Merge branch 'feature/gcc-fanalyzer_v5.2' into 'release/v5.2'

Fix issues found by gnu static analyzer job (v5.2)

See merge request espressif/esp-idf!32983

components/driver/usb_serial_jtag/usb_serial_jtag.c

@@ -137,13 +137,13 @@ esp_err_t usb_serial_jtag_driver_install(usb_serial_jtag_driver_config_t *usb_se
     ESP_RETURN_ON_FALSE((usb_serial_jtag_config->rx_buffer_size > USB_SER_JTAG_RX_MAX_SIZE), ESP_ERR_INVALID_ARG, USB_SERIAL_JTAG_TAG, "RX buffer prepared is so small, should larger than 64");
     ESP_RETURN_ON_FALSE((usb_serial_jtag_config->tx_buffer_size > 0), ESP_ERR_INVALID_ARG, USB_SERIAL_JTAG_TAG, "TX buffer is not prepared");
     p_usb_serial_jtag_obj = (usb_serial_jtag_obj_t*) heap_caps_calloc(1, sizeof(usb_serial_jtag_obj_t), MALLOC_CAP_INTERNAL | MALLOC_CAP_8BIT);
-    p_usb_serial_jtag_obj->tx_stash_cnt = 0;
     if (p_usb_serial_jtag_obj == NULL) {
         ESP_LOGE(USB_SERIAL_JTAG_TAG, "memory allocate error");
         // no `goto _exit` here as there's nothing to clean up and that would make the uninstall
         // routine unhappy.
         return ESP_ERR_NO_MEM;
     }
+    p_usb_serial_jtag_obj->tx_stash_cnt = 0;
 
     p_usb_serial_jtag_obj->rx_ring_buf = xRingbufferCreate(usb_serial_jtag_config->rx_buffer_size, RINGBUF_TYPE_BYTEBUF);
     if (p_usb_serial_jtag_obj->rx_ring_buf == NULL) {

components/esp_hw_support/dma/gdma.c

@@ -135,8 +135,8 @@ static esp_err_t do_allocate_gdma_channel(const gdma_channel_search_info_t *sear
 
     for (int i = start_group_id; i < end_group_id && search_code; i++) { // loop to search group
         group = gdma_acquire_group_handle(i, search_info->hal_init);
-        group->bus_id = search_info->bus_id;
         ESP_GOTO_ON_FALSE(group, ESP_ERR_NO_MEM, err, TAG, "no mem for group(%d)", i);
+        group->bus_id = search_info->bus_id;
         for (int j = 0; j < pairs_per_group && search_code; j++) { // loop to search pair
             pair = gdma_acquire_pair_handle(group, j);
             ESP_GOTO_ON_FALSE(pair, ESP_ERR_NO_MEM, err, TAG, "no mem for pair(%d,%d)", i, j);

components/esp_hw_support/esp_clock_output.c

@@ -62,7 +62,9 @@ static clkout_channel_handle_t* clkout_channel_alloc(soc_clkout_sig_id_t clk_sig
         (s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].mapped_clock == clk_sig)) {
         allocated_channel = &s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)];
     }
-    allocated_channel->channel_id = (clock_out_channel_t)IONUM_TO_CLKOUT_CHANNEL(gpio_num);
+    if (allocated_channel != NULL) {
+        allocated_channel->channel_id = (clock_out_channel_t)IONUM_TO_CLKOUT_CHANNEL(gpio_num);
+    }
     portEXIT_CRITICAL(&s_clkout_handle[IONUM_TO_CLKOUT_CHANNEL(gpio_num)].clkout_channel_lock);
 #elif SOC_GPIO_CLOCKOUT_BY_GPIO_MATRIX
     for(uint32_t channel = 0; channel < CLKOUT_CHANNEL_MAX; channel++) {
@@ -114,6 +116,9 @@ static esp_clock_output_mapping_t* clkout_mapping_alloc(clkout_channel_handle_t*
 
     if (allocated_mapping == NULL) {
         allocated_mapping = (esp_clock_output_mapping_t *)malloc(sizeof(esp_clock_output_mapping_t));
+        if (!allocated_mapping) {
+            return NULL;
+        }
         allocated_mapping->mapped_io = gpio_num;
         allocated_mapping->clkout_channel_hdl = channel_hdl;
         allocated_mapping->ref_cnt = 0;

