Misc fixups from scan-build.

Makefile

@@ -151,6 +151,7 @@ gnu-efi/$(ARCH_GNUEFI)/gnuefi/libgnuefi.a gnu-efi/$(ARCH_GNUEFI)/lib/libefi.a:
  mkdir -p gnu-efi/lib gnu-efi/gnuefi
  $(MAKE) -C gnu-efi \
  COMPILER="$(COMPILER)" \
+ CCC_CC="$(COMPILER)" \
  CC="$(CC)" \
  ARCH=$(ARCH_GNUEFI) \
  TOPDIR=$(TOPDIR)/gnu-efi \

include/peimage.h

@@ -17,10 +17,14 @@
 
 #include "wincert.h"
 
-#define SIGNATURE_16(A, B) ((A) | (B << 8))
-#define SIGNATURE_32(A, B, C, D) (SIGNATURE_16 (A, B) | (SIGNATURE_16 (C, D) << 16))
-#define SIGNATURE_64(A, B, C, D, E, F, G, H) \
- (SIGNATURE_32 (A, B, C, D) | ((UINT64) (SIGNATURE_32 (E, F, G, H)) << 32))
+#define SIGNATURE_16(A, B) \
+ ((UINT16)(((UINT16)(A)) | (((UINT16)(B)) << ((UINT16)8))))
+#define SIGNATURE_32(A, B, C, D) \
+ ((UINT32)(((UINT32)SIGNATURE_16(A, B)) | \
+ (((UINT32)SIGNATURE_16(C, D)) << (UINT32)16)))
+#define SIGNATURE_64(A, B, C, D, E, F, G, H) \
+ ((UINT64)((UINT64)SIGNATURE_32(A, B, C, D) | \
+ ((UINT64)(SIGNATURE_32(E, F, G, H)) << (UINT64)32)))
 
 #define ALIGN_VALUE(Value, Alignment) ((Value) + (((Alignment) - (Value)) & ((Alignment) - 1)))
 #define ALIGN_POINTER(Pointer, Alignment) ((VOID *) (ALIGN_VALUE ((UINTN)(Pointer), (Alignment))))

include/sbat.h

@@ -9,29 +9,33 @@
 #define SBAT_VAR_SIG "sbat,"
 #define SBAT_VAR_VERSION "1,"
 #define SBAT_VAR_ORIGINAL_DATE "2021030218"
-#define SBAT_VAR_ORIGINAL SBAT_VAR_SIG SBAT_VAR_VERSION \
- SBAT_VAR_ORIGINAL_DATE "\n"
+#define SBAT_VAR_ORIGINAL \
+ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_ORIGINAL_DATE "\n"
 
 #if defined(ENABLE_SHIM_DEVEL)
 #define SBAT_VAR_PREVIOUS_DATE "2022020101"
 #define SBAT_VAR_PREVIOUS_REVOCATIONS "component,2\n"
-#define SBAT_VAR_PREVIOUS SBAT_VAR_SIG SBAT_VAR_VERSION \
- SBAT_VAR_PREVIOUS_DATE "\n" SBAT_VAR_PREVIOUS_REVOCATIONS
+#define SBAT_VAR_PREVIOUS \
+ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_PREVIOUS_DATE "\n" \
+ SBAT_VAR_PREVIOUS_REVOCATIONS
 
 #define SBAT_VAR_LATEST_DATE "2022050100"
 #define SBAT_VAR_LATEST_REVOCATIONS "component,2\nothercomponent,2\n"
-#define SBAT_VAR_LATEST SBAT_VAR_SIG SBAT_VAR_VERSION \
- SBAT_VAR_LATEST_DATE "\n" SBAT_VAR_LATEST_REVOCATIONS
+#define SBAT_VAR_LATEST \
+ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \
+ SBAT_VAR_LATEST_REVOCATIONS
 #else /* !ENABLE_SHIM_DEVEL */
 #define SBAT_VAR_PREVIOUS_DATE SBAT_VAR_ORIGINAL_DATE
 #define SBAT_VAR_PREVIOUS_REVOCATIONS
-#define SBAT_VAR_PREVIOUS SBAT_VAR_SIG SBAT_VAR_VERSION \
- SBAT_VAR_PREVIOUS_DATE "\n" SBAT_VAR_PREVIOUS_REVOCATIONS
+#define SBAT_VAR_PREVIOUS \
+ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_PREVIOUS_DATE "\n" \
+ SBAT_VAR_PREVIOUS_REVOCATIONS
 
