Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-5041-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Cc: Bastien Nocera <hadess@hadess.net>
Subject: [BlueZ 4/9] rfkill: Avoid using a signed int for an unsigned variable
Date: Thu, 30 May 2024 16:57:58 +0200
Message-ID: <20240530150057.444585-5-hadess@hadess.net>
In-Reply-To: <20240530150057.444585-1-hadess@hadess.net>
References: <20240530150057.444585-1-hadess@hadess.net>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Error: INTEGER_OVERFLOW (CWE-190): [#def37] [important]
bluez-5.76/src/rfkill.c:101:3: tainted_data_argument: The value "event" is considered tainted.
bluez-5.76/src/rfkill.c:105:3: tainted_data_argument: "event.idx" is considered tainted.
bluez-5.76/src/rfkill.c:105:3: underflow: The cast of "event.idx" to a signed type could result in a negative number.
103|			break;
104|
105|->		id = get_adapter_id_for_rfkill(event.idx);
106|
107|		if (index == id) {

Error: INTEGER_OVERFLOW (CWE-190): [#def38] [important]
bluez-5.76/src/rfkill.c:133:2: tainted_data_argument: The value "event" is considered tainted.
bluez-5.76/src/rfkill.c:143:2: tainted_data_argument: "event.idx" is considered tainted.
bluez-5.76/src/rfkill.c:157:2: underflow: The cast of "event.idx" to a signed type could result in a negative number.
155|		return TRUE;
156|
157|->	id = get_adapter_id_for_rfkill(event.idx);
158|	if (id < 0)
159|		return TRUE;
---
 src/rfkill.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/rfkill.c b/src/rfkill.c
index a0a50d9e45d9..8a0e48f01c4f 100644
--- a/src/rfkill.c
+++ b/src/rfkill.c
@@ -55,7 +55,7 @@ struct rfkill_event {
 };
 #define RFKILL_EVENT_SIZE_V1    8
 
-static int get_adapter_id_for_rfkill(int rfkill_id)
+static int get_adapter_id_for_rfkill(uint32_t rfkill_id)
 {
 	char sysname[PATH_MAX];
 	int namefd;
-- 
2.45.1