On Fri, 29 Jul 2022 at 16:56, Corey Minyard <miny...@acm.org> wrote:
>
> On Tue, Jun 28, 2022 at 05:21:44PM +0100, Peter Maydell wrote:
> > On Thu, 19 Sept 2019 at 22:39, <miny...@acm.org> wrote:
> > >
> > > From: Corey Minyard <cminy...@mvista.com>
> > >
> > > Signed-off-by: Corey Minyard <cminy...@mvista.com>
> > > ---
> >
>
> Thank you for the ping. Comments inline...
> > ...calling memcpy() with argument 1 being a pointer that points
> > one past the end of the array. Even though len will be 0 and
> > we won't memcpy() anything, this is (depending on how you choose
> > to intepret things the C standard doesn't come right out and state
> > explicitly) undefined behaviour, because memcpy() wants to be passed
> > valid pointers, even if you ask it to do no work with a zero len.
> >
> > This isn't going to be a visible bug in practical terms, but it would
> > make Coverity happy if we either (a) rejected a request with an empty
> > length or else (b) skipped the memcpy(). I don't know enough about
> > IPMI to know which is better.
>
> Hmm. In some cases you have to accept a zero-length packet (as
> described in the comments), but if you said:
>
> if (len > 0)
> memcpy(sid->inmsg + sid->inlen, buf, len);
>
> would that make Coverity happy? I was under the impression that if you
> passed zero into len, you could pass anything into the data on a memcpy.
> But apparently not; I can make this change.
Yes, putting an if() around the memcpy() will be enough to avoid
the undefined behaviour. (NB that you want braces {} on it ;-))
thanks
-- PMM
