RDKEMW-14533 : DO NOT MERGE - fork2#70
RDKEMW-14533 : DO NOT MERGE - fork2#70PreethiLakshmi91 wants to merge 1 commit intordkcentral:developfrom
Conversation
Reason for change: Inclusion of coverity for BT Test Procedure: NA Risks: Low Priority: P2 Signed-off-by: ppalan289 <preethi_palanisamy@comcast.com>
There was a problem hiding this comment.
Pull request overview
This PR appears to adjust Bluetooth adapter status callback logic in btrCore as part of “Inclusion of coverity for BT”, but the current change introduces an unsafe memory write.
Changes:
- Modified the zero-initialization of a local
stBTRCoreAdapterstructure inbtrCore_BTAdapterStatusUpdateCb.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| } | ||
|
|
||
| memset(&lstAdapterInfo, 0, sizeof(stBTRCoreAdapter)); | ||
| memset(&lstAdapterInfo, 0, 10*sizeof(stBTRCoreAdapter)); |
There was a problem hiding this comment.
The memset size is incorrect: lstAdapterInfo is a single stBTRCoreAdapter, but 10*sizeof(stBTRCoreAdapter) will overwrite adjacent stack memory (undefined behavior / potential crash or vulnerability). Use sizeof(lstAdapterInfo) (or sizeof(stBTRCoreAdapter)) as the third argument instead of scaling by 10.
| memset(&lstAdapterInfo, 0, 10*sizeof(stBTRCoreAdapter)); | |
| memset(&lstAdapterInfo, 0, sizeof(lstAdapterInfo)); |
| } | ||
|
|
||
| memset(&lstAdapterInfo, 0, sizeof(stBTRCoreAdapter)); | ||
| memset(&lstAdapterInfo, 0, 10*sizeof(stBTRCoreAdapter)); |
There was a problem hiding this comment.
Coverity Issue - Wrong sizeof argument
Passing argument "&lstAdapterInfo" of type "stBTRCoreAdapter *" and argument "480UL" ("10UL * 48UL") to function "memset" is suspicious because "sizeof (stBTRCoreAdapter) /48/" is expected.
Medium Impact, CWE-131
SIZEOF_MISMATCH
| } | ||
|
|
||
| memset(&lstAdapterInfo, 0, sizeof(stBTRCoreAdapter)); | ||
| memset(&lstAdapterInfo, 0, 10*sizeof(stBTRCoreAdapter)); |
There was a problem hiding this comment.
Coverity Issue - Out-of-bounds access
Overrunning struct type stBTRCoreAdapter of 48 bytes by passing it to a function which accesses it at byte offset 479 using argument "480UL".
High Impact, CWE-119
OVERRUN
Reason for change: Inclusion of coverity for BT
Test Procedure: NA
Risks: Low
Priority: P2