emulator: Fix integer truncation warnings Error: INTEGER_OVERFLOW (CWE-190): [#def1] [important] emulator/amp.c:693:2: cast_overflow: Truncation due to cast operation on "(remain_assoc_len > 248) ? 248 : remain_assoc_len" from 32 to 16 bits. emulator/amp.c:693:2: overflow_assign: "fragment_len" is assigned from "(remain_assoc_len > 248) ? 248 : remain_assoc_len". emulator/amp.c:698:2: overflow_sink: "fragment_len", which might have overflowed, is passed to "memcpy(rsp.assoc_fragment, amp->local_assoc + len_so_far, fragment_len)". [Note: The source code implementation of the function has been overridden by a builtin model.] 696| rsp.phy_handle = cmd->phy_handle; 697| rsp.remain_assoc_len = cpu_to_le16(remain_assoc_len); 698|-> memcpy(rsp.assoc_fragment, amp->local_assoc + len_so_far, 699| fragment_len); 700| Error: INTEGER_OVERFLOW (CWE-190): [#def2] [important] emulator/amp.c:701:2: cast_overflow: Truncation due to cast operation on "4 + fragment_len" from 32 to 8 bits. emulator/amp.c:701:2: overflow_sink: "4 + fragment_len", which might have overflowed, is passed to "cmd_complete(amp, 5130, &rsp, 4 + fragment_len)". 699| fragment_len); 700| 701|-> cmd_complete(amp, BT_HCI_CMD_READ_LOCAL_AMP_ASSOC, 702| &rsp, 4 + fragment_len); 703| } Error: INTEGER_OVERFLOW (CWE-190): [#def4] [important] emulator/bthost.c:3309:3: cast_overflow: Truncation due to cast operation on "len - offset" from 32 to 8 bits. emulator/bthost.c:3309:3: overflow_assign: "cp->data_len" is assigned from "len - offset". emulator/bthost.c:3317:2: overflow_sink: "cp->data_len", which might have overflowed, is passed to "memcpy(cp->data, data + offset, cp->data_len)". [Note: The source code implementation of the function has been overridden by a builtin model.] 3315| } 3316| 3317|-> memcpy(cp->data, data + offset, cp->data_len); 3318| 3319| send_command(bthost, BT_HCI_CMD_LE_SET_PA_DATA, buf,

Diffstat

2 files changed, 7 insertions(+), 4 deletions(-)