CodeSonar : Irssi : Null Pointer Dereference

Irssi : Irssi analysis 1 : Null Pointer Dereference at textbuffer-view.c:1039

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	2357.2368
Procedure:	view_get_lines_height
Trace:	View
Modified:	Wed Sep 2 12:19:47 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Analysis:

Irssi analysis 1

Analysis ID:

Started:

Wed Sep 2 10:24:04 2009 show details hide details

by user:	paul
on host:	green.grammatech.com
at address:	10.233.219.86

Finished:

Wed Sep 2 12:25:44 2009 show logs hide logs

build:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar parse:	[Full] [Streamed Full] [Tail] [Streamed Tail]
codesonar analysis:	[Full] [Streamed Full] [Tail] [Streamed Tail]

Analysis State:

Finished

Detected:

Wed Sep 2 12:19:47 2009

First Detected:

Wed Sep 2 12:19:47 2009

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Show Legend Hide Legend

Problem	Line	Source

			/u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c

			Enter view_get_lines_height

1030

static int view_get_lines_height(TEXT_BUFFER_VIEW_REC *view,

1031

LINE_REC *line, int subline,

1032

LINE_REC *skip_line)

1033

{

1034

int height, linecount;

1035

1036

height = -subline;

1037

while (line != NULL && height < view->height) {

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

1038

if (line != skip_line) {

true

1039

linecount = view_get_linecount (view , line ); /* Null Pointer Dereference */

x Problem
true

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
43	#define view_get_linecount(view, line) \
44	textbuffer_view_get_line_cache(view, line)->count

					Enter view_get_lines_height / textbuffer_view_get_line_cache

893

LINE_CACHE_REC *textbuffer_view_get_line_cache(TEXT_BUFFER_VIEW_REC *view,

894

LINE_REC *line)

895

{

896

LINE_CACHE_REC *cache;

897

898

g_assert(view != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

899

g_assert(line != NULL);

x /usr/include/glib-2.0/glib/gtestutils.h
56	#define g_assert(expr) do { if G_LIKELY (expr) ; else \
57	g_assertion_message_expr (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, \
58	#expr); } while (0)

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
145	# define G_STRFUNC ((const char*) (__PRETTY_FUNCTION__))

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

900

901

cache = g_hash_table_lookup(view->cache->line_cache, line); /* Null Pointer Dereference (ID: 2356.2367) */

902

if (cache == NULL)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

true

903

cache = view_update_line_cache (view, line );

x Problem
true

							Enter view_get_lines_height / textbuffer_view_get_line_cache / view_update_line_cache

164

static LINE_CACHE_REC *

165

view_update_line_cache(TEXT_BUFFER_VIEW_REC *view, LINE_REC *line)

166

{

167

INDENT_FUNC indent_func;

168

LINE_CACHE_REC *rec;

169

LINE_CACHE_SUB_REC *sub;

170

GSList *lines;

171

unsigned char cmd;

172

const unsigned char *ptr, *next_ptr, *last_space_ptr;

173

int xpos, pos, indent_pos, last_space, last_color, color, linecount;

int char_width;

g_return_val_if_fail(line->text != NULL, NULL); /* Null Pointer Dereference (ID: 2355.2366) */

x Problem
true

x /usr/include/glib-2.0/glib/gmessages.h
262	#define g_return_val_if_fail(expr,val) G_STMT_START{ \
263	if G_LIKELY(expr) { } else \
264	{ \
265	g_return_if_fail_warning (G_LOG_DOMAIN, \
266	__PRETTY_FUNCTION__, \
267	#expr); \
268	return (val); \
269	}; }G_STMT_END

x /usr/include/glib-2.0/glib/gmacros.h
229	# define G_STMT_START (void) __extension__ (

x /usr/include/glib-2.0/glib/gmacros.h
270	#define G_LIKELY(expr) (__builtin_expect (_G_BOOLEAN_EXPR(expr), 1))

x /usr/include/glib-2.0/glib/gmacros.h
261	#define _G_BOOLEAN_EXPR(expr) \
262	__extension__ ({ \
263	int _g_boolean_var_; \
264	if (expr) \
265	_g_boolean_var_ = 1; \
266	else \
267	_g_boolean_var_ = 0; \
268	_g_boolean_var_; \
269	})

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/textbuffer-view.c
21	#define G_LOG_DOMAIN "TextBufferView"

x /usr/include/glib-2.0/glib/gmacros.h
230	# define G_STMT_END )

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

177

178

color = ATTR_RESETFG | ATTR_RESETBG;

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
7	#define ATTR_RESETFG 0x0100

x /u1/paul/SATE/2010/c/irssi/irssi-0.8.14/src/fe-text/term.h
8	#define ATTR_RESETBG 0x0200

179

xpos = 0; indent_pos = view->default_indent;

180

last_space = last_color = 0; last_space_ptr = NULL; sub = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

181

182

indent_func = view->default_indent_func;

183

linecount = 1;

184

lines = NULL;

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

185

for (ptr = line->text;;) {

186

if (*ptr == '\0') {

...

283

memcpy(&rec->lines[pos], data,

284

sizeof(LINE_CACHE_SUB_REC));

285

286

lines = g_slist_remove(lines, data);

g_free(data);

}

}

g_hash_table_insert(view->cache->line_cache, line, rec);

292

return rec;

view_update_line_cache$return <= 4095

293

}

x Problem
view_update_line_cache$return <= 4095

							Exit view_get_lines_height / textbuffer_view_get_line_cache / view_update_line_cache

904

else

905

cache->last_access = time(NULL);

x /usr/lib/gcc/x86_64-unknown-linux-gnu/4.3.2/include/stddef.h
403	#define NULL ((void *)0)

906

$unknown_92976783 <= 4095

907

return cache;

x Problem
$unknown_92976783 <= 4095

textbuffer_view_get_line_cache$return <= 4095

908

}

x Problem
textbuffer_view_get_line_cache$return <= 4095

					Exit view_get_lines_height / textbuffer_view_get_line_cache

	1040		height += linecount;
	1041		}
	1042		line = line->next;

Preconditions

&$unknown_3117413 != $param_4
((char*)$param_1)[28] >= -1 * $param_3 + 1

Postconditions

((char*)&$unknown_3117413)[16]' = 0
line' = &$unknown_3117413
skip_line' = $param_4
subline' = $param_3
view' = $param_1

Change Warning 2357.2368 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: