Coverity Scan - Static Analysis

Sample of Defect

Project Name	CID	Checker	Category	Developer Description
Kodi	1262428	OVERRUN	Memory - illegal accesses	We haven't noticed an impact of the bug but the out of bounds access has been present since at least 2009 without anybody spotting it. If it wasn't for coverity we would never have found out about it until something blew up badly.

File: /xbmc/cores/dvdplayer/DVDCodecs/Overlay/contrib/cc_decoder.c

  memset(buf, 0, sizeof (cc_memory_t));
  for (i = 0; i < CC_ROWS; i++)
  {
    ccrow_der(&buf->channel[0].rows[i], 0);
    ccrow_der(&buf->channel[1].rows[i], 0);
  }
}

static void ccmem_init(cc_memory_t *buf)
{
  ccmem_clear(buf);
}

static void ccmem_exit(cc_memory_t *buf)
{
/*FIXME: anything to deallocate?*/
}

void ccmem_tobuf(cc_decoder_t *dec)
{
  cc_buffer_t *buf = &dec->on_buf->channel[dec->on_buf->channel_no];
  int empty = 1;
  dec->textlen = 0;
  int i,j;

 < 1. Condition "i < 15", taking true branch

234
235

  for (i = 0; i < CC_ROWS; i++)
  {

 < 2. Condition "j < 32", taking true branch

    for (j = 0; j<CC_COLUMNS; j++)

 < 3. Condition "buf->rows[i].cells[j].c != 32", taking true branch

237
238
239

      if (buf->rows[i].cells[j].c != ' ')
      {
        empty = 0;

 < 4. Breaking from loop

240
241

        break;
      }

 < 5. Condition "!empty", taking true branch

    if (!empty)

 < 6. Breaking from loop

243
244

      break;
  }

 < 7. Condition "empty", taking false branch

245
246

  if (empty)
    return; // Nothing to write

 < 8. Condition "i < 15", taking true branch

 < 29. Condition "i < 15", taking true branch

248
249
250

  for (i = 0; i<CC_ROWS; i++)
  {
    int empty = 1;

 < 9. Condition "j < 32", taking true branch

 < 12. Condition "j < 32", taking true branch

 < 15. Condition "j < 32", taking false branch

 < 30. Condition "j < 32", taking true branch

 < 33. Condition "j < 32", taking true branch

 < 36. Condition "j < 32", taking false branch

    for (j = 0; j<CC_COLUMNS; j++)

 < 10. Condition "buf->rows[i].cells[j].c != 32", taking true branch

 < 13. Condition "buf->rows[i].cells[j].c != 32", taking true branch

 < 31. Condition "buf->rows[i].cells[j].c != 32", taking false branch

 < 34. Condition "buf->rows[i].cells[j].c != 32", taking true branch

      if (buf->rows[i].cells[j].c != ' ')

 < 11. Jumping back to the beginning of the loop

 < 14. Jumping back to the beginning of the loop

 < 32. Jumping back to the beginning of the loop

 < 35. Jumping back to the beginning of the loop

        empty = 0;

 < 16. Condition "!empty", taking true branch

 < 37. Condition "!empty", taking true branch

254
255
256

    if (!empty)
    {
      int f, l; // First,last used char

 < 17. Condition "f < 32", taking true branch

 < 38. Condition "f < 32", taking true branch

 < 41. Condition "f < 32", taking true branch

 << 42. Checking "f < 32" implies that "f" has the value which may be up to 31 on the true branch.

      for (f = 0; f<CC_COLUMNS; f++)

 < 18. Condition "buf->rows[i].cells[f].c != 32", taking true branch

 < 39. Condition "buf->rows[i].cells[f].c != 32", taking false branch

 < 43. Condition "buf->rows[i].cells[f].c != 32", taking true branch

        if (buf->rows[i].cells[f].c != ' ')

 < 19. Breaking from loop

 < 40. Jumping back to the beginning of the loop

 < 44. Breaking from loop

          break;

 < 20. Condition "l > 0", taking true branch

 < 45. Condition "l > 0", taking true branch

      for (l = CC_COLUMNS-1; l>0; l--)

 < 21. Condition "buf->rows[i].cells[l].c != 32", taking true branch

 < 46. Condition "buf->rows[i].cells[l].c != 32", taking true branch

        if (buf->rows[i].cells[l].c != ' ')

 < 22. Breaking from loop

 < 47. Breaking from loop

          break;

 < 23. Condition "j <= l", taking true branch

 < 25. Condition "j <= l", taking true branch

 < 27. Condition "j <= l", taking false branch

 << 48. Assigning: "j" = "f". The value of "j" may now be up to 31.

 < 49. Condition "j <= l", taking true branch

 << 51. Incrementing "j". The value of "j" may now be up to 32.

 < 52. Condition "j <= l", taking true branch

      for (j = f; j <= l; j++)

 < 24. Jumping back to the beginning of the loop

 < 26. Jumping back to the beginning of the loop

 < 50. Jumping back to the beginning of the loop

 <<< CID 1262428: Memory - illegal accesses OVERRUN
 <<< 53. Overrunning array "buf->rows[i].cells" of 32 12-byte elements at element index 32 (byte offset 384) using index "j" (which evaluates to 32).

264
265
266

        dec->text[dec->textlen++] = buf->rows[i].cells[j].c;
      dec->text[dec->textlen++] = '\n';
    }

 < 28. Jumping back to the beginning of the loop

  }
  dec->text[dec->textlen++] = '\n';
  dec->text[dec->textlen++] = '\0';
  dec->callback(0, dec->userdata);
}

/*----------------- cc_decoder_t methods --------------------------------*/

static void cc_set_channel(cc_decoder_t *dec, int channel)
{
  (*dec->active)->channel_no = channel;
}

static cc_buffer_t *active_ccbuffer(cc_decoder_t *dec)
{
  cc_memory_t *mem = *dec->active;
  return &mem->channel[mem->channel_no];
}

static void cc_swap_buffers(cc_decoder_t *dec)
{
  cc_memory_t *temp;

  /* hide caption in displayed memory */
  /* cc_hide_displayed(dec); */

  temp = dec->on_buf;

Events:

	42. cond_at_most	cc_decoder.c:257
	48. assignment	cc_decoder.c:263
	51. incr	cc_decoder.c:263
	53. overrun-local	cc_decoder.c:264

Sample of Defect

About Synopsys

Communities and resources