CodeSonar : Irssi : Null Pointer Dereference

Irssi : Irssi analysis 1 : Null Pointer Dereference at textbuffer-view.c:682

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	2352.2362
Procedure:	view_draw_bottom
Trace:	View
Modified:	Wed Sep 2 12:19:36 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Analysis:

Irssi analysis 1

Analysis ID:

Started:

Wed Sep 2 10:24:04 2009 show details hide details

by user:	paul
on host:	green.grammatech.com
at address:	10.233.219.86

Finished:

Wed Sep 2 12:25:44 2009 show logs hide logs

build:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar parse:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar analysis:	[Full] [Streamed Full] [Tail] [Streamed Tail]

Analysis State:

Finished

Detected:

Wed Sep 2 12:19:36 2009

First Detected:

Wed Sep 2 12:19:36 2009

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Show Legend Hide Legend

Problem	Line	Source

			/u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c

			Enter view_draw_bottom

674

static void view_draw_bottom(TEXT_BUFFER_VIEW_REC *view, int lines)

675

{

676

LINE_REC *line;

677

int ypos, maxline, subline, linecount;

678

679

maxline = view->height-lines;

680

line = view->startline; ypos = -view->subline; subline = 0;

681

while (line != NULL && ypos < maxline) {

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

true

682

linecount = view_get_linecount (view , line ); /* Null Pointer Dereference */

x Problem
true

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
43	#define view_get_linecount(view, line) \
44	textbuffer_view_get_line_cache(view, line)->count

					Enter view_draw_bottom / textbuffer_view_get_line_cache

893

LINE_CACHE_REC *textbuffer_view_get_line_cache(TEXT_BUFFER_VIEW_REC *view,

894

LINE_REC *line)

895

{

896

LINE_CACHE_REC *cache;

897

898

g_assert(view != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

899

g_assert(line != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

900

901

cache = g_hash_table_lookup(view->cache->line_cache, line); /* Null Pointer Dereference (ID: 2356.2367) */

902

if (cache == NULL)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

true

903

cache = view_update_line_cache (view, line );

x Problem
true

							Enter view_draw_bottom / textbuffer_view_get_line_cache / view_update_line_cache

164

static LINE_CACHE_REC *

165

view_update_line_cache(TEXT_BUFFER_VIEW_REC *view, LINE_REC *line)

166

{

167

INDENT_FUNC indent_func;

168

LINE_CACHE_REC *rec;

169

LINE_CACHE_SUB_REC *sub;

170

GSList *lines;

171

unsigned char cmd;

172

const unsigned char *ptr, *next_ptr, *last_space_ptr;

173

int xpos, pos, indent_pos, last_space, last_color, color, linecount;

int char_width;

g_return_val_if_fail(line->text != NULL, NULL); /* Null Pointer Dereference (ID: 2355.2366) */

x Problem
true

x /usr/include/glib-2.0/glib/gmessages.h
262	#define g_return_val_if_fail(expr,val) G_STMT_START{ \
263	if G_LIKELY(expr) { } else \
264	{ \
265	g_return_if_fail_warning (G_LOG_DOMAIN, \
266	__PRETTY_FUNCTION__, \
267	#expr); \
268	return (val); \
269	}; }G_STMT_END

x /usr/include/glib-2.0/glib/gmacros.h
229	# define G_STMT_START (void) __extension__ (

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
230	# define G_STMT_END )

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

177

178

color = ATTR_RESETFG | ATTR_RESETBG;

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
7	#define ATTR_RESETFG 0x0100

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
8	#define ATTR_RESETBG 0x0200

179

xpos = 0; indent_pos = view->default_indent;

180

last_space = last_color = 0; last_space_ptr = NULL; sub = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

181

182

indent_func = view->default_indent_func;

183

linecount = 1;

184

lines = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

185

for (ptr = line->text;;) {

186

if (*ptr == '\0') {

...

283

memcpy(&rec->lines[pos], data,

284

sizeof(LINE_CACHE_SUB_REC));

285

286

lines = g_slist_remove(lines, data);

g_free(data);

}

}

g_hash_table_insert(view->cache->line_cache, line, rec);

292

return rec;

view_update_line_cache$return <= 4095

293

}

x Problem
view_update_line_cache$return <= 4095

							Exit view_draw_bottom / textbuffer_view_get_line_cache / view_update_line_cache

904

else

905

cache->last_access = time(NULL);

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

906

$unknown_92580323 <= 4095

907

return cache;

x Problem
$unknown_92580323 <= 4095

textbuffer_view_get_line_cache$return <= 4095

908

}

x Problem
textbuffer_view_get_line_cache$return <= 4095

					Exit view_draw_bottom / textbuffer_view_get_line_cache

	683		ypos += linecount;
	684		if (ypos > maxline) {
	685		subline = maxline-(ypos-linecount);
	686		break;
	687		}
	688		line = line->next;

Postconditions

((char*)&$unknown_3092773)[8]' = &$unknown_3092774
((char*)&$unknown_3092774)[16]' = 0
line' = &$unknown_3092774
lines' = $param_2
maxline' >= -1 * ((char*)$param_1)[80] + 1
subline' = 0
view' = $param_1

Change Warning 2352.2362 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: