96 free(buf);
97
98 return 0;
99 }
100
101 static int scan_vendor_boot_part(struct udevice *blk, struct
android_priv *priv)
** CID 501794: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 501794: Memory - corruptions (OVERRUN)
/lib/tpm_tcg2.c: 640 in tcg2_measurement_init()
634 rc = tcg2_log_prepare_buffer(*dev, elog,
ignore_existing_log);
635 if (rc) {
636 tcg2_measurement_term(*dev, elog, true);
637 return rc;
638 }
639
CID 501794: Memory - corruptions (OVERRUN)
Overrunning array "version_string" of 50 bytes by passing it to a
function which accesses it at byte offset 63.
640 rc = tcg2_measure_event(*dev, elog, 0, EV_S_CRTM_VERSION,
641 strlen(version_string) + 1,
642 (u8 *)version_string);
643 if (rc) {
644 tcg2_measurement_term(*dev, elog, true);
645 return rc;
** CID 501793: Insecure data handling (TAINTED_SCALAR)
/lib/tpm-v2.c: 909 in tpm2_allow_extend()
________________________________________________________________________________________________________
*** CID 501793: Insecure data handling (TAINTED_SCALAR)
/lib/tpm-v2.c: 909 in tpm2_allow_extend()
903 int rc;
904
905 rc = tpm2_get_pcr_info(dev, &pcrs);
906 if (rc)
907 return false;
908
CID 501793: Insecure data handling (TAINTED_SCALAR)
Using tainted variable "pcrs.count" as a loop boundary.
909 for (i = 0; i < pcrs.count; i++) {
910 if (tpm2_is_active_pcr(&pcrs.selection[i]) &&
911 !tpm2_algorithm_to_len(pcrs.selection[i].hash))
912 return false;
913 }
914
915 return true;
** CID 501792: Control flow issues (DEADCODE)
/lib/efi_loader/efi_helper.c: 137 in efi_load_option_dp_join()
________________________________________________________________________________________________________
*** CID 501792: Control flow issues (DEADCODE)
/lib/efi_loader/efi_helper.c: 137 in efi_load_option_dp_join()
131 if (fdt_dp) {
132 struct efi_device_path *tmp_dp = *dp;
133
134 *dp = efi_dp_concat(tmp_dp, fdt_dp, *dp_size);
135 efi_free_pool(tmp_dp);
136 if (!dp)
CID 501792: Control flow issues (DEADCODE)
Execution cannot reach this statement: "return
9223372036854775817UL;".
137 return EFI_OUT_OF_RESOURCES;
138 *dp_size += efi_dp_size(fdt_dp) + sizeof(END);
139 }
140
141 *dp_size += sizeof(END);
142
** CID 501791: (DEADCODE)
/drivers/usb/gadget/ether.c: 2219 in eth_bind()
/drivers/usb/gadget/ether.c: 2110 in eth_bind()
/drivers/usb/gadget/ether.c: 2071 in eth_bind()
/drivers/usb/gadget/ether.c: 2089 in eth_bind()
________________________________________________________________________________________________________
*** CID 501791: (DEADCODE)
/drivers/usb/gadget/ether.c: 2219 in eth_bind()
2213 out_ep->name, in_ep->name,
2214 status_ep ? " STATUS " : "",
2215 status_ep ? status_ep->name : ""
2216 );
2217 printf("MAC %pM\n", pdata->enetaddr);
2218
CID 501791: (DEADCODE)
Execution cannot reach the expression "rndis" inside this
statement: "if (cdc || rndis)
printf(...".
2219 if (cdc || rndis)
2220 printf("HOST MAC %02x:%02x:%02x:%02x:%02x:%02x\n",
2221 dev->host_mac[0], dev->host_mac[1],
2222 dev->host_mac[2], dev->host_mac[3],
2223 dev->host_mac[4], dev->host_mac[5]);
2224
/drivers/usb/gadget/ether.c: 2110 in eth_bind()
2104 device_desc.bNumConfigurations = 2;
2105
2106 if (gadget_is_dualspeed(gadget)) {
2107 if (rndis)
2108 dev_qualifier.bNumConfigurations = 2;
2109 else if (!cdc)
CID 501791: (DEADCODE)
Execution cannot reach this statement: "dev_qualifier.bDeviceClass
...".
2110 dev_qualifier.bDeviceClass =
USB_CLASS_VENDOR_SPEC;
2111
2112 /* assumes ep0 uses the same value for both speeds
... */
2113 dev_qualifier.bMaxPacketSize0 =
device_desc.bMaxPacketSize0;
2114
2115 /* and that all endpoints are dual-speed */
/drivers/usb/gadget/ether.c: 2071 in eth_bind()
2065
2066 #if defined(CONFIG_USB_ETH_CDC) || defined(CONFIG_USB_ETH_RNDIS)
2067 /*
2068 * CDC Ethernet control interface doesn't require a status
endpoint.
2069 * Since some hosts expect one, try to allocate one anyway.
2070 */
CID 501791: (DEADCODE)
Execution cannot reach the expression "rndis" inside this
statement: "if (cdc || rndis) {
statu...".
2071 if (cdc || rndis) {
2072 status_ep = usb_ep_autoconfig(gadget,
&fs_status_desc);
2073 if (status_ep) {
2074 status_ep->driver_data = status_ep; /*
claim */
2075 } else if (rndis) {
2076 pr_err("can't run RNDIS on %s",
gadget->name);
/drivers/usb/gadget/ether.c: 2089 in eth_bind()
2083 }
2084 }
2085 #endif
2086
2087 /* one config: cdc, else minimal subset */
2088 if (!cdc) {
CID 501791: (DEADCODE)
Execution cannot reach this statement: "eth_config.bNumInterfaces =
1;".
2089 eth_config.bNumInterfaces = 1;
2090 eth_config.iConfiguration = STRING_SUBSET;
2091
2092 /*
2093 * use functions to set these up, in case we're
built to work
2094 * with multiple controllers and must override CDC
Ethernet.
** CID 501790: Null pointer dereferences (FORWARD_NULL)
/cmd/bcb.c: 175 in __bcb_initialize()
________________________________________________________________________________________________________
*** CID 501790: Null pointer dereferences (FORWARD_NULL)
/cmd/bcb.c: 175 in __bcb_initialize()
169 }
170 }
171
172 return CMD_RET_SUCCESS;
173
174 err_read_fail:
CID 501790: Null pointer dereferences (FORWARD_NULL)
Dereferencing null pointer "block".
175 printf("Error: %d %d:%s read failed (%d)\n",
block->uclass_id,
176 block->devnum, partition->name, ret);
177 __bcb_reset();
178 return CMD_RET_FAILURE;
179 }
180
