New Defects reported by Coverity Scan for digiKam

[scan-admin]

Hi,

Please find the latest report on new defect(s) introduced to digiKam found with Coverity Scan.

20 new defect(s) introduced to digiKam found with Coverity Scan.
8 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 20 defect(s)


** CID 1375970:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 368 in libraw_set_wf_debanding()


________________________________________________________________________________________________________
*** CID 1375970:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 368 in libraw_set_wf_debanding()
362     DllDef void libraw_set_wf_debanding(libraw_data_t *lr, int wf_debanding, float wfd0, float wfd1, float wfd2, float wfd3)
363     {
364     if(!lr) return;
365     LibRaw *ip = (LibRaw*) lr->parent_class;
366     ip->imgdata.params.wf_debanding = wf_debanding;
367     ip->imgdata.params.wf_deband_treshold[0] = wfd0;
>>>     CID 1375970:  Incorrect expression  (UNUSED_VALUE)
>>>     Assigning value from "wfd1" to "ip->imgdata.params.wf_deband_treshold[0]" here, but that stored value is overwritten before it can be used.
368     ip->imgdata.params.wf_deband_treshold[0] = wfd1;
369     ip->imgdata.params.wf_deband_treshold[0] = wfd2;
370     ip->imgdata.params.wf_deband_treshold[0] = wfd3;
371     }
372    
373     DllDef void libraw_set_interpolation_passes(libraw_data_t *lr,int passes)

** CID 1375969:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 369 in libraw_set_wf_debanding()


________________________________________________________________________________________________________
*** CID 1375969:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 369 in libraw_set_wf_debanding()
363     {
364     if(!lr) return;
365     LibRaw *ip = (LibRaw*) lr->parent_class;
366     ip->imgdata.params.wf_debanding = wf_debanding;
367     ip->imgdata.params.wf_deband_treshold[0] = wfd0;
368     ip->imgdata.params.wf_deband_treshold[0] = wfd1;
>>>     CID 1375969:  Incorrect expression  (UNUSED_VALUE)
>>>     Assigning value from "wfd2" to "ip->imgdata.params.wf_deband_treshold[0]" here, but that stored value is overwritten before it can be used.
369     ip->imgdata.params.wf_deband_treshold[0] = wfd2;
370     ip->imgdata.params.wf_deband_treshold[0] = wfd3;
371     }
372    
373     DllDef void libraw_set_interpolation_passes(libraw_data_t *lr,int passes)
374     {

** CID 1375968:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 367 in libraw_set_wf_debanding()


________________________________________________________________________________________________________
*** CID 1375968:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_c_api.cpp: 367 in libraw_set_wf_debanding()
361    
362     DllDef void libraw_set_wf_debanding(libraw_data_t *lr, int wf_debanding, float wfd0, float wfd1, float wfd2, float wfd3)
363     {
364     if(!lr) return;
365     LibRaw *ip = (LibRaw*) lr->parent_class;
366     ip->imgdata.params.wf_debanding = wf_debanding;
>>>     CID 1375968:  Incorrect expression  (UNUSED_VALUE)
>>>     Assigning value from "wfd0" to "ip->imgdata.params.wf_deband_treshold[0]" here, but that stored value is overwritten before it can be used.
367     ip->imgdata.params.wf_deband_treshold[0] = wfd0;
368     ip->imgdata.params.wf_deband_treshold[0] = wfd1;
369     ip->imgdata.params.wf_deband_treshold[0] = wfd2;
370     ip->imgdata.params.wf_deband_treshold[0] = wfd3;
371     }
372    

** CID 1375967:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 1807 in x3f_load_huffman(x3f_info_s *, x3f_directory_entry_s *, int, int, int)()


________________________________________________________________________________________________________
*** CID 1375967:  Incorrect expression  (UNUSED_VALUE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 1807 in x3f_load_huffman(x3f_info_s *, x3f_directory_entry_s *, int, int, int)()
1801     HUF->x3rgb16.row_stride = ID->columns * 3;
1802     HUF->x3rgb16.buf = malloc(sizeof(uint16_t)*size);
1803     HUF->x3rgb16.data = (uint16_t *)HUF->x3rgb16.buf;
1804     break;
1805     case X3F_IMAGE_THUMB_HUFFMAN:
1806     size = ID->columns * ID->rows * 3;
>>>     CID 1375967:  Incorrect expression  (UNUSED_VALUE)
>>>     Assigning value from "ID->columns" to "HUF->rgb8.columns" here, but that stored value is overwritten before it can be used.
1807     HUF->rgb8.columns = ID->columns;
1808     HUF->rgb8.columns = ID->rows;
1809     HUF->rgb8.channels = 3;
1810     HUF->rgb8.row_stride = ID->columns * 3;
1811     HUF->rgb8.buf = malloc(sizeof(uint8_t)*size);
1812     HUF->rgb8.data = (uint8_t *)HUF->rgb8.buf;

** CID 1375966:  Control flow issues  (UNREACHABLE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 1504 in simple_decode_row(x3f_info_s *, x3f_directory_entry_s *, int, int, int)()


________________________________________________________________________________________________________
*** CID 1375966:  Control flow issues  (UNREACHABLE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 1504 in simple_decode_row(x3f_info_s *, x3f_directory_entry_s *, int, int, int)()
1498       case 12:
1499         mask = 0xfff;
1500         break;
1501       default:
1502         /* TODO: Shouldn't this be treated as a fatal error? */
1503     throw LIBRAW_EXCEPTION_IO_CORRUPT;
>>>     CID 1375966:  Control flow issues  (UNREACHABLE)
>>>     This code cannot be reached: "mask = 0U;".
1504         mask = 0;
1505         break;
1506       }
1507    
1508       for (col = 0; col < ID->columns; col++) {
1509         int color;

** CID 1375965:  Memory - illegal accesses  (UNINIT)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_xtrans_compressed.cpp: 228 in LibRaw::copy_line_to_xtrans(xtrans_block *, int, int, int)()


________________________________________________________________________________________________________
*** CID 1375965:  Memory - illegal accesses  (UNINIT)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_xtrans_compressed.cpp: 228 in LibRaw::copy_line_to_xtrans(xtrans_block *, int, int, int)()
222     case 2:     // blue
223     line_buf = lineBufB[row_count >> 1];
224     break;
225     }
226    
227     index = (((pixel_count*2/3) & 0x7FFFFFFE) | ((pixel_count % 3) & 1)) + ((pixel_count % 3) >> 1);
>>>     CID 1375965:  Memory - illegal accesses  (UNINIT)
>>>     Using uninitialized value "line_buf".
228     raw_block_data[pixel_count] = line_buf[index];
229    
230     ++pixel_count;
231     }
232     ++row_count;
233     raw_block_data += imgdata.sizes.raw_width;

** CID 1375964:  Security best practices violations  (STRING_OVERFLOW)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 8299 in LibRaw::parse_makernote(int, int)()


________________________________________________________________________________________________________
*** CID 1375964:  Security best practices violations  (STRING_OVERFLOW)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 8299 in LibRaw::parse_makernote(int, int)()
8293              unsigned c;
8294              stmread(FujiSerial, len, ifp);
8295              nwords = getwords(FujiSerial, words, 4,sizeof(imgdata.shootinginfo.InternalBodySerial));
8296              for (int i = 0; i < nwords; i++) {
8297                mm[2] = dd[2] = 0;
8298                if (strlen(words[i]) < 18)
>>>     CID 1375964:  Security best practices violations  (STRING_OVERFLOW)
>>>     You might overrun the 64 byte fixed-size string "this->imgdata.shootinginfo.InternalBodySerial" by copying "words[0]" without checking the length.
8299                   if (i == 0) strcpy (imgdata.shootinginfo.InternalBodySerial, words[0]);
8300                   else snprintf (imgdata.shootinginfo.InternalBodySerial, sizeof(imgdata.shootinginfo.InternalBodySerial), "%s %s", imgdata.shootinginfo.InternalBodySerial, words[i]);
8301                else
8302                {
8303                  strncpy (dd, words[i]+strlen(words[i])-14, 2);
8304                  strncpy (mm, words[i]+strlen(words[i])-16, 2);

** CID 1375963:    (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7306 in LibRaw::process_Sony_0x9050(unsigned char *, unsigned int)()
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7309 in LibRaw::process_Sony_0x9050(unsigned char *, unsigned int)()


________________________________________________________________________________________________________
*** CID 1375963:    (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7306 in LibRaw::process_Sony_0x9050(unsigned char *, unsigned int)()
7300                                SonySubstitution[buf[0x116]]);
7301       else if (imgdata.lens.makernotes.CameraMount != LIBRAW_MOUNT_FixedLens)
7302         parseSonyLensFeatures (SonySubstitution[buf[0x116]],
7303                                SonySubstitution[buf[0x117]]);
7304    
7305        if ((id==347) || (id==350) || (id==357))
>>>     CID 1375963:    (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension: "SonySubstitution[buf[138]]" with type "unsigned char" (8 bits, unsigned) is promoted in "SonySubstitution[buf[138]] << 24" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed).  If "SonySubstitution[buf[138]] << 24" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
7306          sprintf(imgdata.shootinginfo.InternalBodySerial, "%06lx", ((long)SonySubstitution[buf[0x88]]<<40) + ((long)SonySubstitution[buf[0x89]]<<32) + (SonySubstitution[buf[0x8a]]<<24) + (SonySubstitution[buf[0x8b]]<<16) + (SonySubstitution[buf[0x8c]]<<8) +SonySubstitution[buf[0x8d]]);
7307    
7308        else if ((imgdata.lens.makernotes.CameraMount == LIBRAW_MOUNT_Minolta_A) && (id > 279) && (id != 282) && (id != 283))
7309          sprintf(imgdata.shootinginfo.InternalBodySerial, "%05lx", ((long)SonySubstitution[buf[0xf0]]<<32) + (SonySubstitution[buf[0xf1]]<<24) + (SonySubstitution[buf[0xf2]]<<16) + (SonySubstitution[buf[0xf3]]<<8) +SonySubstitution[buf[0xf4]]);
7310    
7311        else if ((imgdata.lens.makernotes.CameraMount == LIBRAW_MOUNT_Sony_E) && (id != 288) && (id != 289)  && (id != 290))
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7309 in LibRaw::process_Sony_0x9050(unsigned char *, unsigned int)()
7303                                SonySubstitution[buf[0x117]]);
7304    
7305        if ((id==347) || (id==350) || (id==357))
7306          sprintf(imgdata.shootinginfo.InternalBodySerial, "%06lx", ((long)SonySubstitution[buf[0x88]]<<40) + ((long)SonySubstitution[buf[0x89]]<<32) + (SonySubstitution[buf[0x8a]]<<24) + (SonySubstitution[buf[0x8b]]<<16) + (SonySubstitution[buf[0x8c]]<<8) +SonySubstitution[buf[0x8d]]);
7307    
7308        else if ((imgdata.lens.makernotes.CameraMount == LIBRAW_MOUNT_Minolta_A) && (id > 279) && (id != 282) && (id != 283))
>>>     CID 1375963:    (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension: "SonySubstitution[buf[241]]" with type "unsigned char" (8 bits, unsigned) is promoted in "SonySubstitution[buf[241]] << 24" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed).  If "SonySubstitution[buf[241]] << 24" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
7309          sprintf(imgdata.shootinginfo.InternalBodySerial, "%05lx", ((long)SonySubstitution[buf[0xf0]]<<32) + (SonySubstitution[buf[0xf1]]<<24) + (SonySubstitution[buf[0xf2]]<<16) + (SonySubstitution[buf[0xf3]]<<8) +SonySubstitution[buf[0xf4]]);
7310    
7311        else if ((imgdata.lens.makernotes.CameraMount == LIBRAW_MOUNT_Sony_E) && (id != 288) && (id != 289)  && (id != 290))
7312          sprintf(imgdata.shootinginfo.InternalBodySerial, "%04x", (SonySubstitution[buf[0x7c]]<<24) + (SonySubstitution[buf[0x7d]]<<16) + (SonySubstitution[buf[0x7e]]<<8) +SonySubstitution[buf[0x7f]]);
7313    
7314       return;

** CID 1375962:  Integer handling issues  (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_cxx.cpp: 2521 in LibRaw::unpack()()


________________________________________________________________________________________________________
*** CID 1375962:  Integer handling issues  (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_cxx.cpp: 2521 in LibRaw::unpack()()
2515                 S.iwidth = S.width;
2516                 S.iheight= S.height;
2517                 IO.shrink = 0;
2518                 S.raw_pitch = S.raw_width*8;
2519                 // allocate image as temporary buffer, size
2520                 imgdata.rawdata.raw_alloc = 0;
>>>     CID 1375962:  Integer handling issues  (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension: "this->imgdata.sizes.raw_width" with type "unsigned short" (16 bits, unsigned) is promoted in "this->imgdata.sizes.raw_width * this->imgdata.sizes.raw_height" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned).  If "this->imgdata.sizes.raw_width * this->imgdata.sizes.raw_height" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
2521                 imgdata.image = (ushort (*)[4]) calloc(S.raw_width*S.raw_height,sizeof(*imgdata.image));
2522     if(!(decoder_info.decoder_flags &  LIBRAW_DECODER_ADOBECOPYPIXEL))
2523     {
2524     imgdata.rawdata.raw_image = (ushort*) imgdata.image ;
2525     zero_rawimage = 1;
2526     }

** CID 1375961:  Integer handling issues  (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_cxx.cpp: 2521 in LibRaw::unpack()()


________________________________________________________________________________________________________
*** CID 1375961:  Integer handling issues  (SIGN_EXTENSION)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/src/libraw_cxx.cpp: 2521 in LibRaw::unpack()()
2515                 S.iwidth = S.width;
2516                 S.iheight= S.height;
2517                 IO.shrink = 0;
2518                 S.raw_pitch = S.raw_width*8;
2519                 // allocate image as temporary buffer, size
2520                 imgdata.rawdata.raw_alloc = 0;
>>>     CID 1375961:  Integer handling issues  (SIGN_EXTENSION)
>>>     Suspicious implicit sign extension: "this->imgdata.sizes.raw_height" with type "unsigned short" (16 bits, unsigned) is promoted in "this->imgdata.sizes.raw_width * this->imgdata.sizes.raw_height" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned).  If "this->imgdata.sizes.raw_width * this->imgdata.sizes.raw_height" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
2521                 imgdata.image = (ushort (*)[4]) calloc(S.raw_width*S.raw_height,sizeof(*imgdata.image));
2522     if(!(decoder_info.decoder_flags &  LIBRAW_DECODER_ADOBECOPYPIXEL))
2523     {
2524     imgdata.rawdata.raw_image = (ushort*) imgdata.image ;
2525     zero_rawimage = 1;
2526     }

** CID 1375960:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/demosaic-pack-GPL2/ahd_interpolate_mod.c: 137 in LibRaw::ahd_interpolate_mod()()


________________________________________________________________________________________________________
*** CID 1375960:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/demosaic-pack-GPL2/ahd_interpolate_mod.c: 137 in LibRaw::ahd_interpolate_mod()()
131     pix[ width-1][c] + pix[ width+1][c] + 2) >> 2; }
132     rix[0][c] = val;
133     c = FC(row,col);
134     rix[0][c] = pix[0][c];
135     xyz[0] = xyz[1] = xyz[2] = 0.5;
136     FORCC {
>>>     CID 1375960:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array "rix[0]" of 3 2-byte elements at element index 3 (byte offset 6) using index "c" (which evaluates to 3).
137     xyz[0] += xyz_cam[0][c] * rix[0][c];
138     xyz[1] += xyz_cam[1][c] * rix[0][c];
139     xyz[2] += xyz_cam[2][c] * rix[0][c];
140     }
141     xyz[0] = cbrt[CLIP((int) xyz[0])];
142     xyz[1] = cbrt[CLIP((int) xyz[1])];

