((long)fmap_fmap_entry->offset != fmap_region_offset) {
204                     ERROR("FMAP's '%s' section doesn't point back to FMAP 
start (did something corrupt this file?)\n",
205                                                             
SECTION_NAME_FMAP);
206                     partitioned_file_close(file);

** CID 1361275:    (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 839 in parse_subpart_dir()


________________________________________________________________________________________________________
*** CID 1361275:    (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 832 in parse_subpart_dir()
826             memcpy(hdr.name, data + offset, sizeof(hdr.name));
827             offset += sizeof(hdr.name);
828     
829             validate_subpart_dir_without_checksum((struct subpart_dir 
*)&hdr, name);
830     
831             assert(size > subpart_dir_size(&hdr));
>>>     CID 1361275:    (TAINTED_SCALAR)
>>>     Passing tainted variable "subpart_dir_size(&hdr)" to a tainted sink.
832             alloc_buffer(subpart_dir_buf, subpart_dir_size(&hdr), "Subpart 
Dir");
833             memcpy(buffer_get(subpart_dir_buf), &hdr, 
SUBPART_DIR_HEADER_SIZE);
834     
835             /* Read Subpart Dir entries. */
836             struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf);
837             struct subpart_dir_entry *e = &subpart_dir->e[0];
/util/cbfstool/ifwitool.c: 839 in parse_subpart_dir()
833             memcpy(buffer_get(subpart_dir_buf), &hdr, 
SUBPART_DIR_HEADER_SIZE);
834     
835             /* Read Subpart Dir entries. */
836             struct subpart_dir *subpart_dir = buffer_get(subpart_dir_buf);
837             struct subpart_dir_entry *e = &subpart_dir->e[0];
838             uint32_t i;
>>>     CID 1361275:    (TAINTED_SCALAR)
>>>     Using tainted variable "hdr.num_entries" as a loop boundary.
839             for (i = 0; i < hdr.num_entries; i++) {
840                     memcpy(e[i].name, data + offset, sizeof(e[i].name));
841                     offset += sizeof(e[i].name);
842                     offset = read_member(data, offset, sizeof(e[i].offset),
843                                          &e[i].offset);
844                     offset = read_member(data, offset, sizeof(e[i].length),

** CID 1361274:  Insecure data handling  (TAINTED_SCALAR)


________________________________________________________________________________________________________
*** CID 1361274:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/ifwitool.c: 718 in alloc_bpdt_buffer()
712     {
713             struct bpdt_header bpdt_header;
714             assert((offset + BPDT_HEADER_SIZE) < size);
715             bpdt_read_header((uint8_t *)data + offset, &bpdt_header, name);
716     
717             /* Buffer to read BPDT header and entries. */
>>>     CID 1361274:  Insecure data handling  (TAINTED_SCALAR)
>>>     Passing tainted variable "get_bpdt_size(&bpdt_header)" to a tainted 
>>> sink.
718             alloc_buffer(b, get_bpdt_size(&bpdt_header), name);
719     
720             struct bpdt *bpdt = buffer_get(b);
721             memcpy(&bpdt->h, &bpdt_header, BPDT_HEADER_SIZE);
722     
723             /*

** CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/util/cbfstool/ifwitool.c: 1301 in init_subpart_dir_entry()


________________________________________________________________________________________________________
*** CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/util/cbfstool/ifwitool.c: 1301 in init_subpart_dir_entry()
1295     static size_t init_subpart_dir_entry(struct subpart_dir_entry *e,
1296                                         struct buffer *b, size_t offset)
1297     {
1298            memset(e, 0, sizeof(*e));
1299     
1300            assert(strlen(b->name) <= sizeof(e->name));
>>>     CID 1361253:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
>>>     Calling strncpy with a maximum size argument of 12 bytes on destination 
>>> array "e->name" of size 12 bytes might leave the destination string 
>>> unterminated.
1301            strncpy((char *)e->name, (char *)b->name, sizeof(e->name));
1302            e->offset = offset;
1303            e->length = buffer_size(b);
1304     
1305            return (offset + buffer_size(b));
1306     }

** CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()
346                             pspdir[4+4*i+2] = 1;
347                             pspdir[4+4*i+3] = 0;
348                     } else if (fw_table[i].filename != NULL) {
349                             pspdir[4+4*i+0] = fw_table[i].type;
350     
351                             fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353028:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fd" is passed to a parameter that cannot be negative. [Note: The 
>>> source code implementation of the function has been overridden by a builtin 
>>> model.]
352                             fstat(fd, &fd_stat);
353                             pspdir[4+4*i+1] = (uint32_t)fd_stat.st_size;
354     
355                             pspdir[4+4*i+2] = pos + rom_base_address;
356                             pspdir[4+4*i+3] = 0;
357     

** CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()
289             int i;
290             uint32_t rom_base_address = 0xFFFFFFFF - rom_size + 1;
291     
292             for (i = 0; fw_table[i].type != AMD_FW_INVALID; i++) {
293                     if (fw_table[i].filename != NULL) {
294                             fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353027:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fd" is passed to a parameter that cannot be negative. [Note: The 
>>> source code implementation of the function has been overridden by a builtin 
>>> model.]
295                             fstat(fd, &fd_stat);
296     
297                             switch (fw_table[i].type) {
298                             case AMD_FW_IMC:
299                                     pos = ALIGN(pos, 0x10000U);
300                                     romsig[1] = pos + rom_base_address;

** CID 1353021:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 366 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353021:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 366 in integrate_psp_firmwares()
360                                             " will not fit %s.  Exiting.\n",
361                                             rom_size, fw_table[i].filename);
362                                     free(base);
363                                     exit(1);
364                             }
365     
>>>     CID 1353021:  Error handling issues  (CHECKED_RETURN)
>>>     "read(int, void *, size_t)" returns the number of bytes read, but it is 
>>> ignored.
366                             read(fd, (void *)(base + pos), 
(size_t)fd_stat.st_size);
367     
368                             pos += fd_stat.st_size;
369                             close(fd);
370                             pos = ALIGN(pos, 0x100U);
371                     } else {

** CID 1353020:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()


________________________________________________________________________________________________________
*** CID 1353020:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 352 in integrate_psp_firmwares()
346                             pspdir[4+4*i+2] = 1;
347                             pspdir[4+4*i+3] = 0;
348                     } else if (fw_table[i].filename != NULL) {
349                             pspdir[4+4*i+0] = fw_table[i].type;
350     
351                             fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353020:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "fstat(fd, &fd_stat)" without checking return value. This 
>>> library function may fail and return an error code. [Note: The source code 
>>> implementation of the function has been overridden by a builtin model.]
352                             fstat(fd, &fd_stat);
353                             pspdir[4+4*i+1] = (uint32_t)fd_stat.st_size;
354     
355                             pspdir[4+4*i+2] = pos + rom_base_address;
356                             pspdir[4+4*i+3] = 0;
357     

** CID 1353019:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 321 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353019:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 321 in integrate_firmwares()
315                                             " will not fit %s.  Exiting.\n",
316                                             rom_size, fw_table[i].filename);
317                                     free(base);
318                                     exit(1);
319                             }
320     
>>>     CID 1353019:  Error handling issues  (CHECKED_RETURN)
>>>     "read(int, void *, size_t)" returns the number of bytes read, but it is 
>>> ignored.
321                             read(fd, (void *)(base + pos), 
(size_t)fd_stat.st_size);
322     
323                             pos += fd_stat.st_size;
324                             close(fd);
325                             pos = ALIGN(pos, 0x100U);
326                     }

