Skip to content

Commit

Permalink
lib: fix variable types in common.c:pqos_read()
Browse files Browse the repository at this point in the history
The types used for len and ret variables in pqos_read do not match
neither the function prototype, nor read() library call, which may lead
to possible overflow;  while the ret overflow is arguably hypothetical
on Linux, as it likely won't return a value greater than 0x7ffff000,
which is less than INT_MAX, a potential overflow of len seems
to be possible, as caller might pass count greater than INT_MAX.
Fix it by changing the type of len to size_t, to match count,
and the type of ret to ssize_t, to match the return type of read().

Discovered by covscan:

    Error: INTEGER_OVERFLOW (CWE-190):
    intel-cmt-cat-23.11/lib/common.c:382: tainted_data_return: Called function "read(fd, byte_ptr, len)", and a possible return value may be less than zero.
    intel-cmt-cat-23.11/lib/common.c:382: cast_overflow: An assign that casts to a different type, which might trigger an overflow.
    intel-cmt-cat-23.11/lib/common.c:389: overflow: The expression "len" is considered to have possibly overflowed.
    intel-cmt-cat-23.11/lib/common.c:382: overflow_sink: "len", which might be negative, is passed to "read(fd, byte_ptr, len)". [Note: The source code implementation of the function has been overridden by a builtin model.]
    #  380|                   return -1;
    #  381|
    #  382|->         while (len != 0 && (ret = read(fd, byte_ptr, len)) != 0) {
    #  383|                   if (ret == -1) {
    #  384|                           if (errno == EINTR)

Signed-off-by: Eugene Syromiatnikov <[email protected]>
  • Loading branch information
esyr-rh authored and rkanagar committed Oct 9, 2024
1 parent 0a7c549 commit ddcf8a8
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions lib/common.c
Original file line number Diff line number Diff line change
Expand Up @@ -378,9 +378,9 @@ pqos_munmap(void *mem, const uint64_t size)
ssize_t
pqos_read(int fd, void *buf, size_t count)
{
int len = count;
size_t len = count;
char *byte_ptr = (char *)buf;
int ret;
ssize_t ret;

if (buf == NULL)
return -1;
Expand Down

0 comments on commit ddcf8a8

Please sign in to comment.