CodeSonar : Pvm : Null Pointer Dereference

Pvm : Pvm analysis 1 : Null Pointer Dereference at pvmd.c:3715

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	2715.2768
Procedure:	sendmessage
Trace:	View
Modified:	Wed Sep 2 12:44:19 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/u1/paul/SATE/2010/c/pvm/pvm3/src/tdpro.c

			Enter tm_tickle

	1647		tm_tickle(tp, mp)
	1648		struct task *tp;
	1649		struct pmsg *mp;
	1650		{
	1651		int nar;
	1652		int arg[10];
	1653		int i;
	1654		char *p;
	1655		struct hostd *hp;
	1656
	1657		upkint(mp, &nar );
	1658		if (nar < 1 \|\| nar > 10) {
	1659		pvmlogprintf("tm_tickle() bad msg format\n");
	1660		return 0;
	1661		}
	1662		for (i = 0; i < nar; i++)
	1663		upkint(mp, &arg[i]);
	1664		while (i < sizeof(arg)/sizeof(arg[0]))
	1665		arg[i++] = 0;
	1666
	1667		pvmlogprintf("tm_tickle() #");
	1668		for (i = 0; i < nar; i++)
	1669		pvmlogprintf(" %d", arg[i]);
	1670		pvmlogprintf("\n");
	1671

true

1672

mp = replymessage (mp );

	1673
	1674		switch (arg[0]) {
	1675
	1676		case 0:
	1677		i_dump(1);
	1678		pkint(mp, 0);
	1679		break;
	1680
	1681		case 1:
	1682		ht_dump(hosts );
	1683		pkint(mp, 0);
	1684		break;
			...
	1712
	1713		case 7:
	1714		if (arg[1] > 0 && arg[1] < 50) {
	1715		nopax = arg[1];
	1716		pvmlogprintf("tm_tickle() nopax is %d\n", nopax );
	1717		} else
	1718		pvmlogprintf("tm_tickle() bogus nopax %d\n", arg[1]);
	1719		pkint(mp, 0);
	1720		break;
	1721
	1722		case 8:
	1723		pkint(mp, 1);
	1724		if ((hp = tidtohost (hosts, arg[1]))
	1725		&& hp != hosts->ht_hosts[hosts->ht_local]) {
	1726		pvmlogprintf("tm_tickle() failing %s\n", hp->hd_name );
	1727		hostfailentry(hp );
	1728		ht_delete(hosts, hp );
	1729		if (newhosts)
	1730		ht_delete(newhosts, hp );
	1731		pkint(mp, 1);
	1732		} else {
	1733		if (hp)
	1734		pvmlogprintf("tm_tickle() can't fail %s\n", hp->hd_name );
	1735		else
	1736		pvmlogprintf("tm_tickle() no such host %x\n", arg[1]);
	1737		pkint(mp, 0);
	1738		}
	1739		break;
	1740
	1741		case 9:
	1742		#ifdef STATISTICS
	1743		dump_statistics();
	1744		if (arg[1])
	1745		reset_statistics();
	1746		#else
	1747		pvmlogerror("tm_tickle() statistics not compiled in\n");
	1748		#endif
	1749		pkint(mp, 0);
			...
	1775		pkint(mp, 0);
	1776		}
	1777		break;
	1778
	1779		default:
	1780		pvmlogprintf("tm_tickle() don't know #%d\n", arg[0]);
	1781		pkint(mp, 0);
	1782		break;
	1783		}
	1784

mp <= 4095

1785

sendmessage(mp );

					/u1/paul/SATE/2010/c/pvm/pvm3/src/pvmd.c

					Enter tm_tickle / sendmessage

sendmessage(mp)

struct pmsg *mp;

{

struct hostd *hp = 0;

struct task *tp;

struct frag *fp;

struct pkt *pp;

int ff = FFSOM;

int dst = mp->m_dst; /* Null Pointer Dereference */ /* 12 more... */

					Exit tm_tickle / sendmessage

Preconditions

&$unknown_1037720 = 0
arg[0] = 8
numpmsgs = 0

Postconditions

atnewline' = 0
ff' = 1
freepmsgs.m_link' = &freepmsgs.m_link
freepmsgs.m_rlink' = &freepmsgs.m_link
hp' = 0
hp' = 0
i' = 10
mp' = 0
mp' = 0
nar' = 10
tmbuf.tm_sec' = &$unknown_1037719
tp' = $param_1

Change Warning 2715.2768 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: