clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name self_reloc.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -disable-red-zone -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/stand/efiboot/bootx64/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/efi/include/amd64 -D EFIBOOT -D FWRANDOM -D NEEDS_HEAP_H -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/efi/include -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/boot -D SOFTRAID -D _STANDALONE -D MDRANDOM -D BOOT_STTY -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/efi/include/amd64 -D EFIBOOT -D FWRANDOM -D NEEDS_HEAP_H -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/efi/include -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../../stand/boot -D SOFTRAID -D _STANDALONE -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../../../.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../../libsa -I . -I /usr/src/sys/arch/amd64/stand/efiboot/bootx64 -D SMALL -D SLOW -D NOBYFOUR -D __INTERNAL_LIBSA_CREAD -D HEAP_LIMIT=0xc00000 -D HIBERNATE -Oz -Wno-pointer-sign -std=gnu99 -fdebug-compilation-dir=/usr/src/sys/arch/amd64/stand/efiboot/bootx64/obj -ferror-limit 19 -fwrapv -fcf-protection=branch -fno-jump-tables -fno-builtin -fwchar-type=short -fno-signed-wchar -fgnuc-version=4.2.1 -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/sys/arch/amd64/stand/efiboot/bootx64/../self_reloc.c
1 | |
2 | |
3 | |
4 | |
5 | |
6 | |
7 | |
8 | |
9 | |
10 | |
11 | |
12 | |
13 | |
14 | |
15 | |
16 | |
17 | |
18 | |
19 | |
20 | |
21 | |
22 | |
23 | |
24 | |
25 | |
26 | |
27 | |
28 | #include <sys/param.h> |
29 | #include <machine/reloc.h> |
30 | |
31 | #if defined(__aarch64__) || defined(__amd64__) |
32 | #define ELFSIZE 64 |
33 | #define ElfW_Rel Elf64_Rela |
34 | #define ElfW_Dyn Elf64_Dyn |
35 | #define ELFW_R_TYPE ELF64_R_TYPE |
36 | #define ELF_RELA |
37 | #elif defined(__arm__) || defined(__i386__) |
38 | #define ELFSIZE 32 |
39 | #define ElfW_Rel Elf32_Rel |
40 | #define ElfW_Dyn Elf32_Dyn |
41 | #define ELFW_R_TYPE ELF32_R_TYPE |
42 | #else |
43 | #error architecture not supported |
44 | #endif |
45 | |
46 | #include <sys/exec_elf.h> |
47 | |
48 | #if defined(__aarch64__) |
49 | #define RELOC_TYPE_NONE R_AARCH64_NONE |
50 | #define RELOC_TYPE_RELATIVE R_AARCH64_RELATIVE |
51 | #elif defined(__amd64__) |
52 | #define RELOC_TYPE_NONE R_X86_64_NONE |
53 | #define RELOC_TYPE_RELATIVE R_X86_64_RELATIVE |
54 | #elif defined(__arm__) |
55 | #define RELOC_TYPE_NONE R_ARM_NONE |
56 | #define RELOC_TYPE_RELATIVE R_ARM_RELATIVE |
57 | #elif defined(__i386__) |
58 | #define RELOC_TYPE_NONE R_386_NONE |
59 | #define RELOC_TYPE_RELATIVE R_386_RELATIVE |
60 | #endif |
61 | |
62 | |
63 | |
64 | |
65 | void |
66 | self_reloc(Elf_Addr baseaddr, ElfW_Dyn *dynamic) |
67 | { |
68 | Elf_Word relsz, relent; |
69 | Elf_Addr *newaddr; |
70 | ElfW_Rel *rel = NULL; |
| 1 | 'rel' initialized to a null pointer value | |
|
71 | ElfW_Dyn *dynp; |
72 | |
73 | |
74 | |
75 | |
76 | relsz = 0; |
77 | relent = 0; |
78 | for (dynp = dynamic; dynp->d_tag != DT_NULL; dynp++) { |
| 2 | | Assuming field 'd_tag' is not equal to DT_NULL | |
|
| 3 | | Loop condition is true. Entering loop body | |
|
| 6 | | Assuming field 'd_tag' is equal to DT_NULL | |
|
| 7 | | Loop condition is false. Execution continues on line 102 | |
|
79 | switch (dynp->d_tag) { |
| 4 | | Control jumps to 'case 8:' at line 85 | |
|
80 | case DT_REL: |
81 | case DT_RELA: |
82 | rel = (ElfW_Rel *)(dynp->d_un.d_ptr + baseaddr); |
83 | break; |
84 | case DT_RELSZ: |
85 | case DT_RELASZ: |
86 | relsz = dynp->d_un.d_val; |
87 | break; |
| 5 | | Execution continues on line 78 | |
|
88 | case DT_RELENT: |
89 | case DT_RELAENT: |
90 | relent = dynp->d_un.d_val; |
91 | break; |
92 | default: |
93 | break; |
94 | } |
95 | } |
96 | |
97 | |
98 | |
99 | |
100 | |
101 | |
102 | for (; relsz > 0; relsz -= relent) { |
| |
| 9 | | Loop condition is true. Entering loop body | |
|
103 | switch (ELFW_R_TYPE(rel->r_info)) { |
| 10 | | Access to field 'r_info' results in a dereference of a null pointer (loaded from variable 'rel') |
|
104 | case RELOC_TYPE_NONE: |
105 | |
106 | break; |
107 | |
108 | case RELOC_TYPE_RELATIVE: |
109 | newaddr = (Elf_Addr *)(rel->r_offset + baseaddr); |
110 | #ifdef ELF_RELA |
111 | |
112 | *newaddr = baseaddr + rel->r_addend; |
113 | #else |
114 | |
115 | *newaddr += baseaddr; |
116 | #endif |
117 | break; |
118 | default: |
119 | |
120 | break; |
121 | } |
122 | rel = (ElfW_Rel *) ((caddr_t) rel + relent); |
123 | } |
124 | } |