** CID 1375959:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/demosaic-pack-GPL2/ahd_partial_interpolate.c: 133 in LibRaw::ahd_partial_interpolate(int)()


________________________________________________________________________________________________________
*** CID 1375959:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/demosaic-pack-GPL2/ahd_partial_interpolate.c: 133 in LibRaw::ahd_partial_interpolate(int)()
127     pix[ width-1][c] + pix[ width+1][c] + 2) >> 2; }
128     rix[0][c] = val;
129     c = FC(row,col);
130     rix[0][c] = pix[0][c];
131     xyz[0] = xyz[1] = xyz[2] = 0.5;
132     FORCC {
>>>     CID 1375959:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array "rix[0]" of 3 2-byte elements at element index 3 (byte offset 6) using index "c" (which evaluates to 3).
133     xyz[0] += xyz_cam[0][c] * rix[0][c];
134     xyz[1] += xyz_cam[1][c] * rix[0][c];
135     xyz[2] += xyz_cam[2][c] * rix[0][c];
136     }
137     xyz[0] = cbrt[CLIP((int) xyz[0])];
138     xyz[1] = cbrt[CLIP((int) xyz[1])];

** CID 1375958:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 4956 in LibRaw::cielab(unsigned short *, short *)()


________________________________________________________________________________________________________
*** CID 1375958:  Memory - illegal accesses  (OVERRUN)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 4956 in LibRaw::cielab(unsigned short *, short *)()
4950     for (xyz_cam[i][j] = k=0; k < 3; k++)
4951      xyz_cam[i][j] += xyz_rgb[i][k] * rgb_cam[k][j] / d65_white[i];
4952         return;
4953       }
4954       xyz[0] = xyz[1] = xyz[2] = 0.5;
4955       FORCC {
>>>     CID 1375958:  Memory - illegal accesses  (OVERRUN)
>>>     Overrunning array of 3 2-byte elements at element index 3 (byte offset 6) by dereferencing pointer "rgb + c".
4956         xyz[0] += xyz_cam[0][c] * rgb[c];
4957         xyz[1] += xyz_cam[1][c] * rgb[c];
4958         xyz[2] += xyz_cam[2][c] * rgb[c];
4959       }
4960       xyz[0] = cbrt[CLIP((int) xyz[0])];
4961       xyz[1] = cbrt[CLIP((int) xyz[1])];

** CID 1375957:  Control flow issues  (NESTING_INDENT_MISMATCH)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 9751 in LibRaw::parse_exif(int)()


________________________________________________________________________________________________________
*** CID 1375957:  Control flow issues  (NESTING_INDENT_MISMATCH)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 9751 in LibRaw::parse_exif(int)()
9745                if (num > 0.01) FORC3 imgdata.color.ccm[l][c] = imgdata.color.ccm[l][c] / num;
9746              }
9747            }
9748            else
9749     #endif
9750             parse_makernote (base, 0);
>>>     CID 1375957:  Control flow issues  (NESTING_INDENT_MISMATCH)
>>>     This  statement is indented to column 9, as if it were nested within the preceding parent statement, but it is not.
9751             break;
9752           case 40962:  if (kodak) raw_width  = get4(); break;
9753           case 40963:  if (kodak) raw_height = get4(); break;
9754           case 41730:
9755     if (get4() == 0x20002)
9756      for (exif_cfa=c=0; c < 8; c+=2)

** CID 1375956:  Control flow issues  (NESTING_INDENT_MISMATCH)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7125 in LibRaw::parseSonyLensType2(unsigned char, unsigned char)()