** CID 1353018:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()


________________________________________________________________________________________________________
*** CID 1353018:  Error handling issues  (CHECKED_RETURN)
/util/amdfwtool/amdfwtool.c: 295 in integrate_firmwares()
289             int i;
290             uint32_t rom_base_address = 0xFFFFFFFF - rom_size + 1;
291     
292             for (i = 0; fw_table[i].type != AMD_FW_INVALID; i++) {
293                     if (fw_table[i].filename != NULL) {
294                             fd = open(fw_table[i].filename, O_RDONLY);
>>>     CID 1353018:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "fstat(fd, &fd_stat)" without checking return value. This 
>>> library function may fail and return an error code. [Note: The source code 
>>> implementation of the function has been overridden by a builtin model.]
295                             fstat(fd, &fd_stat);
296     
297                             switch (fw_table[i].type) {
298                             case AMD_FW_IMC:
299                                     pos = ALIGN(pos, 0x10000U);
300                                     romsig[1] = pos + rom_base_address;

** CID 1347335:    (UNINIT)
/util/cbfstool/elfheaders.c: 1000 in write_phdrs()
/util/cbfstool/elfheaders.c: 1002 in write_phdrs()
/util/cbfstool/elfheaders.c: 1003 in write_phdrs()
/util/cbfstool/elfheaders.c: 1004 in write_phdrs()


________________________________________________________________________________________________________
*** CID 1347335:    (UNINIT)
/util/cbfstool/elfheaders.c: 1000 in write_phdrs()
994                     } else {
995                             /* Accumulate file size and memsize. The 
assumption
996                              * is that each section is either NOBITS or full
997                              * (sh_size == file size). This is standard in 
that
998                              * an ELF section doesn't have a file size 
component. */
999                             if (sec->shdr.sh_flags & SHF_EXECINSTR)
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_flags".
1000                                    phdr.p_flags |= PF_X | PF_R;
1001                            if (sec->shdr.sh_flags & SHF_WRITE)
1002                                    phdr.p_flags |= PF_W;
1003                            phdr.p_filesz += buffer_size(&sec->content);
1004                            phdr.p_memsz += sec->shdr.sh_size;
1005                    }
/util/cbfstool/elfheaders.c: 1002 in write_phdrs()
996                              * is that each section is either NOBITS or full
997                              * (sh_size == file size). This is standard in 
that
998                              * an ELF section doesn't have a file size 
component. */
999                             if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000                                    phdr.p_flags |= PF_X | PF_R;
1001                            if (sec->shdr.sh_flags & SHF_WRITE)
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_flags".
1002                                    phdr.p_flags |= PF_W;
1003                            phdr.p_filesz += buffer_size(&sec->content);
1004                            phdr.p_memsz += sec->shdr.sh_size;
1005                    }
1006            }
1007     
/util/cbfstool/elfheaders.c: 1003 in write_phdrs()
997                              * (sh_size == file size). This is standard in 
that
998                              * an ELF section doesn't have a file size 
component. */
999                             if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000                                    phdr.p_flags |= PF_X | PF_R;
1001                            if (sec->shdr.sh_flags & SHF_WRITE)
1002                                    phdr.p_flags |= PF_W;
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_filesz".
1003                            phdr.p_filesz += buffer_size(&sec->content);
1004                            phdr.p_memsz += sec->shdr.sh_size;
1005                    }
1006            }
1007     
1008            /* Write out the last phdr. */
/util/cbfstool/elfheaders.c: 1004 in write_phdrs()
998                              * an ELF section doesn't have a file size 
component. */
999                             if (sec->shdr.sh_flags & SHF_EXECINSTR)
1000                                    phdr.p_flags |= PF_X | PF_R;
1001                            if (sec->shdr.sh_flags & SHF_WRITE)
1002                                    phdr.p_flags |= PF_W;
1003                            phdr.p_filesz += buffer_size(&sec->content);
>>>     CID 1347335:    (UNINIT)
>>>     Using uninitialized value "phdr.p_memsz".
1004                            phdr.p_memsz += sec->shdr.sh_size;
1005                    }
1006            }
1007     
1008            /* Write out the last phdr. */
1009            if (num_needs_write != num_written) {

