lkml.org 
[lkml]   [2006]   [Oct]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectBugs in (2.6.18) from static analysis tool
    Date
    Hi,

    We are in the final stages of refining a new static analysis framework and
    are testing it out on various large open source software projects (like
    other ventures in this space).

    Unlike other enterprises, we are making a linux intraprocedural analysis
    tool openly available in binary form to allow our results to be reproduced
    and validated. Ditto the bug lists.

    Although this is commercial software, our team are all strong OS advocates
    and contributors. We hope to release some components of this project on an
    OS basis just as soon as we can trash out a solid plan which allows this
    while also enabling us to purchase food.

    I've only attached 1 or 2 bugs at the end here (the full list is about 10K
    ascii text), there are at www.cqsat.com/linux.html#bugs. There's about 50
    and I recon 20 or so are both real and not yet identified.

    Any comments/issues/feedback is appreciated.

    -J

    ==============================================================================
    SEVERITY=[SERIOUS]
    ISSUE=[Tainted expression (tmp).kb_table used as an index in this context.
    Expression bounds: [Upper bound unchecked]. Tracking "(tmp).kb_table":
    unsigned, 8 bit(s)]
    SOURCE=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 83]
    SINK=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 88]
    ORIGINATOR=[cqsat]

    80: struct kbentry tmp;
    81: ushort *key_map, val, ov;
    82:
    83: if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
    ^^^---------^^^----------^^^
    START
    84: return -EFAULT;
    86: switch (cmd) {
    87: case KDGKBENT:
    88: key_map = key_maps[s];
    ^^^---------^^^----------^^^
    ERROR
    89: if (key_map) {
    90: val = U(key_map[i]);
    91: if (kbd->kbdmode != VC_UNICODE && KTYP(val) >=
    NR_TYPES)
    92: val = K_HOLE;
    ==============================================================================

    _________________________________________________________________
    Be seen and heard with Windows Live Messenger and Microsoft LifeCams
    http://clk.atdmt.com/MSN/go/msnnkwme0020000001msn/direct/01/?href=http://www.microsoft.com/hardware/digitalcommunication/default.mspx?locale=en-us&source=hmtagline

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-10-12 07:09    [W:0.037 / U:0.368 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site