Text  |   XML   |   Visible Warnings:

pvm3.4.6 : pvm3.4.6 analysis 2 : Integer Overflow of Allocation Size  at pvmgsu_core.c:839

Categories: ALLOC.IOAS BSI:MALLOC-OVERFLOW CWE:680
Warning ID: 530.29323
Procedure: gs_cachegroup
Trace: view
Modified: Thu Nov 26 11:37:18 2009   show details
 
Priority: None
State: None
Finding: None
Owner: None
  edit properties

Legend [ X ]
Warning Location
Contributes
Parse Error
Other Warning
Two or More Loop Iterations
On Execution Path
Comment
Macro
Preprocessor
Include
Keyword
Preprocessed Away
Legend
Warning Location Contributes Parse Error
Other Warning Two or More Loop Iterations On Execution Path
Comment Macro Preprocessor
Include Keyword Preprocessed Away

Source  |  Language: C Hide Legend     
ProblemLineSource
   /kat0/fletcher/SATE/2010/pvm3/pvmgs/pvmgsu_core.c
   Enter gs_cachegroup
 792 gs_cachegroup(sgroup_list, ngroups, rsgroup) 
 793 GROUP_LIST_PTR sgroup_list;
 794 int *ngroups;
 795 GROUP_STRUCT_PTR *rsgroup;
 796 {
 797         char *newname = (char *) NULL;  
 798  
 799         int info;
 800         int len;
 801  
 802         GROUP_STRUCT_PTR sgroup;  
 803  
 804         *rsgroup = (GROUP_STRUCT_PTR) NULL;
 805  
true806         if ( (info = pvm_upkint(&len,1,1))  < 0 )
 807                 DO_ERROR_RTN( info, "gs_cachegroup" );
 808  
$unknown_72699165 overflowed809         if (len < 0)                  /* didn't get a valid groupname     */   /* Uninitialized Variable (ID: 534.29325) */
 810                 return(-1);
 811  
 812         if ( (newname = (char *) PVM_ALLOC(sizeof(char)*(len + 1),
 813                         "gs_cachegroup") ) == (char *) NULL)  
 814                 DO_ERROR_RTN( PvmNoMem, "gs_cachegroup" );
 815  
 816         if ( (info = pvm_upkstr(newname))  < 0  )
 817         {
 818                 PVM_FREE(newname);
 819                 DO_ERROR_RTN( info, "gs_cachegroup" );
 820         }
 821  
 822         sgroup = gs_group(newname, sgroup_list, ngroups, CREATE);
 823  
 824         if (sgroup != (GROUP_STRUCT_PTR) NULL)
 825         {
 826                 if ( (info = pvm_upkint(&(sgroup->ntids),1,1) ) < 0 )
 827                 {
 828                         PVM_FREE(newname);
 829                         DO_ERROR_RTN( info, "gs_cachegroup" );
 830                 }
 831  
 832                 if ( (info = pvm_upkint(&(sgroup->maxntids),1,1) ) < 0 )
 833                 {
 834                         PVM_FREE(newname);
 835                         DO_ERROR_RTN( info, "gs_cachegroup" );
 836                 }
 837  
 838                 sgroup->tids = (int *) PVM_ALLOC(sgroup->maxntids*sizeof(int),
true839                                 "gs_cachegroup");     /* Integer Overflow of Allocation Size */
Preconditions 
pvmrbuf != 0
pvmtoplvl != 0
pvmtrc.trctid != pvmmytid
pvmtrc.trctid >= 1
$input_12 = 0
Postconditions 
$heap_451115' is allocated by malloc
bytes_before(&$heap_451115)' = 0
info' = 0
len' >= 0
newname' = &$heap_451115
sgroup' = &$unknown_12362044



Change Warning 530.29323 : Integer Overflow of Allocation Size

Priority:
State:
Finding:
Owner:
Note: