CodeSonar : pvm3.4.6 : Integer Overflow of Allocation Size

pvm3.4.6 : pvm3.4.6 analysis 2 : Integer Overflow of Allocation Size at ddpro.c:1415

Categories:	ALLOC.IOAS BSI:MALLOC-OVERFLOW CWE:680
Warning ID:	120.28741
Procedure:	exectasks
Trace:	view
Modified:	Thu Nov 26 11:27:41 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/pvm3/src/ddpro.c

			Enter exectasks

1401

exectasks(mp, rmp, schtid)

1402

struct pmsg *mp; /* the request message */

1403

struct pmsg *rmp; /* reply message blank */

1404

int schtid; /* scheduler for new tasks */

1405

{

1406

struct pmsg *mp2; /* reply message hdl */

1407

int i;

1408

struct timeval now;

1409

struct waitc_spawn *wxp; /* new task parameters */

int munge_tenv = 0;

char tmp[255];

char *wd = 0;

$unknown_6897295 overflowed

1413

char *savewd = 0;

1414

1415

wxp = TALLOC(1, struct waitc_spawn, "waix"); /* Integer Overflow of Allocation Size */

1416

BZERO((char*)wxp, sizeof(struct waitc_spawn)); /* Null Pointer Dereference (ID: 125.28746) */

/* unpack message */

if (upkuint(mp, &wxp->w_ptid )

1421

|| upkstralloc(mp, &wxp->w_file )

1422

|| upkint(mp, &wxp->w_flags )

1423

|| upkint(mp, &wxp->w_veclen )

1424

|| upkint(mp, &wxp->w_argc ))

1425

goto bad;

1426

1427

if (wxp->w_veclen < 1)

1428

goto bad;

1429

wxp->w_vec = TALLOC(wxp->w_veclen, int, "tids"); /* Integer Overflow of Allocation Size (ID: 124.28745) */

1430

1431

wxp->w_argc += 2;

1432

wxp->w_argv = TALLOC(wxp->w_argc + 1, char*, "argv"); /* Integer Overflow of Allocation Size (ID: 123.28744) */

1433

BZERO((char*)wxp->w_argv, (wxp->w_argc + 1) * sizeof(char*)); /* Null Pointer Dereference (ID: 122.28743) */

1434

wxp->w_argv++;

1435

wxp->w_argv[0] = wxp->w_file; /* Null Pointer Dereference (ID: 121.28742) */

1436

wxp->w_file = 0;

1437

wxp->w_argv[--wxp->w_argc] = 0;

1438

for (i = 1; i < wxp->w_argc; i++)

1439

if (upkstralloc(mp, &wxp->w_argv[i]))

1440

goto bad;

1441

1442

if (upkuint(mp, &wxp->w_outtid )

1443

|| upkuint(mp, &wxp->w_outctx )

1444

|| upkuint(mp, &wxp->w_outtag )

1445

|| upkuint(mp, &wxp->w_trctid )

1446

|| upkuint(mp, &wxp->w_trcctx )

1447

|| upkuint(mp, &wxp->w_trctag )

1448

|| upkuint(mp, &wxp->w_nenv ))

1449

goto bad;

1450

1451

wxp->w_hosttotal = wxp->w_veclen; /* this is the task count! */

1452

1453

if (pvmtracer.trctid) {

1454

if (!(wxp->w_trctid) && pvmtracer.trctag) {

1455

wxp->w_trctid = pvmtracer.trctid;

1456

wxp->w_trcctx = pvmtracer.trcctx;

1457

wxp->w_trctag = pvmtracer.trctag;

munge_tenv++;

}

}

if (pvmtracer.outtid) {

1463

if (!(wxp->w_outtid) && pvmtracer.outtag) {

1464

wxp->w_outtid = pvmtracer.outtid;

1465

wxp->w_outctx = pvmtracer.outctx;

1466

wxp->w_outtag = pvmtracer.outtag;

}

}

wxp->w_env = TALLOC((wxp->w_nenv + 1), char*, "env");

Preconditions

&$unknown_432457 >= 1
((char*)&$heap_63211)[24] >= 1
((char*)&$heap_63211)[32] != 0
pvmtracer.trctid != 0
pvmtracer.trctag != 0
pvmtracer.outtid != 0
$input_12 = 0

Postconditions

errno' != 0
$heap_63211' = 0
bytes_after(&$heap_63211)' = 84
$heap_63211' is allocated by malloc
bytes_before(&$heap_63211)' = 0
((char*)&$heap_63211)[20]' = &$heap_63213
((char*)&$heap_63211)[44]' = pvmtracer.trctid
((char*)&$heap_63211)[48]' = pvmtracer.trcctx
((char*)&$heap_63211)[52]' = pvmtracer.trctag
((char*)&$heap_63211)[76]' = ((char*)&$heap_63211)[24]
((char*)&$heap_63211)[12]' = &$heap_63214 + 4
bytes_after(&$heap_63212)' = &$unknown_432457
$heap_63212' is allocated by malloc
bytes_before(&$heap_63212)' = 0
bytes_after(&$heap_63213)' = 4 * ((char*)&$heap_63211)[24]
$heap_63213' is allocated by malloc
$heap_63213' is allocated
bytes_before(&$heap_63213)' = 0
$heap_63214' = 0
$heap_63214' is allocated by malloc
bytes_before(&$heap_63214)' = 0
((char*)&$heap_63214)[4]' = &$heap_63212
munge_tenv' = 1
savewd' = 0
wd' = 0
wxp' = &$heap_63211

Change Warning 120.28741 : Integer Overflow of Allocation Size

Priority:
State:
Finding:
Owner:
Note: