Add a similar assertion to the other tests to avoid passing negative len to tester_monitor() which might result in crashes. Error: OVERRUN (CWE-119): [#def13] [important] bluez-5.77/src/shared/tester.c:946:2: return_constant: Function call "io_send(io, iov, 1)" may return -107. bluez-5.77/src/shared/tester.c:946:2: assignment: Assigning: "len" = "io_send(io, iov, 1)". The value of "len" is now -107. bluez-5.77/src/shared/tester.c:948:2: overrun-buffer-arg: Calling "tester_monitor" with "iov->iov_base" and "len" is suspicious because of the very large index, 18446744073709551509. The index may be due to a negative parameter being interpreted as unsigned. 946| len = io_send(io, iov, 1); 947| 948|-> tester_monitor('<', 0x0004, 0x0000, iov->iov_base, len); 949| 950| g_assert_cmpint(len, ==, iov->iov_len); --- src/shared/tester.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/shared/tester.c b/src/shared/tester.c index 56c8cba6f578..3053025d7945 100644 --- a/src/shared/tester.c +++ b/src/shared/tester.c @@ -945,6 +945,8 @@ static bool test_io_send(struct io *io, void *user_data) len = io_send(io, iov, 1); + g_assert(len > 0); + tester_monitor('<', 0x0004, 0x0000, iov->iov_base, len); g_assert_cmpint(len, ==, iov->iov_len); -- 2.45.2