Re: [lwip-devel] [bug #36492] Static Analysis on code 1.4.0

[Mason]

[ Switching to lwip-devel ]

bayard wrote:

> ABR : Buffer overflow, array index of 'hwaddr' may be out of bounds.
> Array 'hwaddr' of size 6 may use index value(s) 6..15 :
> lwip/src/core/dhcp.c : 1683 : Critical : Analyze

I assume line 1698 in the 1.4.x branch.

  for (i = 0; i < DHCP_CHADDR_LEN; i++) {
    /* copy netif hardware address, pad with zeroes */
    dhcp->msg_out->chaddr[i] = (i < netif->hwaddr_len) ? netif->hwaddr[i] : 0/* 
pad byte*/;
  }

DHCP_CHADDR_LEN      = 16U
NETIF_MAX_HWADDR_LEN =  6U

struct netif {
  ...
  /** number of bytes used in hwaddr */
  u8_t hwaddr_len;
  /** link level hardware address of this interface */
  u8_t hwaddr[NETIF_MAX_HWADDR_LEN];

It is the responsibility of the driver to ensure
ASSERT(hwaddr_len <= NETIF_MAX_HWADDR_LEN);

and, in fact, netif/etharp.c ASSERTS hwaddr_len == ETHARP_HWADDR_LEN.

The problem with static analysis tools is that they produce
too many false positives.

-- 
Regards.