Attachment 647818 Details for Bug 878052 – List of all defects added in kexec-tools-2.0.0-252.el6

List of all defects added in kexec-tools-2.0.0-252.el6

kexec-tools.added.err (text/plain), 58.46 KB, created by Ondrej Oprala on 2012-11-19 14:55:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ondrej Oprala

Created: 2012-11-19 14:55:41 UTC

Size: 58.46 KB

patch

obsolete

>Error: CONSTANT_EXPRESSION_RESULT (CWE-569):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:334: result_independent_of_operands: lsize > 9223372036854775807L is always false regardless of the values of its operands. This occurs as the logical operand of if.
>
>Error: OVERRUN:
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:260: cond_true: Condition "pos <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_true: Condition "eol <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_true: Condition "*eol != 10", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:264: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_true: Condition "eol <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_false: Condition "*eol != 10", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:264: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:265: cond_false: Condition "eol > last", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:282: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:289: cond_true: Condition "len >= 10", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:289: cond_true: Condition "memcmp("OSRELEASE=", pos, 10) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:291: cond_true: Condition "to_copy >= 4096UL /* sizeof (osrelease) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_true: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:299: cond_true: Condition "symbol[i].len >= len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:300: continue: Continuing loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_true: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:299: cond_true: Condition "symbol[i].len >= len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:300: continue: Continuing loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_false: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:310: cond_true: Condition "memcmp("SIZE(log)=", pos, 10) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:314: cond_true: Condition "memcmp("OFFSET(log.ts_nsec)=", pos, 20) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:317: cond_true: Condition "memcmp("OFFSET(log.len)=", pos, 16) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:320: cond_true: Condition "memcmp("OFFSET(log.text_len)=", pos, 21) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:323: cond_false: Condition "last_line", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:324: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:325: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:260: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:260: cond_true: Condition "pos <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_true: Condition "eol <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_false: Condition "*eol != 10", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:264: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:265: cond_false: Condition "eol > last", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:282: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:289: cond_false: Condition "len >= 10", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:295: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_true: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:299: cond_true: Condition "symbol[i].len >= len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:300: continue: Continuing loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_true: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:299: cond_true: Condition "symbol[i].len >= len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:300: continue: Continuing loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:297: cond_false: Condition "i < 6UL /* sizeof (symbol) / sizeof (symbol[0]) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:310: cond_true: Condition "memcmp("SIZE(log)=", pos, 10) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:314: cond_true: Condition "memcmp("OFFSET(log.ts_nsec)=", pos, 20) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:317: cond_true: Condition "memcmp("OFFSET(log.len)=", pos, 16) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:320: cond_true: Condition "memcmp("OFFSET(log.text_len)=", pos, 21) == 0", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:323: cond_false: Condition "last_line", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:324: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:325: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:260: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:260: cond_true: Condition "pos <= last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:263: cond_false: Condition "eol <= last", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:264: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:265: cond_true: Condition "eol > last", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:273: cond_true: Condition "len >= 1024UL /* sizeof (temp_buf) */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:274: assignment: Assigning: "len" = "1023UL".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:276: overrun-local: Overrunning array "temp_buf" of 1024 bytes at byte offset 1024 using index "len + 1UL" (which evaluates to 1024).
>
>Error: RESOURCE_LEAK (CWE-404):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:452: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:455: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:456: cond_false: Condition "!log_end_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:459: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:460: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:463: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:464: cond_false: Condition "!logged_chars_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:467: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:477: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:477: var_assign: Assigning: "buf" = storage returned from "calloc(1UL, log_buf_len)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:478: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:482: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:487: noescape: Resource "buf" is not freed or pointed-to in function "pread(int, void *, size_t, __off64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:488: cond_false: Condition "ret != to_wrap", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:492: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:493: noescape: Resource "buf + to_wrap" is not freed or pointed-to in function "pread(int, void *, size_t, __off64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:494: cond_false: Condition "ret != log_end_wrapped", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:498: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:500: noescape: Resource "buf + (log_buf_len - logged_chars)" is not freed or pointed-to in function "write_to_stdout(char *, unsigned int)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:432:35: noescape: "write_to_stdout(char *, unsigned int)" does not free or save its pointer parameter "buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:501: leaked_storage: Variable "buf" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-404):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:571: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:574: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:576: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:579: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:581: cond_false: Condition "!log_first_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:584: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:586: cond_false: Condition "!log_next_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:589: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:591: cond_false: Condition "!log_sz", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:594: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:596: cond_false: Condition "log_offset_ts_nsec == 18446744073709551615UL", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:599: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:601: cond_false: Condition "log_offset_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:604: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:606: cond_false: Condition "log_offset_text_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:609: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:619: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:619: var_assign: Assigning: "buf" = storage returned from "calloc(1UL, log_buf_len)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:620: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:624: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:626: noescape: Resource "buf" is not freed or pointed-to in function "pread(int, void *, size_t, __off64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:627: cond_false: Condition "ret != log_buf_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:631: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: cond_true: Condition "current_idx != log_next_idx", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: identity_transfer: Passing variable "buf" as argument 1 to function "log_from_idx(char *, uint32_t)", which returns that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:533:2: cond_true: Condition "!struct_val_u16(msg, log_offset_len)", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:534:3: return_parm: Returning parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: noescape: Resource "buf" is not freed or pointed-to in function "log_from_idx(char *, uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:525:33: noescape: "log_from_idx(char *, uint32_t)" does not free or save its pointer parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: var_assign: Assigning: "msg" = storage returned from "log_from_idx(buf, current_idx)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:639: noescape: Resource "msg" is not freed or pointed-to in function "struct_val_u64(char *, unsigned int)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:513:45: noescape: "struct_val_u64(char *, unsigned int)" does not free or save its pointer parameter "ptr".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:648: noescape: Resource "msg" is not freed or pointed-to in function "struct_val_u16(char *, unsigned int)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:503:45: noescape: "struct_val_u16(char *, unsigned int)" does not free or save its pointer parameter "ptr".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_true: Condition "i < text_len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: identity_transfer: Passing variable "msg" as argument 1 to function "log_text(char *)", which returns an offset off that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:521:2: return_parm: Returning parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: noescape: Resource "msg" is not freed or pointed-to in function "log_text(char *)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:519:29: noescape: "log_text(char *)" does not free or save its pointer parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:652: cond_true: Condition "c < 32", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:653: if_fallthrough: Falling through to end of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:655: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:657: cond_true: Condition "len >= 4080U /* 4096 - 16 */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_true: Condition "i < text_len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: identity_transfer: Passing variable "msg" as argument 1 to function "log_text(char *)", which returns an offset off that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:521:2: return_parm: Returning parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: noescape: Resource "msg" is not freed or pointed-to in function "log_text(char *)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:519:29: noescape: "log_text(char *)" does not free or save its pointer parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:652: cond_true: Condition "c < 32", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:653: if_fallthrough: Falling through to end of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:655: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:657: cond_true: Condition "len >= 4080U /* 4096 - 16 */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_true: Condition "i < text_len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: identity_transfer: Passing variable "msg" as argument 1 to function "log_text(char *)", which returns an offset off that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:521:2: return_parm: Returning parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: noescape: Resource "msg" is not freed or pointed-to in function "log_text(char *)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:519:29: noescape: "log_text(char *)" does not free or save its pointer parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:652: cond_true: Condition "c < 32", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:653: if_fallthrough: Falling through to end of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:655: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:657: cond_false: Condition "len >= 4080U /* 4096 - 16 */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:660: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_false: Condition "i < text_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:666: noescape: Resource "buf" is not freed or pointed-to in function "log_next(char *, uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:539:32: noescape: "log_next(char *, uint32_t)" does not free or save its pointer parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:667: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: cond_true: Condition "current_idx != log_next_idx", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: identity_transfer: Passing variable "buf" as argument 1 to function "log_from_idx(char *, uint32_t)", which returns that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:533:2: cond_true: Condition "!struct_val_u16(msg, log_offset_len)", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:534:3: return_parm: Returning parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: noescape: Resource "buf" is not freed or pointed-to in function "log_from_idx(char *, uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:525:33: noescape: "log_from_idx(char *, uint32_t)" does not free or save its pointer parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: var_assign: Assigning: "msg" = storage returned from "log_from_idx(buf, current_idx)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:639: noescape: Resource "msg" is not freed or pointed-to in function "struct_val_u64(char *, unsigned int)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:513:45: noescape: "struct_val_u64(char *, unsigned int)" does not free or save its pointer parameter "ptr".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:648: noescape: Resource "msg" is not freed or pointed-to in function "struct_val_u16(char *, unsigned int)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:503:45: noescape: "struct_val_u16(char *, unsigned int)" does not free or save its pointer parameter "ptr".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_true: Condition "i < text_len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: identity_transfer: Passing variable "msg" as argument 1 to function "log_text(char *)", which returns an offset off that argument.