This is an automated email from the ASF dual-hosted git repository. casaroli pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit dd00ec250808c9c1cb76d60079c56f425377dfcf Author: gaohedong <[email protected]> AuthorDate: Fri Apr 24 10:18:00 2026 +0800 net/can: Fix Coverity CID 1816914 negative value usage In can_recvfrom_newdata(), iob_copyout() returns int which may be negative on error, but the return value was directly assigned to size_t variable recvlen. This implicit conversion could turn a negative error code into a large positive value, causing incorrect behavior in subsequent iob_trimhead() and can_add_recvlen() calls. Fix this by storing the iob_copyout() return value in an int variable first, checking for errors, and only then assigning to the size_t recvlen. Coverity CID: 1816914 Signed-off-by: gaohedong <[email protected]> Signed-off-by: p-szafonimateusz <[email protected]> --- net/can/can_recvmsg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/can/can_recvmsg.c b/net/can/can_recvmsg.c index 215660b2993..f7b1f626c4e 100644 --- a/net/can/can_recvmsg.c +++ b/net/can/can_recvmsg.c @@ -154,7 +154,7 @@ static size_t can_recvfrom_newdata(FAR struct net_driver_s *dev, FAR struct can_recvfrom_s *pstate) { unsigned int offset; - size_t recvlen; + ssize_t recvlen; #ifdef CONFIG_NET_TIMESTAMP cmsg_store_timestamp(pstate->pr_msg, &dev->d_iob->io_time, @@ -174,6 +174,10 @@ static size_t can_recvfrom_newdata(FAR struct net_driver_s *dev, recvlen = iob_copyout(pstate->pr_msg->msg_iov->iov_base, dev->d_iob, recvlen, offset); + if (recvlen <= 0) + { + return 0; + } /* Trim the copied buffers */
