Paolo Bonzini <pbonz...@redhat.com> writes:
> Replay data is not considered a possible attack vector; add a model that
> does not use getc so that "tainted data" warnings are suppressed.
>
> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
> ---
> scripts/coverity-model.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/scripts/coverity-model.c b/scripts/coverity-model.c
> index c702804f41..576f48de33 100644
> --- a/scripts/coverity-model.c
> +++ b/scripts/coverity-model.c
> @@ -103,6 +103,19 @@ static int get_keysym(const name2keysym_t *table,
> }
> }
>
> +
> +/* Replay data is considered trusted. */
> +uint8_t replay_get_byte(void)
> +{
> + uint8_t byte = 0;
> + if (replay_file) {
> + uint8_t c;
> + byte = c;
> + }
> + return byte;
> +}
> +
> +
> /*
> * GLib memory allocation functions.
> *
Coverity 2018.06 chokes on this:
$ cov-make-library -of scripts/coverity-model.xmldb
scripts/coverity-model.c
output file: scripts/coverity-model.xmldb
Compiling scripts/coverity-model.c with command
/opt/cov-sa-2018.06/bin/cov-emit --dir
/tmp/cov-armbru/930a6fb31e5f464fc1a53354b2deb66b/cov-make-library-emit -w
--no_error_recovery --emit_header_functions --no_implicit_decl --preinclude
/opt/cov-sa-2018.06/library/decls.h --c scripts/coverity-model.c
"scripts/coverity-model.c", line 110: error #20: identifier "replay_file" is
undefined
if (replay_file) {
^
Emit for file '/work/armbru/qemu/scripts/coverity-model.c' complete.
[ERROR] 1 error detected in the compilation of "scripts/coverity-model.c".
ERROR: cov-emit returned with code 1
Minimal fix:
diff --git a/scripts/coverity-model.c b/scripts/coverity-model.c
index 48b112393b..f987ce53b8 100644
--- a/scripts/coverity-model.c
+++ b/scripts/coverity-model.c
@@ -106,6 +106,7 @@ static int get_keysym(const name2keysym_t *table,
/* Replay data is considered trusted. */
uint8_t replay_get_byte(void)
{
+ void *replay_file;
uint8_t byte = 0;
if (replay_file) {
uint8_t c;
Alternatively, dumb down to:
/* Replay data is considered trusted. */
uint8_t replay_get_byte(void)
{
uint8_t byte;
return byte;
}
Got a preference?