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:521:2: return_parm: Returning parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:650: noescape: Resource "msg" is not freed or pointed-to in function "log_text(char *)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:519:29: noescape: "log_text(char *)" does not free or save its pointer parameter "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:652: cond_true: Condition "c < 32", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:653: if_fallthrough: Falling through to end of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:655: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:657: cond_true: Condition "len >= 4080U /* 4096 - 16 */", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: cond_false: Condition "i < text_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:661: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:666: noescape: Resource "buf" is not freed or pointed-to in function "log_next(char *, uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:539:32: noescape: "log_next(char *, uint32_t)" does not free or save its pointer parameter "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:667: loop: Jumping back to the beginning of the loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: loop_begin: Jumped back to beginning of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: cond_false: Condition "current_idx != log_next_idx", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:667: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:669: cond_true: Condition "len", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:671: leaked_storage: Variable "msg" going out of scope leaks the storage it points to.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:671: leaked_storage: Variable "buf" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-404):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:571: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:574: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:576: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:579: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:581: cond_false: Condition "!log_first_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:584: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:586: cond_false: Condition "!log_next_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:589: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:591: cond_false: Condition "!log_sz", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:594: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:596: cond_false: Condition "log_offset_ts_nsec == 18446744073709551615UL", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:599: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:601: cond_false: Condition "log_offset_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:604: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:606: cond_false: Condition "log_offset_text_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:609: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:619: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:619: var_assign: Assigning: "buf" = storage returned from "calloc(1UL, log_buf_len)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:620: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:624: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:626: noescape: Resource "buf" is not freed or pointed-to in function "pread(int, void *, size_t, __off64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:627: cond_false: Condition "ret != log_buf_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:631: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: cond_false: Condition "current_idx != log_next_idx", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:667: loop_end: Reached end of loop
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:669: cond_false: Condition "len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:670: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:671: leaked_storage: Variable "buf" going out of scope leaks the storage it points to.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:452: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:455: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:456: cond_false: Condition "!log_end_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:459: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:460: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:463: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:464: cond_false: Condition "!logged_chars_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:467: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:472: tainted_data_return: Function "read_file_s32(int, uint64_t)" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:429:2: tainted_data_return: Function "read_file_u32(int, uint64_t)" returning tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:418:2: tainted_data_argument: Function "pread(int, void *, size_t, __off64_t)" taints argument "scratch".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:419:2: cond_false: Condition "ret != 4UL /* sizeof (scratch) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:423:2: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: tainted_data_transitive: Call to function "file32_to_cpu(uint32_t)" with tainted argument "scratch" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:62:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: var_assign_alias: Assigning: "__x" = "val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:64:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: return_tainted_data_fn: Returning tainted result of "file32_to_cpu(uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:429:2: return_tainted_data_fn: Returning tainted result of "read_file_u32(int, uint64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:472: var_assign: Assigning: "log_buf_len" = "read_file_s32(int, uint64_t)", which taints "log_buf_len".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:477: tainted_data: Passing tainted variable "log_buf_len" to a tainted sink.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:452: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:455: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:456: cond_false: Condition "!log_end_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:459: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:460: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:463: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:464: cond_false: Condition "!logged_chars_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:467: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:473: tainted_data_return: Function "read_file_u32(int, uint64_t)" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:418:2: tainted_data_argument: Function "pread(int, void *, size_t, __off64_t)" taints argument "scratch".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:419:2: cond_false: Condition "ret != 4UL /* sizeof (scratch) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:423:2: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: tainted_data_transitive: Call to function "file32_to_cpu(uint32_t)" with tainted argument "scratch" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:62:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: var_assign_alias: Assigning: "__x" = "val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:64:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: return_tainted_data_fn: Returning tainted result of "file32_to_cpu(uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:473: var_assign: Assigning: "logged_chars" = "read_file_u32(int, uint64_t)", which taints "logged_chars".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:478: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:482: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:488: cond_false: Condition "ret != to_wrap", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:492: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:494: cond_false: Condition "ret != log_end_wrapped", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:498: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:500: tainted_data: Passing tainted variable "logged_chars" to a tainted sink.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:436:2: tainted_data_sink_lv_call: Passing tainted variable "nr" to tainted data sink "write(int, void const *, size_t)".
