CodeSonar : Irssi : Null Pointer Dereference

Irssi : Irssi analysis 1 : Null Pointer Dereference at textbuffer-view.c:351

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	2349.2359
Procedure:	view_line_draw
Trace:	View
Modified:	Wed Sep 2 12:19:33 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Analysis:

Irssi analysis 1

Analysis ID:

Started:

Wed Sep 2 10:24:04 2009 show details hide details

by user:	paul
on host:	green.grammatech.com
at address:	10.233.219.86

Finished:

Wed Sep 2 12:25:44 2009 show logs hide logs

build:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar parse:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar analysis:	[Full] [Streamed Full] [Tail] [Streamed Tail]

Analysis State:

Finished

Detected:

Wed Sep 2 12:19:33 2009

First Detected:

Wed Sep 2 12:19:33 2009

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Show Legend Hide Legend

Problem	Line	Source

			/u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c

			Enter view_line_draw

	337		static int view_line_draw(TEXT_BUFFER_VIEW_REC view, LINE_REC line,
	338		int subline, int ypos, int max)
	339		{
	340		INDENT_FUNC indent_func;
	341		LINE_CACHE_REC *cache;
	342		const unsigned char text, end, *text_newline;
	343		unsigned char *tmp;
	344		unichar chr;
	345		int xpos, color, drawcount, first, need_move, need_clrtoeol, char_width;
	346
	347		if (view->dirty) /* don't bother drawing anything - redraw is coming */
	348		return 0;
	349

true

350

cache = textbuffer_view_get_line_cache(view, line );

x Problem
true

					Enter view_line_draw / textbuffer_view_get_line_cache

893

LINE_CACHE_REC *textbuffer_view_get_line_cache(TEXT_BUFFER_VIEW_REC *view,

894

LINE_REC *line)

895

{

896

LINE_CACHE_REC *cache;

897

898

g_assert(view != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

899

g_assert(line != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

900

901

cache = g_hash_table_lookup(view->cache->line_cache, line); /* Null Pointer Dereference (ID: 2356.2367) */

902

if (cache == NULL)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

true

903

cache = view_update_line_cache (view, line );

x Problem
true

							Enter view_line_draw / textbuffer_view_get_line_cache / view_update_line_cache

164

static LINE_CACHE_REC *

165

view_update_line_cache(TEXT_BUFFER_VIEW_REC *view, LINE_REC *line)

166

{

167

INDENT_FUNC indent_func;

168

LINE_CACHE_REC *rec;

169

LINE_CACHE_SUB_REC *sub;

170

GSList *lines;

171

unsigned char cmd;

172

const unsigned char *ptr, *next_ptr, *last_space_ptr;

173

int xpos, pos, indent_pos, last_space, last_color, color, linecount;

int char_width;

g_return_val_if_fail(line->text != NULL, NULL); /* Null Pointer Dereference (ID: 2355.2366) */

x Problem
true

x /usr/include/glib-2.0/glib/gmessages.h
262	#define g_return_val_if_fail(expr,val) G_STMT_START{ \
263	if G_LIKELY(expr) { } else \
264	{ \
265	g_return_if_fail_warning (G_LOG_DOMAIN, \
266	__PRETTY_FUNCTION__, \
267	#expr); \
268	return (val); \
269	}; }G_STMT_END

x /usr/include/glib-2.0/glib/gmacros.h
229	# define G_STMT_START (void) __extension__ (

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
230	# define G_STMT_END )

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

177

178

color = ATTR_RESETFG | ATTR_RESETBG;

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
7	#define ATTR_RESETFG 0x0100

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
8	#define ATTR_RESETBG 0x0200

179

xpos = 0; indent_pos = view->default_indent;

180

last_space = last_color = 0; last_space_ptr = NULL; sub = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

181

182

indent_func = view->default_indent_func;

183

linecount = 1;

184

lines = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

185

for (ptr = line->text;;) {

186

if (*ptr == '\0') {

...

283

memcpy(&rec->lines[pos], data,

284

sizeof(LINE_CACHE_SUB_REC));

285

286

lines = g_slist_remove(lines, data);

g_free(data);

}

}

g_hash_table_insert(view->cache->line_cache, line, rec);

292

return rec;

view_update_line_cache$return <= 4095

293

}

x Problem
view_update_line_cache$return <= 4095

							Exit view_line_draw / textbuffer_view_get_line_cache / view_update_line_cache

904

else

905

cache->last_access = time(NULL);

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

906

$unknown_92524355 <= 4095

907

return cache;

x Problem
$unknown_92524355 <= 4095

textbuffer_view_get_line_cache$return <= 4095

908

}

x Problem
textbuffer_view_get_line_cache$return <= 4095

					Exit view_line_draw / textbuffer_view_get_line_cache

cache <= 4095

351

if (subline >= cache->count) /* Null Pointer Dereference */

x Problem
cache <= 4095

Preconditions

((char*)$param_1)[104] = 0

Postconditions

cache' = 0
line' = $param_2
max' = $param_5
subline' = $param_3
view' = $param_1
ypos' = $param_4

Change Warning 2349.2359 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: