{"action":"closed","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/12249","repository_url":"https://api.github.com/repos/radare/radare2","labels_url":"https://api.github.com/repos/radare/radare2/issues/12249/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/12249/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/12249/events","html_url":"https://github.com/radare/radare2/issues/12249","id":383002140,"node_id":"MDU6SXNzdWUzODMwMDIxNDA=","number":12249,"title":"More covs","user":{"login":"radare","id":917142,"node_id":"MDQ6VXNlcjkxNzE0Mg==","avatar_url":"https://avatars1.githubusercontent.com/u/917142?v=4","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/radare/radare2/milestones/33","html_url":"https://github.com/radare/radare2/milestone/33","labels_url":"https://api.github.com/repos/radare/radare2/milestones/33/labels","id":3611763,"node_id":"MDk6TWlsZXN0b25lMzYxMTc2Mw==","number":33,"title":"3.1.0","description":"","creator":{"login":"radare","id":917142,"node_id":"MDQ6VXNlcjkxNzE0Mg==","avatar_url":"https://avatars1.githubusercontent.com/u/917142?v=4","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"open_issues":12,"closed_issues":118,"state":"open","created_at":"2018-08-31T00:20:51Z","updated_at":"2018-11-22T15:09:42Z","due_on":"2018-11-24T08:00:00Z","closed_at":null},"comments":1,"created_at":"2018-11-21T08:15:56Z","updated_at":"2018-11-22T15:09:42Z","closed_at":"2018-11-22T15:09:42Z","author_association":"OWNER","body":"```\r\nNew defect(s) Reported-by: Coverity Scan\r\nShowing 10 of 10 defect(s)\r\n\r\n\r\n** CID 1396937:    (TAINTED_SCALAR)\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396937:    (TAINTED_SCALAR)\r\n/libr/bin/p/bin_symbols.c: 156 in parseMetadata()\r\n150         // int count = r_read_le32 (b + 0x48);\r\n151         sm.namelen = r_read_le32 (b + 0xc);\r\n152         // eprintf (\"0x%08x  count    %d\\n\", 0x48, count);\r\n153         // eprintf (\"0x%08x  strlen   %d\\n\", 0x4c, sm.namelen);\r\n154         // eprintf (\"0x%08x  filename %s\\n\", 0x50, b + 16);\r\n155         int delta = 16;\r\n   CID 1396937:    (TAINTED_SCALAR)\r\n   Passing tainted variable \"sm.n_segments\" to a tainted sink.\r\n156         sm.segments = parseSegments (buf, off + sm.namelen + delta, sm.n_segments);\r\n157         sm.size = (sm.n_segments * 32) + 120;\r\n158     \r\n159         // hack to detect format\r\n160         ut32 nm, nm2, nm3;\r\n161         r_buf_read_at (buf, off + sm.size, &nm, sizeof (nm));\r\n/libr/bin/p/bin_symbols.c: 156 in parseMetadata()\r\n150         // int count = r_read_le32 (b + 0x48);\r\n151         sm.namelen = r_read_le32 (b + 0xc);\r\n152         // eprintf (\"0x%08x  count    %d\\n\", 0x48, count);\r\n153         // eprintf (\"0x%08x  strlen   %d\\n\", 0x4c, sm.namelen);\r\n154         // eprintf (\"0x%08x  filename %s\\n\", 0x50, b + 16);\r\n155         int delta = 16;\r\n   CID 1396937:    (TAINTED_SCALAR)\r\n   Passing tainted variable \"sm.n_segments\" to a tainted sink.\r\n156         sm.segments = parseSegments (buf, off + sm.namelen + delta, sm.n_segments);\r\n157         sm.size = (sm.n_segments * 32) + 120;\r\n158     \r\n159         // hack to detect format\r\n160         ut32 nm, nm2, nm3;\r\n161         r_buf_read_at (buf, off + sm.size, &nm, sizeof (nm));\r\n\r\n** CID 1396936:  Control flow issues  (UNREACHABLE)\r\n/libr/asm/p/asm_ppc_cs.c: 111 in disassemble()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396936:  Control flow issues  (UNREACHABLE)\r\n/libr/asm/p/asm_ppc_cs.c: 111 in disassemble()\r\n105         } else {\r\n106             r_asm_op_set_asm (op, \"invalid\");\r\n107             op->size = 4;\r\n108             cs_free (insn, n);\r\n109             return op->size;\r\n110         }\r\n   CID 1396936:  Control flow issues  (UNREACHABLE)\r\n   This code cannot be reached: \"cs_free(insn, n);\".\r\n111         cs_free (insn, n);\r\n112         return 4;\r\n113     }\r\n114     \r\n115     RAsmPlugin r_asm_plugin_ppc_cs = {\r\n116         .name = \"ppc\",\r\n\r\n** CID 1396935:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)\r\n/libr/bin/format/wasm/wasm.c: 569 in r_bin_wasm_get_symtab_entries()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396935:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)\r\n/libr/bin/format/wasm/wasm.c: 569 in r_bin_wasm_get_symtab_entries()\r\n563         while (b->cur <= max) {\r\n564             if (!(ptr = R_NEW0 (RBinWasmSymbol))) {\r\n565                 return ret;\r\n566             }\r\n567             ptr->id = b->buf[b->cur];\r\n568             tmp = b->buf[b->cur + 1];\r\n   CID 1396935:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)\r\n   \"tmp == 256\" is always false regardless of the values of its operands. This occurs as the logical operand of \"if\".\r\n569             if (tmp == R_BIN_WASM_STRING_LENGTH) {\r\n570                 tmp = R_BIN_WASM_STRING_LENGTH - 1;\r\n571             }\r\n572             ptr->name_len = (ut32) tmp;\r\n573             r_buf_seek (b, 2, R_IO_SEEK_CUR);\r\n574             if (!(consume_str_r (b, max, tmp, ptr->name))) {\r\n\r\n** CID 1396934:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/debug/p/native/bt.c: 61 in r_debug_native_frames()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396934:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/debug/p/native/bt.c: 61 in r_debug_native_frames()\r\n55                 cb = backtrace_x86_32;\r\n56             }\r\n57         }\r\n58     \r\n59         RList *list;\r\n60         if(dbg->btalgo && !strcmp (dbg->btalgo, \"trace\")) {\r\n   CID 1396934:  Resource leaks  (RESOURCE_LEAK)\r\n   Ignoring storage allocated by \"r_list_clone(dbg->call_frames)\" leaks it.\r\n61             r_list_clone (dbg->call_frames);\r\n62         } else {\r\n63     #if HAVE_PTRACE\r\n64             struct frames_proxy_args args = { cb, dbg, at };\r\n65             list = r_debug_ptrace_func (dbg, backtrace_proxy, &args);\r\n66     #else\r\n\r\n** CID 1396933:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_wasm.c: 210 in symbols()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396933:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_wasm.c: 210 in symbols()\r\n204         // TODO: exports, globals, tables and memories\r\n205         return ret;\r\n206     bad_alloc:\r\n207         // not so sure if imports should be freed.\r\n208         r_list_free (codes);\r\n209         r_list_free (ret);\r\n   CID 1396933:  Resource leaks  (RESOURCE_LEAK)\r\n   Variable \"symtab\" going out of scope leaks the storage it points to.\r\n210         return NULL;\r\n211     }\r\n212     \r\n213     static RList *imports(RBinFile *bf) {\r\n214         RBinWasmObj *bin = NULL;\r\n215         RList *imports = NULL;\r\n\r\n** CID 1396932:  Memory - illegal accesses  (UNINIT)\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396932:  Memory - illegal accesses  (UNINIT)\r\n/libr/debug/p/native/bt.c: 71 in r_debug_native_frames()\r\n65             list = r_debug_ptrace_func (dbg, backtrace_proxy, &args);\r\n66     #else\r\n67             cb (dbg, at);\r\n68     #endif\r\n69         }\r\n70     \r\n   CID 1396932:  Memory - illegal accesses  (UNINIT)\r\n   Using uninitialized value \"list\" when calling \"prepend_current_pc\".\r\n71         prepend_current_pc (dbg, list);\r\n72         return list;\r\n\r\n** CID 1396931:    (TAINTED_SCALAR)\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396931:    (TAINTED_SCALAR)\r\n/libr/bin/p/bin_symbols.c: 323 in parseDragons()\r\n317         D {\r\n318             const int e0ss = r_read_le32 (b + 12);\r\n319             eprintf (\"0x%08x  eoss   0x%x\\n\", off + 12, e0ss);\r\n320         }\r\n321         sd.n_segments = r_read_le32 (b + 24);\r\n322         sd.n_sections = r_read_le32 (b + 28);\r\n   CID 1396931:    (TAINTED_SCALAR)\r\n   Passing tainted variable \"sd.n_segments\" to a tainted sink.\r\n323         parseSegments (buf, SEGMENTS_BEGIN, sd.n_segments);\r\n324     \r\n325         sd.n_symbols = r_read_le32 (b + 0x20); // depends on nsections\r\n326         if (sd.n_symbols > 1024 * 1024) {\r\n327             eprintf (\"Warning: too many symbols %d, truncated to 2048\\n\", sd.n_symbols);\r\n328             sd.n_symbols = 2048;\r\n/libr/bin/p/bin_symbols.c: 323 in parseDragons()\r\n317         D {\r\n318             const int e0ss = r_read_le32 (b + 12);\r\n319             eprintf (\"0x%08x  eoss   0x%x\\n\", off + 12, e0ss);\r\n320         }\r\n321         sd.n_segments = r_read_le32 (b + 24);\r\n322         sd.n_sections = r_read_le32 (b + 28);\r\n   CID 1396931:    (TAINTED_SCALAR)\r\n   Passing tainted variable \"sd.n_segments\" to a tainted sink.\r\n323         parseSegments (buf, SEGMENTS_BEGIN, sd.n_segments);\r\n324     \r\n325         sd.n_symbols = r_read_le32 (b + 0x20); // depends on nsections\r\n326         if (sd.n_symbols > 1024 * 1024) {\r\n327             eprintf (\"Warning: too many symbols %d, truncated to 2048\\n\", sd.n_symbols);\r\n328             sd.n_symbols = 2048;\r\n\r\n** CID 1396930:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_symbols.c: 574 in sections()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396930:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_symbols.c: 574 in sections()\r\n568         r_list_foreach (sm.segments, iter, s) {\r\n569             r_list_append (res, s);\r\n570         }\r\n571         r_list_foreach (sections, iter, s) {\r\n572             r_list_append (res, s);\r\n573         }\r\n   CID 1396930:  Resource leaks  (RESOURCE_LEAK)\r\n   Variable \"sections\" going out of scope leaks the storage it points to.\r\n574         return res;\r\n575     }\r\n576     \r\n577     static ut64 baddr(RBinFile *bf) {\r\n578         return 0;\r\n579     }\r\n\r\n** CID 1396929:    (STRING_NULL)\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396929:    (STRING_NULL)\r\n/libr/bin/p/bin_symbols.c: 102 in parseSegments()\r\n96         for (i = 0; i < count; i++) {\r\n97             int A = r_read_le32 (b + X + 16);\r\n98             int B = r_read_le32 (b + X + 16 + 8);\r\n99             //    eprintf (\"0x%08x  segment  0x%08x 0x%08x  %s\\n\",\r\n100             //        x, A, A + B, b + X);\r\n101             const char *name = (const char *)(b + X);\r\n   Passing unterminated string \"name\" to \"newSection\", which expects a null-terminated string.\r\n102             RBinSection *section = newSection (name, A, A + B, true);\r\n103             r_list_append (segments, section);\r\n104             x += 32;\r\n105             X += 32;\r\n106         }\r\n107         return segments;\r\n/libr/bin/p/bin_symbols.c: 102 in parseSegments()\r\n96         for (i = 0; i < count; i++) {\r\n97             int A = r_read_le32 (b + X + 16);\r\n98             int B = r_read_le32 (b + X + 16 + 8);\r\n99             //    eprintf (\"0x%08x  segment  0x%08x 0x%08x  %s\\n\",\r\n100             //        x, A, A + B, b + X);\r\n101             const char *name = (const char *)(b + X);\r\n   Passing unterminated string \"name\" to \"newSection\", which expects a null-terminated string.\r\n102             RBinSection *section = newSection (name, A, A + B, true);\r\n103             r_list_append (segments, section);\r\n104             x += 32;\r\n105             X += 32;\r\n106         }\r\n107         return segments;\r\n\r\n** CID 1396928:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_symbols.c: 323 in parseDragons()\r\n\r\n\r\n________________________________________________________________________________________________________\r\n*** CID 1396928:  Resource leaks  (RESOURCE_LEAK)\r\n/libr/bin/p/bin_symbols.c: 323 in parseDragons()\r\n317         D {\r\n318             const int e0ss = r_read_le32 (b + 12);\r\n319             eprintf (\"0x%08x  eoss   0x%x\\n\", off + 12, e0ss);\r\n320         }\r\n321         sd.n_segments = r_read_le32 (b + 24);\r\n322         sd.n_sections = r_read_le32 (b + 28);\r\n   CID 1396928:  Resource leaks  (RESOURCE_LEAK)\r\n   Ignoring storage allocated by \"parseSegments(buf, 432, sd.n_segments)\" leaks it.\r\n323         parseSegments (buf, SEGMENTS_BEGIN, sd.n_segments);\r\n324     \r\n325         sd.n_symbols = r_read_le32 (b + 0x20); // depends on nsections\r\n326         if (sd.n_symbols > 1024 * 1024) {\r\n327             eprintf (\"Warning: too many symbols %d, truncated to 2048\\n\", sd.n_symbols);\r\n328             sd.n_symbols = 2048;\r\n```"}}
{"actor":{"display_login":"radare"}}