Public bug reported:

I've noticed some errors (maybe false positives) with mt6625 wifi driver
[1] in gcc11 (gcc10 does not show this error)

drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c: In function 
'_stp_btm_put_dump_to_nl':
drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c:139:34: 
error: array subscript 'STP_PACKET_T {aka struct stp_dbg_pkt}[0]' is partly 
outside array bounds of 'UINT8[2048]' {aka 'unsigned char[2048]'} 
[-Werror=array-bounds]
  139 |                         len = pkt->hdr.len;
      |                                  ^~
drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c:116:22: 
note: while referencing 'buf'
  116 |         static UINT8 buf[2048];
      |                      ^~~
drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c: In function 
'_stp_btm_handler':
drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c:257:33: 
error: array subscript 'STP_PACKET_T {aka struct stp_dbg_pkt}[0]' is partly 
outside array bounds of 'UINT8[2048]' {aka 'unsigned char[2048]'} 
[-Werror=array-bounds]
  257 |                                 memcpy(&tmp[0], pkt->raw, pkt->hdr.len);
      |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c:239:22: 
note: while referencing 'buf'
  239 |         static UINT8 buf[2048];
      |                      ^~~

imho buffer is large enough

#define STP_DMP_SZ 16

typedef struct stp_dbg_pkt_hdr {
        /* packet information */
        unsigned int sec;
        unsigned int usec;
        unsigned int dbg_type;
        unsigned int dmy;
        unsigned int no;
        unsigned int dir;

        /* packet content */
        unsigned int type;
        unsigned int len;
        unsigned int ack;
        unsigned int seq;
        unsigned int chs;
        unsigned int crc;
} STP_DBG_HDR_T;

typedef struct stp_dbg_pkt {
        struct stp_dbg_pkt_hdr hdr;
        unsigned char raw[STP_DMP_SZ];
} STP_PACKET_T;

so we have 12 x uint32 + 16 = 62 bytes, buffer is 2028, i guess the
error comes because array is defined as bytes and types are uint32 so
using 4 array-elements each

[1]
https://github.com/frank-w/BPI-R2-4.14/blob/5.18-main/drivers/misc/mediatek/connectivity/common/conn_soc/core/btm_core.c#L138

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: gcc-11-arm-linux-gnueabihf 11.2.0-17ubuntu1cross1
ProcVersionSignature: Ubuntu 5.15.0-30.31-generic 5.15.30
Uname: Linux 5.15.0-30-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: GNOME-Flashback:GNOME
Date: Thu May 26 17:35:04 2022
InstallationDate: Installed on 2022-05-22 (4 days ago)
InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220419)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: gcc-11-cross
UpgradeStatus: No upgrade log present (probably fresh install)

** Affects: gcc-11-cross (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: amd64 apport-bug jammy

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1975848

Title:
  gcc11 shows (maybe false positive) error about array-bounds

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-11-cross/+bug/1975848/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to