The following issues were found
include/uapi/linux/kd.h
1 issues
Line: 115
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct kbsentry {
unsigned char kb_func;
unsigned char kb_string[512];
};
#define KDGKBSENT 0x4B48 /* gets one function key string entry */
#define KDSKBSENT 0x4B49 /* sets one function key string entry */
struct kbdiacr {
Reported by FlawFinder.
net/netfilter/nft_rt.c
1 issues
Line: 83
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (nft_pf(pkt) != NFPROTO_IPV6)
goto err;
memcpy(dest, rt6_nexthop((struct rt6_info *)dst,
&ipv6_hdr(skb)->daddr),
sizeof(struct in6_addr));
break;
case NFT_RT_TCPMSS:
nft_reg_store16(dest, get_tcpmss(pkt, dst));
Reported by FlawFinder.
include/uapi/linux/ipmi.h
1 issues
Line: 56
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
in section 6.5 of the IPMI 1.5 manual. */
int addr_type;
short channel;
char data[IPMI_MAX_ADDR_SIZE];
};
/*
* When the address is not used, the type will be set to this value.
* The channel is the BMC's channel number for the channel (usually
Reported by FlawFinder.
lib/reed_solomon/test_rslib.c
1 issues
Line: 173
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
encode_rs16(rs, c, dlen, c + dlen, 0);
/* Make copyand add errors and erasures */
memcpy(r, c, len * sizeof(*r));
memset(errlocs, 0, len * sizeof(*errlocs));
memset(derrlocs, 0, nroots * sizeof(*derrlocs));
/* Generating random errors */
for (i = 0; i < errs; i++) {
Reported by FlawFinder.
lib/rhashtable.c
1 issues
Line: 1028
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
memset(ht, 0, sizeof(*ht));
mutex_init(&ht->mutex);
spin_lock_init(&ht->lock);
memcpy(&ht->p, params, sizeof(*params));
if (params->min_size)
ht->p.min_size = roundup_pow_of_two(params->min_size);
/* Cap total entries at 2^31 to avoid nelems overflow. */
Reported by FlawFinder.
include/uapi/linux/inotify.h
1 issues
Line: 26
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
__u32 mask; /* watch mask */
__u32 cookie; /* cookie to synchronize two events */
__u32 len; /* length (including nulls) of name */
char name[0]; /* stub for possible name */
};
/* the following are legal, implemented events that user-space can watch for */
#define IN_ACCESS 0x00000001 /* File was accessed */
#define IN_MODIFY 0x00000002 /* File was modified */
Reported by FlawFinder.
lib/stackdepot.c
1 issues
Line: 139
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
stack->handle.slabindex = depot_index;
stack->handle.offset = depot_offset >> STACK_ALLOC_ALIGN;
stack->handle.valid = 1;
memcpy(stack->entries, entries, flex_array_size(stack, entries, size));
depot_offset += required_size;
return stack;
}
Reported by FlawFinder.
include/uapi/linux/in.h
1 issues
Line: 243
Column: 12
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct in_addr sin_addr; /* Internet address */
/* Pad to size of `struct sockaddr'. */
unsigned char __pad[__SOCK_SIZE__ - sizeof(short int) -
sizeof(unsigned short int) - sizeof(struct in_addr)];
};
#define sin_zero __pad /* for BSD UNIX comp. -FvK */
#endif
Reported by FlawFinder.
include/linux/uacce.h
1 issues
Line: 55
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
* @ops: pointer to the struct uacce_ops
*/
struct uacce_interface {
char name[UACCE_MAX_NAME_SIZE];
unsigned int flags;
const struct uacce_ops *ops;
};
enum uacce_q_state {
Reported by FlawFinder.
net/netfilter/nft_socket.c
1 issues
Line: 51
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (level > cgrp->level)
return false;
memcpy(dest, &cgrp->ancestor_ids[level], sizeof(u64));
return true;
}
#endif
Reported by FlawFinder.