Text  |   XML   |   Visible Warnings:

pvm3.4.6 : pvm3.4.6 analysis 2 : Integer Overflow of Allocation Size  at lpvm.c:3497

Categories: ALLOC.IOAS BSI:MALLOC-OVERFLOW CWE:680
Warning ID: 412.29130
Procedure: pvm_getfds
Trace: view
Modified: Thu Nov 26 11:34:41 2009   show details
 
Priority: None
State: None
Finding: None
Owner: None
  edit properties

Legend [ X ]
Warning Location
Contributes
Parse Error
Other Warning
Two or More Loop Iterations
On Execution Path
Comment
Macro
Preprocessor
Include
Keyword
Preprocessed Away
Legend
Warning Location Contributes Parse Error
Other Warning Two or More Loop Iterations On Execution Path
Comment Macro Preprocessor
Include Keyword Preprocessed Away

Source  |  Language: C Hide Legend     
ProblemLineSource
   /kat0/fletcher/SATE/2010/pvm3/src/lpvm.c
   Enter pvm_getfds
 3471 pvm_getfds(fds)         /* XXX this function kinda sucks */ 
 3472         int **fds;                      /* fd list return */ 
 3473 {
 3474         static int *fdlist = 0;
 3475         static int fdlen = 0;
 3476         int cc;
 3477         int nfds;
 3478         struct ttpcb *pcbp;
 3479         TEV_DECLS 
 3480  
 3481         if (TEV_EXCLUSIVE) {
 3482                 if (TEV_DO_TRACE(TEV_GETFDS,TEV_EVENT_ENTRY))
 3483                         TEV_FIN;
 3484         }
 3485  
 3486         if (!(cc = BEATASK)) {
 3487                 nfds = 1;
 3488                 for (pcbp = ttlist->tt_link; pcbp != ttlist; pcbp = pcbp->tt_link)
 3489                         if (pcbp->tt_state == TTOPEN || pcbp->tt_state == TTGRNWAIT)
 3490                                 nfds++;
 3491  
 3492                 if (fdlen < nfds) {
 3493                         fdlen = (nfds * 3) / 2 + 1;
 3494                         if (fdlist)
 3495                                 fdlist = TREALLOC(fdlist, fdlen, int);
 3496                         else 
true3497                                 fdlist = TALLOC(fdlen, int, "fdlist");     /* Integer Overflow of Allocation Size */
Preconditions 
&$unknown_10963945 != $unknown_10963945
&$unknown_10963945 = *$unknown_10963946
((char*)$unknown_10963946)[12] = 2
fdlist = 0
pvmmytid = -1
pvmtoplvl != 0
$input_12 = 0
Postconditions 
*stderr' is allocated by fopen
bytes_before(stderr)' = 0
cc' = 0
nfds' >= fdlen + 1
pcbp' = *$unknown_10963946
pvmampushed' = 0
pvmamtraced' = pvmtoplvl
pvmmytid' != -1
pvmtoplvl' = 0
pvmtrccodef' = &pvmtrccodef_nop.enc_byte
ttlist' = &$unknown_10963945



Change Warning 412.29130 : Integer Overflow of Allocation Size

Priority:
State:
Finding:
Owner:
Note: