From: Danylo Vodopianov <dvo-...@napatech.com>
CI found couple coverity problems which were fixed in this commit.
CID: 448983, 448980
Memory - corruptions (OVERRUN)
Add check both indices within bounds before calling the macro
Coverity issue: 448983
Fixes: 6e8b7f11205f ("net/ntnic: add categorizer (CAT) FPGA module")
Signed-off-by: Danylo Vodopianov <dvo-...@napatech.com>
---
.../ntnic/nthw/flow_api/hw_mod/hw_mod_hsh.c | 17 ++++++++++++++++-
.../ntnic/nthw/flow_api/hw_mod/hw_mod_pdb.c | 18 ++++++++++++++++--
2 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_hsh.c
b/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_hsh.c
index 1750d09afb..cc8db2fae5 100644
--- a/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_hsh.c
+++ b/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_hsh.c
@@ -121,8 +121,23 @@ static int hw_mod_hsh_rcp_mod(struct flow_api_backend_s
*be, enum hw_hsh_e field
INDEX_TOO_LARGE_LOG;
return INDEX_TOO_LARGE;
}
+ /* Size of the structure */
+ size_t element_size = sizeof(struct hsh_v5_rcp_s);
+ /* Size of the buffer */
+ size_t buffer_size = sizeof(be->hsh.v5.rcp);
- DO_COMPARE_INDEXS(be->hsh.v5.rcp, struct hsh_v5_rcp_s,
index, word_off);
+ /* Calculate the maximum valid index (number of
elements in the buffer) */
+ size_t max_idx = buffer_size / element_size;
+
+ /* Check that both indices are within bounds before
calling the macro */
+ if (index < max_idx && word_off < max_idx) {
+ DO_COMPARE_INDEXS(be->hsh.v5.rcp, struct
hsh_v5_rcp_s, index,
+ word_off);
+
+ } else {
+ INDEX_TOO_LARGE_LOG;
+ return INDEX_TOO_LARGE;
+ }
break;
case HW_HSH_RCP_FIND:
diff --git a/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_pdb.c
b/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_pdb.c
index 59285405ba..147a06ac2b 100644
--- a/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_pdb.c
+++ b/drivers/net/ntnic/nthw/flow_api/hw_mod/hw_mod_pdb.c
@@ -131,8 +131,22 @@ static int hw_mod_pdb_rcp_mod(struct flow_api_backend_s
*be, enum hw_pdb_e field
INDEX_TOO_LARGE_LOG;
return INDEX_TOO_LARGE;
}
-
- DO_COMPARE_INDEXS(be->pdb.v9.rcp, struct pdb_v9_rcp_s,
index, *value);
+ /* Size of the structure */
+ size_t element_size = sizeof(struct pdb_v9_rcp_s);
+ /* Size of the buffer */
+ size_t buffer_size = sizeof(be->pdb.v9.rcp);
+
+ /* Calculate the maximum valid index (number of
elements in the buffer) */
+ size_t max_idx = buffer_size / element_size;
+
+ /* Check that both indices are within bounds before
calling the macro */
+ if (index < max_idx && *value < max_idx) {
+ DO_COMPARE_INDEXS(be->pdb.v9.rcp, struct
pdb_v9_rcp_s, index,
+ *value);
+ } else {
+ INDEX_TOO_LARGE_LOG;
+ return INDEX_TOO_LARGE;
+ }
break;
case HW_PDB_RCP_DESCRIPTOR:
--
2.45.0