** CID 1302457:  Control flow issues  (MISSING_RESTORE)
/util/cbfstool/flashmap/fmap.c: 485 in fmap_append_area_test()


________________________________________________________________________________________________________
*** CID 1302457:  Control flow issues  (MISSING_RESTORE)
/util/cbfstool/flashmap/fmap.c: 485 in fmap_append_area_test()
479             if ((*fmap)->nareas != 1) {
480                     printf("FAILURE: failed to increment number of 
areas\n");
481                     goto fmap_append_area_test_exit;
482             }
483     
484             status = pass;
>>>     CID 1302457:  Control flow issues  (MISSING_RESTORE)
>>>     Jumped to here, skipping restore.
485     fmap_append_area_test_exit:
486             return status;
487     }
488     
489     static int fmap_find_area_test(struct fmap *fmap)
490     {

** CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
/util/cbfstool/flashmap/fmap.c: 601 in fmap_find_test()


________________________________________________________________________________________________________
*** CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
/util/cbfstool/flashmap/fmap.c: 601 in fmap_find_test()
595                     printf("FAILURE: bsearch returned false positive\n");
596                     goto fmap_find_test_exit;
597             }
598     
599             /* simple test case: fmap at (total_size / 2) + 1 */
600             offset = (total_size / 2) + 1;
>>>     CID 1302456:  Error handling issues  (NEGATIVE_RETURNS)
>>>     "fmap_size(fmap)" is passed to a parameter that cannot be negative. 
>>> [Note: The source code implementation of the function has been overridden 
>>> by a builtin model.]
601             memcpy(&buf[offset], fmap, fmap_size(fmap));
602     
603             if ((unsigned)fmap_find(buf, total_size - 1) != offset) {
604                     printf("FAILURE: lsearch failed to find fmap\n");
605                     goto fmap_find_test_exit;
606             }

** CID 1302453:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()


________________________________________________________________________________________________________
*** CID 1302453:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557             }
558             free(my_str);
559             free(str);
560     
561             status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302453:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "my_str" going out of scope leaks the storage it points to.
563             return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {

** CID 1302452:    (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()


________________________________________________________________________________________________________
*** CID 1302452:    (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557             }
558             free(my_str);
559             free(str);
560     
561             status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302452:    (RESOURCE_LEAK)
>>>     Variable "str" going out of scope leaks the storage it points to.
563             return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {
/util/cbfstool/flashmap/fmap.c: 563 in fmap_flags_to_string_test()
557             }
558             free(my_str);
559             free(str);
560     
561             status = pass;
562     fmap_flags_to_string_test_exit:
>>>     CID 1302452:    (RESOURCE_LEAK)
>>>     Variable "str" going out of scope leaks the storage it points to.
563             return status;
564     
565     }
566     
567     static int fmap_find_test(struct fmap *fmap)
568     {

** CID 1302451:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 240 in fmap_print()


________________________________________________________________________________________________________
*** CID 1302451:  Resource leaks  (RESOURCE_LEAK)
/util/cbfstool/flashmap/fmap.c: 240 in fmap_print()
234                     kv_pair_fmt(pair, "area_flags_raw", "0x%02x",
235                                     fmap->areas[i].flags);
236     
237                     /* Print descriptive strings for flags rather than the 
field */
238                     flags = fmap->areas[i].flags;
239                     if ((str = fmap_flags_to_string(flags)) == NULL)
>>>     CID 1302451:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "pair" going out of scope leaks the storage it points to.
240                             return -1;
241                     kv_pair_fmt(pair, "area_flags", "%s", str);
242                     free(str);
243     
244                     kv_pair_print(pair);
245                     kv_pair_free(pair);

** CID 1241818:  Memory - illegal accesses  (OVERRUN)
/src/vendorcode/amd/cimx/rd890/nbPcieLib.c: 1359 in PcieLibGetPortInfo()


________________________________________________________________________________________________________
*** CID 1241818:  Memory - illegal accesses  (OVERRUN)
/src/vendorcode/amd/cimx/rd890/nbPcieLib.c: 1359 in PcieLibGetPortInfo()
1353       case  GPP3a_CORE:
1354         pGppCfgInfoTable = (GPP_CFG_INFO*)FIX_PTR_ADDR 
(&GppCfgInfoTable[CoreConfig - 1], NULL);
1355         NativePortId = PcieLibNativePortId (PortId, pConfig);
1356         if (NativePortId == 0xf) {
1357           return NULL;
1358         }
>>>     CID 1241818:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 6 8-byte elements at element index 4294967295 
>>> (byte offset 34359738360) by dereferencing pointer "pGppCfgInfoTable".
1359         pPortInfo = &pGppCfgInfoTable->PortInfoPtr[NativePortId - 4];
1360         break;
1361       default:
1362         return NULL;
1363       }
1364       return (PORT_INFO*)FIX_PTR_ADDR (pPortInfo, NULL);

** CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 653 in Bt2_MatchFinder_Skip()


________________________________________________________________________________________________________
*** CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 653 in Bt2_MatchFinder_Skip()
647     static void Bt2_MatchFinder_Skip(struct CMatchFinder *p, uint32_t num)
648     {
649       do
650       {
651         SKIP_HEADER(2)
652         HASH2_CALC;
>>>     CID 1241790:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "hashValue" as an index to pointer "p->hash".
653         curMatch = p->hash[hashValue];
654         p->hash[hashValue] = p->pos;
655         SKIP_FOOTER
656       }
657       while (--num != 0);
658     }

** CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 489 in Bt2_MatchFinder_GetMatches()


________________________________________________________________________________________________________
*** CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
/util/cbfstool/lzma/C/LzFind.c: 489 in Bt2_MatchFinder_GetMatches()
483     
484     static uint32_t Bt2_MatchFinder_GetMatches(struct CMatchFinder *p, 
uint32_t *distances)
485     {
486       uint32_t offset;
487       GET_MATCHES_HEADER(2)
488       HASH2_CALC;
>>>     CID 1241788:  Insecure data handling  (TAINTED_SCALAR)
>>>     Using tainted variable "hashValue" as an index to pointer "p->hash".
489       curMatch = p->hash[hashValue];
490       p->hash[hashValue] = p->pos;
491       offset = 0;
492       GET_MATCHES_FOOTER(offset, 1)
493     }
494     


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, 
https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbLuoVetFLSjdonCi1EjfHRqWGQvojmmkYaBE-2BPJiTQvQ-3D-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5aBueK59y7L7-2BNMCFvIZ3L6lm-2FUdKbAyTBHTJ2r-2FDyRuUnsQjE3WJpI8KUI0TLmvJQ3kvgnicpsJWLgdZPM8x67GU0imNbxaQ2qhvlGYnD0B981ECxfeqe-2BBvqlOCQeih6C1seuoi-2F7w5OvokScGIB2ID5xqTgaxTj9w83qvVlkTGtZzvV41Pblq37tC-2Bqrkls-3D

To manage Coverity Scan email notifications for "[email protected]", click 
https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4e-2BpBzwOa5gzBZa9dWpDbzfofODnVj1enK2UkK0-2BgCCqfkfgGF5ECMwHI0-2FVznrU953Dvw3Ddjop950pccFQ-2Br0qaXkQSgAjbZsF6g7Yem3Y-3D_q4bX76XMySz3BXBlWr5fXXJ4cvAsgEXEqC7dBPM7O5aBueK59y7L7-2BNMCFvIZ3L6YY3ye9-2Fm90c6W-2B7iNDrMJ1SaloChr6CoHzHLPwmBcNiN6J7vd2U5lh3-2ByOW8oLjG1C85-2F1HR3rI9K5xnbqdjL-2FIDhaC7S3fGHVTHctN3kyie2l2NQu-2BqlxnkyRv9XKz9ZPQwGBqdyhA4HSBw5HeVV8268w-2FCYVAZgTFugG8U7LA-3D


-- 
coreboot mailing list: [email protected]
https://mail.coreboot.org/mailman/listinfo/coreboot

Reply via email to