components/heap/heap_caps_init.c

@@ -93,6 +93,7 @@ void heap_caps_init(void)
         const soc_memory_type_desc_t *type = &soc_memory_types[region->type];
         heap_t *heap = &temp_heaps[heap_idx];
         if (region->type == -1) {
+            memset(heap, 0, sizeof(*heap));
             continue;
         }
         heap_idx++;

components/usb/hcd_dwc.c

@@ -1424,8 +1424,11 @@ static dma_buffer_block_t *buffer_block_alloc(usb_transfer_type_t type)
         break;
     }
     dma_buffer_block_t *buffer = calloc(1, sizeof(dma_buffer_block_t));
+    if (buffer == NULL) {
+        return NULL;
+    }
     void *xfer_desc_list = heap_caps_aligned_calloc(USB_DWC_QTD_LIST_MEM_ALIGN, desc_list_len, sizeof(usb_dwc_ll_dma_qtd_t), MALLOC_CAP_DMA);
-    if (buffer == NULL || xfer_desc_list == NULL) {
+    if (xfer_desc_list == NULL) {
         free(buffer);
         heap_caps_free(xfer_desc_list);
         return NULL;

components/usb/usb_phy.c

@@ -340,8 +340,10 @@ esp_err_t usb_new_phy(const usb_phy_config_t *config, usb_phy_handle_t *handle_r
     return ESP_OK;
 
 cleanup:
-    free(phy_context->iopins);
+    if (phy_context) {
-    free(phy_context);
+        free(phy_context->iopins);
+        free(phy_context);
+    }
     if (p_phy_ctrl_obj->ref_count == 0) {
         free(p_phy_ctrl_obj);
         p_phy_ctrl_obj = NULL;

components/vfs/vfs_eventfd.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -107,12 +107,16 @@ static esp_err_t event_start_select(int                  nfds,
     for (int i = 0; i < nfds; i++) {
         _lock_acquire_recursive(&s_events[i].lock);
         if (s_events[i].fd == i && (FD_ISSET(i, readfds) || FD_ISSET(i, writefds) || FD_ISSET(i, exceptfds))) {
+            event_select_args_t *event_select_args =
+                (event_select_args_t *)malloc(sizeof(event_select_args_t));
+            if (!event_select_args) {
+                _lock_release_recursive(&s_events[i].lock);
+                return ESP_ERR_NO_MEM;
+            }
             if (s_events[i].support_isr) {
                 portENTER_CRITICAL(&s_events[i].data_spin_lock);
             }
 
-            event_select_args_t *event_select_args =
-                (event_select_args_t *)malloc(sizeof(event_select_args_t));
             event_select_args->fd = i;
             event_select_args->signal_sem = signal_sem;
 

components/wpa_supplicant/src/ap/ieee802_1x.c

@@ -433,6 +433,8 @@ int ieee802_1x_init(struct hostapd_data *hapd)
 
 	os_memset(&conf, 0, sizeof(conf));
 	eap_cfg = os_zalloc(sizeof(struct eap_config));
+	if (!eap_cfg)
+		return -1;
 	eap_cfg->max_auth_rounds = 100;
 	eap_cfg->max_auth_rounds_short = 50;
 	//eap_cfg->backend_auth = 1;

components/wpa_supplicant/src/common/ieee802_11_common.c

@@ -202,6 +202,10 @@ static int ieee802_11_parse_vendor_specific(struct wpa_supplicant *wpa_s, const
 		case SAE_PK_OUI_TYPE:
 			wpa_s->sae_pk_elems.sae_pk_len = elem->datalen - 4;
 			wpa_s->sae_pk_elems.sae_pk = (u8*)os_zalloc(sizeof(u8)*(elem->datalen-4));
+			if (!wpa_s->sae_pk_elems.sae_pk) {
+			    wpa_printf(MSG_EXCESSIVE, "Can not allocate memory for sae_pk");
+			    return -1;
+			}
 			os_memcpy(wpa_s->sae_pk_elems.sae_pk, pos+4, elem->datalen-4);
 			break;
 		default: