Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
lib: fix variable types in common.c:pqos_read()
The types used for len and ret variables in pqos_read do not match neither the function prototype, nor read() library call, which may lead to possible overflow; while the ret overflow is arguably hypothetical on Linux, as it likely won't return a value greater than 0x7ffff000, which is less than INT_MAX, a potential overflow of len seems to be possible, as caller might pass count greater than INT_MAX. Fix it by changing the type of len to size_t, to match count, and the type of ret to ssize_t, to match the return type of read(). Discovered by covscan: Error: INTEGER_OVERFLOW (CWE-190): intel-cmt-cat-23.11/lib/common.c:382: tainted_data_return: Called function "read(fd, byte_ptr, len)", and a possible return value may be less than zero. intel-cmt-cat-23.11/lib/common.c:382: cast_overflow: An assign that casts to a different type, which might trigger an overflow. intel-cmt-cat-23.11/lib/common.c:389: overflow: The expression "len" is considered to have possibly overflowed. intel-cmt-cat-23.11/lib/common.c:382: overflow_sink: "len", which might be negative, is passed to "read(fd, byte_ptr, len)". [Note: The source code implementation of the function has been overridden by a builtin model.] # 380| return -1; # 381| # 382|-> while (len != 0 && (ret = read(fd, byte_ptr, len)) != 0) { # 383| if (ret == -1) { # 384| if (errno == EINTR) Signed-off-by: Eugene Syromiatnikov <[email protected]>
- Loading branch information