Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4701-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <78e4c9a65b6e7509a1f743f945270568a8548f26.camel@hadess.net>
Subject: seid structure in profiles/audio/avdtp.c
From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Date: Thu, 16 May 2024 11:13:39 +0200
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

Hey,

I was looking at the code in profiles/audio/avdtp.c surrounding those
static analyser warnings, and couldn't understand how the seid arrays
were constructed.

There's similar code in android/ which might also need fixing.

I could only find the code that assigned ".first_seid", nothing about
how the rest of the structure is allocated and assigned.

Cheers

PS: Please CC: on the answer, as I'm not subscribed to the list

Error: ARRAY_VS_SINGLETON (CWE-119): [#def29] [important]
bluez-5.75/profiles/audio/avdtp.c:1675:2: address_of: Taking address with "=
&start->first_seid" yields a singleton pointer.
bluez-5.75/profiles/audio/avdtp.c:1675:2: assign: Assigning: "seid" =3D "&s=
tart->first_seid".
bluez-5.75/profiles/audio/avdtp.c:1679:25: ptr_arith: Using "seid" as an ar=
ray.  This might corrupt or misinterpret adjacent memory locations.
# 1677|   	int i;
# 1678|  =20
# 1679|-> 	for (i =3D 0; i < count; i++, seid++) {
# 1680|   		if (seid->seid =3D=3D id) {
# 1681|   			req->collided =3D TRUE;

Error: ARRAY_VS_SINGLETON (CWE-119): [#def30] [important]
bluez-5.75/profiles/audio/avdtp.c:1690:2: address_of: Taking address with "=
&suspend->first_seid" yields a singleton pointer.
bluez-5.75/profiles/audio/avdtp.c:1690:2: assign: Assigning: "seid" =3D "&s=
uspend->first_seid".
bluez-5.75/profiles/audio/avdtp.c:1694:25: ptr_arith: Using "seid" as an ar=
ray.  This might corrupt or misinterpret adjacent memory locations.
# 1692|   	int i;
# 1693|  =20
# 1694|-> 	for (i =3D 0; i < count; i++, seid++) {
# 1695|   		if (seid->seid =3D=3D id) {
# 1696|   			req->collided =3D TRUE;

Error: ARRAY_VS_SINGLETON (CWE-119): [#def31] [important]
bluez-5.75/profiles/audio/avdtp.c:1799:2: address_of: Taking address with "=
&req->first_seid" yields a singleton pointer.
bluez-5.75/profiles/audio/avdtp.c:1799:2: assign: Assigning: "seid" =3D "&r=
eq->first_seid".
bluez-5.75/profiles/audio/avdtp.c:1801:30: ptr_arith: Using "seid" as an ar=
ray.  This might corrupt or misinterpret adjacent memory locations.
# 1799|   	seid =3D &req->first_seid;
# 1800|  =20
# 1801|-> 	for (i =3D 0; i < seid_count; i++, seid++) {
# 1802|   		failed_seid =3D seid->seid;
# 1803|  =20

Error: ARRAY_VS_SINGLETON (CWE-119): [#def32] [important]
bluez-5.75/profiles/audio/avdtp.c:1912:2: address_of: Taking address with "=
&req->first_seid" yields a singleton pointer.
bluez-5.75/profiles/audio/avdtp.c:1912:2: assign: Assigning: "seid" =3D "&r=
eq->first_seid".
bluez-5.75/profiles/audio/avdtp.c:1914:30: ptr_arith: Using "seid" as an ar=
ray.  This might corrupt or misinterpret adjacent memory locations.
# 1912|   	seid =3D &req->first_seid;
# 1913|  =20
# 1914|-> 	for (i =3D 0; i < seid_count; i++, seid++) {
# 1915|   		failed_seid =3D seid->seid;
# 1916|  =20