linux-kernel - Re: lzo1x_decompress_safe: Macro compares unsigned to 0 (NO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140630143745.GA22623@kroah.com>
Date:	Mon, 30 Jun 2014 07:37:45 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Richard Weinberger <richard@....at>
Cc:	donb@...uritymouse.com, markus@...rhumer.com,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: lzo1x_decompress_safe: Macro compares unsigned to 0  (NO_EFFECT)

On Mon, Jun 30, 2014 at 09:22:47AM +0200, Richard Weinberger wrote:
> This was introduced by:
> commit 206a81c18401c0cde6e579164f752c4b147324ce
> Author: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Date:   Fri Jun 20 22:00:53 2014 -0700
> 
>     lzo: properly check for overruns
> 
> Thanks,
> //richard
> 
> -------- Original-Nachricht --------
> Betreff: New Defects reported by Coverity Scan for Linux
> Datum: Sun, 29 Jun 2014 22:09:11 -0700
> Von: scan-admin@...erity.com
> 
> 
> Hi,
> 
> 
> Please find the latest report on new defect(s) introduced to Linux found with Coverity Scan.
> 
> Defect(s) Reported-by: Coverity Scan
> Showing 1 of 1 defect(s)
> 
> 
> ** CID 1224102:  Macro compares unsigned to 0  (NO_EFFECT)
> /lib/lzo/lzo1x_decompress_safe.c: 225 in lzo1x_decompress_safe()
> 
> 
> ________________________________________________________________________________________________________
> *** CID 1224102:  Macro compares unsigned to 0  (NO_EFFECT)
> /lib/lzo/lzo1x_decompress_safe.c: 225 in lzo1x_decompress_safe()
> 219     			op += t;
> 220     			ip += t;
> 221     		} else
> 222     #endif
> 223     		{
> 224     			NEED_IP(t, 3);
> >>>     CID 1224102:  Macro compares unsigned to 0  (NO_EFFECT)
> >>>     This greater-than-or-equal-to-zero comparison of an unsigned value is always true. "t + 0UL >= 0UL".
> 225     			NEED_OP(t, 0);
> 226     			while (t > 0) {
> 227     				*op++ = *ip++;
> 228     				t--;
> 229     			}
> 230     		}
> 
> 
> ________________________________________________________________________________________________________

Looks like coverity needs to fix their "this is how you test for an
overflow" logic, right?  Or did I get the test wrong?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/