________________________________________________________________________________________________________
*** CID 1375956:  Control flow issues  (NESTING_INDENT_MISMATCH)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 7125 in LibRaw::parseSonyLensType2(unsigned char, unsigned char)()
7119             break;
7120             }
7121           }
7122         }
7123       else
7124         imgdata.lens.makernotes.LensID = lid2;
>>>     CID 1375956:  Control flow issues  (NESTING_INDENT_MISMATCH)
>>>     This 'if'  statement is indented to column 5, as if it were nested within the preceding parent statement, but it is not.
7125         if ((lid2 >= 50481) && (lid2 < 50500))
7126         {
7127           strcpy(imgdata.lens.makernotes.Adapter, "MC-11");
7128           imgdata.lens.makernotes.AdapterID = 0x4900;
7129         }
7130       return;

** CID 1375955:  Memory - illegal accesses  (NEGATIVE_RETURNS)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 11657 in LibRaw::parse_ciff(int, int, int)()


________________________________________________________________________________________________________
*** CID 1375955:  Memory - illegal accesses  (NEGATIVE_RETURNS)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 11657 in LibRaw::parse_ciff(int, int, int)()
11651     if (!wbi) cam_mul[0] = -1; /* use my auto white balance */
11652           } else if (!cam_mul[0]) {
11653     if (get2() == key[0]) /* Pro1, G6, S60, S70 */
11654      c = (strstr(model,"Pro1") ?
11655          "012346000000000000":"01345:000000006008")[wbi]-'0'+ 2;
11656     else { /* G3, G5, S45, S50 */
>>>     CID 1375955:  Memory - illegal accesses  (NEGATIVE_RETURNS)
>>>     Using variable "wbi" as an index to array ""023457000000006000"".
11657      c = "023457000000006000"[wbi]-'0';
11658      key[0] = key[1] = 0;
11659     }
11660     fseek (ifp, 78 + c*8, SEEK_CUR);
11661     FORC4 cam_mul[c ^ (c >> 1) ^ 1] = get2() ^ key[c & 1];
11662     if (!wbi) cam_mul[0] = -1;

** CID 1375954:  Control flow issues  (DEADCODE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 781 in x3f_new_from_file(LibRaw_abstract_datastream *)()


________________________________________________________________________________________________________
*** CID 1375954:  Control flow issues  (DEADCODE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 781 in x3f_new_from_file(LibRaw_abstract_datastream *)()
775       }
776    
777       /* Traverse the directory */
778       for (d=0; d<DS->num_directory_entries; d++) {
779         x3f_directory_entry_t *DE = &DS->directory_entry[d];
780     if (!DE)
>>>     CID 1375954:  Control flow issues  (DEADCODE)
>>>     Execution cannot reach this statement: "goto _err;".
781     goto _err;
782         x3f_directory_entry_header_t *DEH = &DE->header;
783     if (!DEH)
784     goto _err;
785         uint32_t save_dir_pos;
786    

** CID 1375953:  Control flow issues  (DEADCODE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 912 in x3f_delete(x3f_s *)()


________________________________________________________________________________________________________
*** CID 1375953:  Control flow issues  (DEADCODE)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/libraw_x3f.cpp: 912 in x3f_delete(x3f_s *)()
906     if (DS->num_directory_entries > 50)
907     return X3F_ARGUMENT_ERROR;
908    
909     for (d=0; d<DS->num_directory_entries; d++) {
910     x3f_directory_entry_t *DE = &DS->directory_entry[d];
911     if (!DE)
>>>     CID 1375953:  Control flow issues  (DEADCODE)
>>>     Execution cannot reach this statement: "continue;".
912     continue;
913     x3f_directory_entry_header_t *DEH = &DE->header;
914     if (!DEH)
915     continue;
916     if (DEH->identifier == X3F_SECp) {
917     x3f_property_list_t *PL = &DEH->data_subsection.property_list;

** CID 1375952:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/samples/dcraw_emu.cpp: 319 in main()


________________________________________________________________________________________________________
*** CID 1375952:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/samples/dcraw_emu.cpp: 319 in main()
313            else if(!strcmp(optstr,"-apentax4shot"))
314     {
315        OUT.raw_processing_options |= LIBRAW_PROCESSING_PENTAX_PS_ALLFRAMES;
316     }
317            else if(!strcmp(optstr,"-apentax4shotorder"))
318     {
>>>     CID 1375952:  Memory - illegal accesses  (BUFFER_SIZE_WARNING)
>>>     Calling strncpy with a maximum size argument of 5 bytes on destination array "RawProcessor.imgdata.params.p4shot_order" of size 5 bytes might leave the destination string unterminated.
319        strncpy(OUT.p4shot_order,argv[arg++],5);
320     }
321                     else
322     #ifdef LIBRAW_DEMOSAIC_PACK_GPL3
323                       if(!strcmp(optstr,"-acae"))
324                         {

** CID 1375951:  Integer handling issues  (BAD_SHIFT)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 11670 in LibRaw::parse_ciff(int, int, int)()


________________________________________________________________________________________________________
*** CID 1375951:  Integer handling issues  (BAD_SHIFT)
/home/gilles/Devel/5.x/core/libs/rawengine/libraw/internal/dcraw_common.cpp: 11670 in LibRaw::parse_ciff(int, int, int)()
11664         }
11665         if (type == 0x10a9) { /* D60, 10D, 300D, and clones */
11666           if (len > 66) wbi = "0134567028"[wbi]-'0';
11667           fseek (ifp, 2 + wbi*8, SEEK_CUR);
11668           FORC4 cam_mul[c ^ (c >> 1)] = get2();
11669         }
>>>     CID 1375951:  Integer handling issues  (BAD_SHIFT)
>>>     In expression "0x18040 >> wbi", shifting by a negative amount has undefined behavior.  The shift amount, "wbi", is -1.
11670         if (type == 0x1030 && (0x18040 >> wbi & 1))
11671           ciff_block_1030(); /* all that don't have 0x10a9 */
11672         if (type == 0x1031) {
11673           raw_width = (get2(),get2());
11674           raw_height = get2();
11675         }


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRZIlZa20oQ0xtvekoaSXYBwgZYh7yqZ4T857KvBwnvzEg-3D-3D_Vulo-2FzB1zz6bqp-2F-2Bl-2FpBD-2BzKk1Nu56XtBupWJitvnTD-2FuY2NXJdl00iesSYncIuGISibT7qVU8uhvRWi1-2BQHTgxnqgNjbVnrJ5ipWsoqxZv0ftXqLyI71Z6QlVVkytPNJ5Mjx-2FsaQqO6TJdNwHXRbRo5-2BSEpkp4IDhr1vDcUGU0KJnoI2Ynktw0iPBEoZNLhzgNSXGSnvRM0mQOH2lbVBj53w4guO5eflAmcVBHTQxM-3D

To manage Coverity Scan email notifications for "[hidden email]", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4g-2BkTwi3e7HlDkvMAkUMj2-2FFhZ2O-2BELTTy-2Fl1ea1gxKqmntchu8-2BeAOkExRtki0102MqL9th0o1rOws5-2F-2FQDFdjkpeJaB-2FdUMxPk-2B7ZQUGV0-3D_Vulo-2FzB1zz6bqp-2F-2Bl-2FpBD-2BzKk1Nu56XtBupWJitvnTD-2FuY2NXJdl00iesSYncIuGwGm7g3j6N9vtYm26MrU5YiSVVKPWJdJ56mgmnWgLUbLDQilLkPw1D-2FVRi36tXtjIXAUZPhF-2B3aXSODDwCUPtvjr7TduXWX8wtA5kQAvXFLzgNNegpC2G1p6YrsUPIeuNUN5DTTGrzvR-2Bfw3s5E4EN8gzk68B57yyKM-2BesbDSw6w-3D