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:571: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:574: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:576: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:579: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:581: cond_false: Condition "!log_first_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:584: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:586: cond_false: Condition "!log_next_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:589: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:591: cond_false: Condition "!log_sz", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:594: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:596: cond_false: Condition "log_offset_ts_nsec == 18446744073709551615UL", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:599: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:601: cond_false: Condition "log_offset_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:604: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:606: cond_false: Condition "log_offset_text_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:609: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:620: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:624: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:626: tainted_data_argument: Calling function "pread(int, void *, size_t, __off64_t)" taints argument "buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:627: cond_false: Condition "ret != log_buf_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:631: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: cond_true: Condition "current_idx != log_next_idx", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: tainted_data_transitive: Call to function "log_from_idx(char *, uint32_t)" with tainted argument "buf" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:533:2: cond_true: Condition "!struct_val_u16(msg, log_offset_len)", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:534:3: return_tainted_data: Returning tainted variable "log_buf".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:638: var_assign: Assigning: "msg" = "log_from_idx(char *, uint32_t)", which taints "msg".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:648: tainted_data_transitive: Call to function "struct_val_u16(char *, unsigned int)" with tainted argument "msg" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:505:2: tainted_data_transitive: Calling function "file16_to_cpu(uint16_t)" with tainted argument "*((uint16_t *)(ptr + offset))" results in tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:55:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: var_assign_alias: Assigning: "__x" = "(unsigned short)val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:57:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:505:2: return_tainted_data: Returning tainted variable "file16_to_cpu(*((uint16_t *)(ptr + offset)))".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:648: var_assign: Assigning: "text_len" = "struct_val_u16(char *, unsigned int)", which taints "text_len".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:649: tainted_data: Using tainted variable "text_len" as a loop boundary.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:571: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:574: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:576: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:579: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:581: cond_false: Condition "!log_first_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:584: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:586: cond_false: Condition "!log_next_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:589: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:591: cond_false: Condition "!log_sz", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:594: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:596: cond_false: Condition "log_offset_ts_nsec == 18446744073709551615UL", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:599: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:601: cond_false: Condition "log_offset_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:604: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:606: cond_false: Condition "log_offset_text_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:609: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:612: tainted_data_return: Function "read_file_s32(int, uint64_t)" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:429:2: tainted_data_return: Function "read_file_u32(int, uint64_t)" returning tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:418:2: tainted_data_argument: Function "pread(int, void *, size_t, __off64_t)" taints argument "scratch".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:419:2: cond_false: Condition "ret != 4UL /* sizeof (scratch) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:423:2: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: tainted_data_transitive: Call to function "file32_to_cpu(uint32_t)" with tainted argument "scratch" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:62:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: var_assign_alias: Assigning: "__x" = "val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:64:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: return_tainted_data_fn: Returning tainted result of "file32_to_cpu(uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:429:2: return_tainted_data_fn: Returning tainted result of "read_file_u32(int, uint64_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:612: var_assign: Assigning: "log_buf_len" = "read_file_s32(int, uint64_t)", which taints "log_buf_len".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:619: tainted_data: Passing tainted variable "log_buf_len" to a tainted sink.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:571: cond_false: Condition "!log_buf_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:574: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:576: cond_false: Condition "!log_buf_len_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:579: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:581: cond_false: Condition "!log_first_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:584: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:586: cond_false: Condition "!log_next_idx_vaddr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:589: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:591: cond_false: Condition "!log_sz", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:594: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:596: cond_false: Condition "log_offset_ts_nsec == 18446744073709551615UL", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:599: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:601: cond_false: Condition "log_offset_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:604: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:606: cond_false: Condition "log_offset_text_len == 65535", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:609: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:615: tainted_data_return: Function "read_file_u32(int, uint64_t)" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:418:2: tainted_data_argument: Function "pread(int, void *, size_t, __off64_t)" taints argument "scratch".