CodeSonar : Pvm : Null Pointer Dereference

Pvm : Pvm analysis 1 : Null Pointer Dereference at lpvm.c:3720

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	2836.2897
Procedure:	pvm_start_pvmd
Trace:	View
Modified:	Wed Sep 2 12:49:34 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/u1/paul/SATE/2010/c/pvm/pvm3/src/lpvm.c

			Enter pvm_start_pvmd

3526

pvm_start_pvmd(argc, argv, block)

3527

int argc; /* number of args to pass to pvmd (>= 0) */

3528

char **argv; /* args for pvmd or null */

3529

int block; /* if true, don't return until add hosts are started */

{

char *sfn;

struct stat sb;

int cc;

char *fn; /* file to exec */

3535

char **av;

3536

int pfd[2];

...

3541

#ifdef WIN32

3542

char *pathending = "\\lib\\win32\\pvmd3.exe";

3543

SECURITY_ATTRIBUTES saPipe;

3544

PROCESS_INFORMATION pi;

3545

STARTUPINFO si; /* for CreateProcess call */

HANDLE pvmdid;

int i = 0;

char cmd[256];

#endif

TEV_DECLS;

if (TEV_EXCLUSIVE) {

if (pvmmytid != -1

&& TEV_DO_TRACE (TEV_START_PVMD ,TEV_EVENT_ENTRY )) {

3556

TEV_PACK_INT( TEV_DID_BF, TEV_DATA_SCALAR, &block, 1, 1 );

3557

TEV_PACK_STRING( TEV_DID_AS, TEV_DATA_ARRAY,

argv, argc, 1 );

TEV_FIN;

}

}

if (argc < 0 || !argv)

argc = 0;

#ifndef WIN32

if ((pvm_useruid = getuid()) == -1) {

3568

pvmlogerror("can't getuid()\n");

cc = PvmSysErr;

goto bail;

}

pvmchkuid( pvm_useruid );

3573

#else

3574

if (!username)

3575

username = MyGetUserName();

3576

#endif

3577

3578

if (!(sfn = pvmdsockfile ())) {

3579

pvmlogerror("pvm_start_pvmd() pvmdsockfile() failed\n");

cc = PvmSysErr;

goto bail;

}

if (stat(sfn, &sb) != -1) {

cc = PvmDupHost;

goto bail;

}

#ifdef WIN32

cc = PvmSysErr;

fn = malloc(128 * sizeof(char));

...

PVM_FREE(av);

while (stat(sfn, &sb) == -1)

3653

Sleep(5000); /* what a hack */

#else

#ifdef IMA_TITN

if (socketpair(AF_UNIX, SOCK_STREAM, 0, pfd) == -1)

#else

if (pipe(pfd) == -1)

#endif

{

cc = PvmSysErr;

goto bail;

}

fn = pvmgetpvmd ();

av = TALLOC(argc + 2, char *, "argv");

3670

if (argc > 0)

3671

BCOPY((char *)&argv[0], (char *)&av[1], argc * sizeof(char*)); /* Null Pointer Dereference (ID: 2837.2898) */

3672

av[0] = fn; /* Null Pointer Dereference (ID: 2838.2899) */

av[argc + 1] = 0;

if (!fork()) {

(void)close(pfd[0]);

/* fork again so the pvmd is not the child - won't have to wait() for it */

if (!fork()) {

if (pfd[1] != 1)

dup2(pfd[1], 1);

for (n = getdtablesize(); n-- > 0; )

3682

if (n != 1)

3683

(void)close(n);

3684

(void)open("/dev/null", O_RDONLY, 0); /* should be 0 */

3685

(void)open("/dev/null", O_WRONLY, 0); /* should be 2 */

3686

(void)signal(SIGINT, SIG_IGN);

3687

(void)signal(SIGQUIT, SIG_IGN);

3688

#ifndef IMA_OS2

3689

(void)signal(SIGTSTP, SIG_IGN);

#endif

execvp(av[0], av);

}

_exit(0);

}

(void)close(pfd[1]);

(void)wait(0);

PVM_FREE(av);

if (!(ff = fdopen(pfd[0], "r"))) {

cc = PvmSysErr;

(void)close(pfd[0]);

goto bail;

}

strcpy(buf, "PVMSOCK=");

3706

n = strlen(buf);

3707

if (!fgets(buf + n, sizeof(buf) - n - 1, ff)) {

cc = PvmCantStart;

fclose(ff);

goto bail;

}

fclose(ff);

if (strlen(buf + n) < 2) {

cc = PvmCantStart;

goto bail;

}

n = strlen(buf);

if (buf[n - 1] == '\n')

3719

buf[n - 1] = 0;

true

3720

pvmputenv(STRALLOC(buf)); /* Null Pointer Dereference */

Preconditions

$param_1 >= 1
&$unknown_2495950 >= 0
&$unknown_2495952 = 0
pp = 0
pvmmytid != -1
pvmtoplvl != 0
pvmtrc.trctid != pvmmytid
pvmtrc.trctid >= 1
pvmtrc.trcopt != 1
pvmtrc.trcopt != 2
pvmtrc.trcopt != 3
rd = 0
$input_12 >= 0
$input_500 <= 118
$input_500 >= 2
td = 0

Postconditions

*stderr' is allocated by fopen
bytes_before(stderr)' = 0
$unknown_2495949' is freed
$unknown_2495949' is closed
$unknown_2495950' is freed
$unknown_2495950' is closed
argc' = $param_1
argv' = $param_2
av' = &$heap_201505
buf[0]' = 80
strlen(&buf[0])' = $input_500 + 7
buf[0]' is checked by path name
buf[8]' = $input_508
errno' != 0
ff' = &$heap_201506
fn' = &$heap_201504
bytes_after(&$heap_201503)' = $input_12 + 1
$heap_201503' is allocated by malloc
$heap_201503' is a non-heap object
bytes_before(&$heap_201503)' = 0
strlen(&$heap_201503)' = $input_12
bytes_after(&$heap_201504)' = $input_12 + 10
$heap_201504' is allocated by malloc
$heap_201504' is allocated
bytes_before(&$heap_201504)' = 0
$heap_201505' = &$heap_201504
bytes_after(&$heap_201505)' = 8 * $param_1 + 16
$heap_201505' is allocated by malloc
$heap_201505' is freed
bytes_before(&$heap_201505)' = 0
bytes_after(&$heap_201506)' = 1028
$heap_201506' is allocated by fopen
$heap_201506' is closed
bytes_before(&$heap_201506)' = 0
n' = $input_500 + 8
newline' = 1
pfd[0]' = &$unknown_2495950
pfd[1]' = &$unknown_2495949
pp' = &$heap_201504
pvm_useruid' != -1
pvmampushed' = 0
pvmamtraced' = pvmtoplvl
pvmtoplvl' = 0
pvmtrccodef' = &pvmtrccodef_nop.enc_byte
rd' = &$heap_201503
sfn' = &buf[0]
td' = &#string21[0]

Change Warning 2836.2897 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: