RDKEMW-14533 : DO NOT MERGE - mgrChk#89
RDKEMW-14533 : DO NOT MERGE - mgrChk#89PreethiLakshmi91 wants to merge 1 commit intordkcentral:developfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR appears to adjust initialization of the local BTRMGR_DiscoveredDevicesList_t discoveredDevices structure in the battery discovery timer handler (likely motivated by Coverity findings).
Changes:
- Modifies the
memsetcall that clearsdiscoveredDevicesbefore callingBTRMGR_GetDiscoveredDevices.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| gTimeoutSeconds = gTimeoutSeconds + BTRMGR_BATTERY_DISCOVERY_TIME_INTERVAL; | ||
|
|
||
| memset(&discoveredDevices, 0, sizeof(discoveredDevices)); | ||
| memset(&discoveredDevices, 0, 1000*sizeof(discoveredDevices)); |
There was a problem hiding this comment.
The new memset size 1000*sizeof(discoveredDevices) will write far past the discoveredDevices stack variable (it’s a single BTRMGR_DiscoveredDevicesList_t), causing stack corruption/UB. This should be limited to the actual object size (and ideally use the project’s safer MEMSET_S pattern used elsewhere for this type).
| memset(&discoveredDevices, 0, 1000*sizeof(discoveredDevices)); | |
| MEMSET_S(&discoveredDevices, sizeof(discoveredDevices), 0, sizeof(discoveredDevices)); |
Reason for change: Inclusion of coverity for BT Test Procedure: NA Risks: Low Priority: P2 Signed-off-by: ppalan289 <preethi_palanisamy@comcast.com>
PreethiLakshmi91
force-pushed
the
RDKEMW-14533_Cov_f
branch
from
5315c4c to
84bd30a
Compare
| /* Initialze all the database */ | ||
| MEMSET_S(&gDefaultAdapterContext, sizeof(gDefaultAdapterContext), 0, sizeof(gDefaultAdapterContext)); | ||
| MEMSET_S(&gListOfAdapters, sizeof(gListOfAdapters), 0, sizeof(gListOfAdapters)); | ||
| MEMSET_S(&gListOfAdapters, sizeof(gListOfAdapters), 0, 100*sizeof(gListOfAdapters)); |
There was a problem hiding this comment.
Coverity Issue - Wrong sizeof argument
Passing argument "&gListOfAdapters" of type "stBTRCoreListAdapters *" and argument "51300UL" ("100UL * 513UL") to function "memset" is suspicious because "sizeof (stBTRCoreListAdapters) /513/" is expected.
Medium Impact, CWE-131
SIZEOF_MISMATCH
| /* Initialze all the database */ | ||
| MEMSET_S(&gDefaultAdapterContext, sizeof(gDefaultAdapterContext), 0, sizeof(gDefaultAdapterContext)); | ||
| MEMSET_S(&gListOfAdapters, sizeof(gListOfAdapters), 0, sizeof(gListOfAdapters)); | ||
| MEMSET_S(&gListOfAdapters, sizeof(gListOfAdapters), 0, 100*sizeof(gListOfAdapters)); |
There was a problem hiding this comment.
Coverity Issue - Out-of-bounds access
Overrunning struct type stBTRCoreListAdapters of 513 bytes by passing it to a function which accesses it at byte offset 51299 using argument "51300UL".
High Impact, CWE-119
OVERRUN
Reason for change: Inclusion of coverity for BT
Test Procedure: NA
Risks: Low
Priority: P2