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:419:2: cond_false: Condition "ret != 4UL /* sizeof (scratch) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:423:2: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: tainted_data_transitive: Call to function "file32_to_cpu(uint32_t)" with tainted argument "scratch" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:62:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: var_assign_alias: Assigning: "__x" = "val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:63:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:64:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:424:2: return_tainted_data_fn: Returning tainted result of "file32_to_cpu(uint32_t)".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:615: var_assign: Assigning: "log_next_idx" = "read_file_u32(int, uint64_t)", which taints "log_next_idx".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:620: cond_false: Condition "!buf", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:624: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:627: cond_false: Condition "ret != log_buf_len", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:631: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:637: tainted_data: Using tainted variable "log_next_idx" as a loop boundary.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:99: tainted_data_argument: Calling function "pread(int, void *, size_t, __off64_t)" taints argument "ehdr32".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:100: cond_false: Condition "ret != 52UL /* sizeof (ehdr32) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:104: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:115: tainted_data_transitive: Call to function "file16_to_cpu(uint16_t)" with tainted argument "ehdr32.e_phnum" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:55:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: var_assign_alias: Assigning: "__x" = "(unsigned short)val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:57:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:115: var_assign: Assigning: "ehdr.e_phnum" = "file16_to_cpu(uint16_t)", which taints "ehdr.e_phnum".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:120: cond_false: Condition "ehdr.e_version != 1", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:124: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:125: cond_false: Condition "ehdr.e_phentsize != 32UL /* sizeof (Elf32_Phdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:129: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:130: var_assign_var: Assigning: "phdrs32_size" = "ehdr.e_phnum * 32UL". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:132: cond_false: Condition "!phdr32", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:136: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:138: cond_false: Condition "!phdr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:142: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:143: tainted_data: Passing tainted variable "phdrs32_size" to a tainted sink.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:99: tainted_data_argument: Calling function "pread(int, void *, size_t, __off64_t)" taints argument "ehdr32".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:100: cond_false: Condition "ret != 52UL /* sizeof (ehdr32) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:104: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:115: tainted_data_transitive: Call to function "file16_to_cpu(uint16_t)" with tainted argument "ehdr32.e_phnum" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:55:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: var_assign_alias: Assigning: "__x" = "(unsigned short)val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:57:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:115: var_assign: Assigning: "ehdr.e_phnum" = "file16_to_cpu(uint16_t)", which taints "ehdr.e_phnum".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:120: cond_false: Condition "ehdr.e_version != 1", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:124: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:125: cond_false: Condition "ehdr.e_phentsize != 32UL /* sizeof (Elf32_Phdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:129: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:131: tainted_data: Passing tainted variable "ehdr.e_phnum" to a tainted sink.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:170: tainted_data_argument: Calling function "pread(int, void *, size_t, __off64_t)" taints argument "ehdr64".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:171: cond_false: Condition "ret < 0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:171: cond_false: Condition "(size_t)ret != 64UL /* sizeof (ehdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:175: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:186: tainted_data_transitive: Call to function "file16_to_cpu(uint16_t)" with tainted argument "ehdr64.e_phnum" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:55:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: var_assign_alias: Assigning: "__x" = "(unsigned short)val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:57:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:186: var_assign: Assigning: "ehdr.e_phnum" = "file16_to_cpu(uint16_t)", which taints "ehdr.e_phnum".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:191: cond_false: Condition "ehdr.e_version != 1", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:195: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:196: cond_false: Condition "ehdr.e_phentsize != 56UL /* sizeof (Elf64_Phdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:200: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:201: var_assign_var: Assigning: "phdrs_size" = "ehdr.e_phnum * 56UL". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:203: cond_false: Condition "!phdr64", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:207: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:209: cond_false: Condition "!phdr", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:213: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:214: tainted_data: Passing tainted variable "phdrs_size" to a tainted sink.
>
>Error: TAINTED_SCALAR (CWE-20):
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:170: tainted_data_argument: Calling function "pread(int, void *, size_t, __off64_t)" taints argument "ehdr64".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:171: cond_false: Condition "ret < 0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:171: cond_false: Condition "(size_t)ret != 64UL /* sizeof (ehdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:175: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:186: tainted_data_transitive: Call to function "file16_to_cpu(uint16_t)" with tainted argument "ehdr64.e_phnum" returns tainted data.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:55:2: cond_true: Condition "ehdr.e_ident[5] != 1", taking true branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: var_assign_alias: Assigning: "__x" = "(unsigned short)val". Both are now tainted.
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: cond_false: Condition "0", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:56:9: else_branch: Reached else branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:57:2: return_tainted_data: Returning tainted variable "val".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:186: var_assign: Assigning: "ehdr.e_phnum" = "file16_to_cpu(uint16_t)", which taints "ehdr.e_phnum".
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:191: cond_false: Condition "ehdr.e_version != 1", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:195: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:196: cond_false: Condition "ehdr.e_phentsize != 56UL /* sizeof (Elf64_Phdr) */", taking false branch
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:200: if_end: End of if statement
>/builddir/build/BUILD/kexec-tools-2.0.0/vmcore-dmesg/vmcore-dmesg.c:202: tainted_data: Passing tainted variable "ehdr.e_phnum" to a tainted sink.

Actions: View

Attachments on bug 878052: 647818