 #define SBAT_VAR_LATEST_DATE SBAT_VAR_ORIGINAL_DATE
 #define SBAT_VAR_LATEST_REVOCATIONS
-#define SBAT_VAR_LATEST SBAT_VAR_SIG SBAT_VAR_VERSION \
- SBAT_VAR_LATEST_DATE "\n" SBAT_VAR_LATEST_REVOCATIONS
+#define SBAT_VAR_LATEST \
+ SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \
+ SBAT_VAR_LATEST_REVOCATIONS
 #endif /* ENABLE_SHIM_DEVEL */
 
 #define UEFI_VAR_NV_BS \
@@ -59,6 +63,10 @@
 #define SBAT_POLICY L"SbatPolicy"
 #define SBAT_POLICY8 "SbatPolicy"
 
+#define SBAT_POLICY_LATEST 1
+#define SBAT_POLICY_PREVIOUS 2
+#define SBAT_POLICY_RESET 3
+
 extern UINTN _sbat, _esbat;
 
 struct sbat_var_entry {

mok.c

@@ -873,7 +873,6 @@ EFI_STATUS import_one_mok_state(struct mok_state_variable *v,
  v->data = AllocateZeroPool(4);
  v->data[0] = 0x01;
  v->data_size = 1;
- efi_status = EFI_SUCCESS;
  } else if (efi_status == EFI_NOT_FOUND) {
  v->data = NULL;
  v->data_size = 0;

sbat.c

@@ -353,15 +353,15 @@ set_sbat_uefi_variable(void)
  sbat_var = SBAT_VAR_PREVIOUS;
  } else {
  switch (*sbat_policy) {
- case 1:
+ case SBAT_POLICY_LATEST:
  dprint("Custom sbat policy: latest\n");
  sbat_var = SBAT_VAR_LATEST;
  break;
- case 2:
+ case SBAT_POLICY_PREVIOUS:
  dprint("Custom sbat policy: previous\n");
  sbat_var = SBAT_VAR_PREVIOUS;
  break;
- case 3:
+ case SBAT_POLICY_RESET:
  if (secure_mode()) {
  console_print(L"Cannot reset SBAT policy: Secure Boot is enabled.\n");
  sbat_var = SBAT_VAR_PREVIOUS;
@@ -374,6 +374,16 @@ set_sbat_uefi_variable(void)
  if (EFI_ERROR(efi_status))
  console_error(L"Could not reset SBAT Policy",
  efi_status);
+ break;
+ default:
+ console_error(L"SBAT policy state %llu is invalid",
+ EFI_INVALID_PARAMETER);
+ efi_status = del_variable(SBAT_POLICY, SHIM_LOCK_GUID);
+ if (EFI_ERROR(efi_status))
+ console_error(L"Could not reset SBAT Policy",
+ efi_status);
+ sbat_var = SBAT_VAR_PREVIOUS;
+ break;
  }
  }
 

shim.c

@@ -1138,7 +1138,7 @@ EFI_STATUS start_image(EFI_HANDLE image_handle, CHAR16 *ImagePath)
  UINTN alloc_pages;
  CHAR16 *PathName = NULL;
  void *data = NULL;
- int datasize;
+ int datasize = 0;
 
  efi_status = read_image(image_handle, ImagePath, PathName, &data,
  &datasize);
@@ -1402,13 +1402,12 @@ load_cert_file(EFI_HANDLE image_handle, CHAR16 *filename)
  CHAR16 *PathName = NULL;
  void *pointer;
  UINT32 original;
- int datasize;
- void *data;
+ int datasize = 0;
+ void *data = NULL;
  int i;
 
  efi_status = read_image(image_handle, filename, PathName,
  &data, &datasize);
-
  if (EFI_ERROR(efi_status))
  return efi_status;
 
@@ -1497,10 +1496,10 @@ load_certs(EFI_HANDLE image_handle)
  goto done;
  }
 
- if (buffersize == 0)
+ info = (EFI_FILE_INFO *)buffer;
+ if (buffersize == 0 || !info)
  goto done;
 
- info = (EFI_FILE_INFO *)buffer;
  if (StrnCaseCmp(info->FileName, L"shim_certificate", 16) == 0) {
  load_cert_file(image_handle, info->FileName);
  }