Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Coverity CID :208676] Overlapping buffer in memory copy in subsys/usb/class/mass_storage.c #23295

Closed
zephyrbot opened this issue Mar 5, 2020 · 1 comment · Fixed by #23510
Assignees
Labels
area: USB Universal Serial Bus bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug

Comments

@zephyrbot
Copy link
Collaborator

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/23ace0e55681c02a81fb6b891f832aa356c85aab/subsys/usb/class/mass_storage.c#L744

Category: API usage errors
Function: thread_memory_write_done
Component: Other
CID: 208676

Details:

738     static void thread_memory_write_done(void)
739     {
740         u32_t size = defered_wr_sz;
741         size_t overflowed_len = (addr + size) % CONFIG_MASS_STORAGE_BULK_EP_MPS;
742    
743         if (overflowed_len) {
>>>     CID 208676:  API usage errors  (BUFFER_SIZE)
>>>     The source buffer "&page[512]" potentially overlaps with the destination buffer "page", which results in undefined behavior for "memcpy".
744             memcpy(page, &page[BLOCK_SIZE], overflowed_len);
745         }
746    
747         addr += size;
748         length -= size;
749         csw.DataResidue -= size;

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v32951/p12996.

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

@zephyrbot zephyrbot added bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug labels Mar 5, 2020
@jfischer-no
Copy link
Collaborator

CONFIG_MASS_STORAGE_BULK_EP_MPS is either 64 or 512 (for high speed), BLOCK_SIZE is 512, page buffer is BLOCK_SIZE+CONFIG_MASS_STORAGE_BULK_EP_MPS. It can not overlap, but memmove is better choice indeed.

I will fix int in following MSC cleanup patches.

@jfischer-no jfischer-no added the area: USB Universal Serial Bus label Mar 5, 2020
jfischer-no added a commit to jfischer-no/zephyr that referenced this issue Mar 16, 2020
Fix API usage error introduced by the commit c88155f
("usb: mass_storage: fix possible page buffer overflow")'

Fixes: zephyrproject-rtos#23295
CID: 208676

Signed-off-by: Johann Fischer <j.fischer@phytec.de>
nashif pushed a commit that referenced this issue Mar 17, 2020
Fix API usage error introduced by the commit c88155f
("usb: mass_storage: fix possible page buffer overflow")'

Fixes: #23295
CID: 208676

Signed-off-by: Johann Fischer <j.fischer@phytec.de>
hakehuang pushed a commit to hakehuang/zephyr that referenced this issue Mar 18, 2020
Fix API usage error introduced by the commit c88155f
("usb: mass_storage: fix possible page buffer overflow")'

Fixes: zephyrproject-rtos#23295
CID: 208676

Signed-off-by: Johann Fischer <j.fischer@phytec.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: USB Universal Serial Bus bug The issue is a bug, or the PR is fixing a bug Coverity A Coverity detected issue or its fix priority: low Low impact/importance bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants