From 6616eb6cf795596d181d5a2f8dfe97534cf7c0ed Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Sun, 9 Aug 2020 00:42:32 +0000 Subject: [PATCH] scst_copy_mgr: Suppress a Coverity taint complaint Suppress the following (false positive) Coverity complaint: CID 361193: Insecure data handling (TAINTED_SCALAR) Passing tainted variable "sense_len" to a tainted sink. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@9118 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/scst_copy_mgr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/scst/src/scst_copy_mgr.c b/scst/src/scst_copy_mgr.c index e8808a465..640885158 100644 --- a/scst/src/scst_copy_mgr.c +++ b/scst/src/scst_copy_mgr.c @@ -578,7 +578,7 @@ static void scst_cm_advance_seg_descr(struct scst_cmd *ec_cmd) static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd) { struct scst_cm_ec_cmd_priv *priv = ec_cmd->cmd_data_descriptors; - uint8_t *fsense = NULL; + uint8_t add_sense_len, *fsense = NULL; int d_sense = scst_get_cmd_dev_d_sense(ec_cmd); bool copy_sense = false; int sense_to_copy = ec_cmd->sense_valid_len; @@ -665,7 +665,7 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd) /* Descriptor format */ fsense[0] = 0x72; fsense[1] = COPY_ABORTED; - fsense[7] = 12; /* additional Sense Length */ + add_sense_len = 12; fsense[8] = 1; /* Command specific descriptor */ fsense[9] = 0xA; @@ -676,7 +676,7 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd) /* Fixed format */ fsense[0] = 0x70; fsense[2] = COPY_ABORTED; - fsense[7] = 0x0a; /* additional Sense Length */ + add_sense_len = 0x0a; put_unaligned_be16(priv->cm_cur_seg_descr, &fsense[10]); @@ -691,15 +691,17 @@ static void scst_cm_prepare_final_sense(struct scst_cmd *ec_cmd) if (copy_sense) { TRACE_DBG("Copying %db of old sense", sense_to_copy); - fsense[7] += 1 + sense_to_copy; + add_sense_len += 1 + sense_to_copy; fsense[17] = ec_cmd->status; memcpy(&fsense[18], ec_cmd->sense, sense_to_copy); } - sense_len = fsense[7] + 8; + sense_len = add_sense_len + 8; TRACE_DBG("New sense len %d", sense_len); } + fsense[7] = add_sense_len; /* additional Sense Length */ + ec_cmd->status = SAM_STAT_CHECK_CONDITION; if (ec_cmd->sense != NULL) { memcpy(ec_cmd->sense, fsense, sense_len);