CodeSonar : pvm3.4.6 : Null Pointer Dereference

pvm3.4.6 : pvm3.4.6 analysis 2 : Null Pointer Dereference at ddpro.c:1539

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	118.28739
Procedure:	exectasks
Trace:	view
Modified:	Thu Nov 26 11:27:40 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/pvm3/src/ddpro.c

			Enter exectasks

1401

exectasks(mp, rmp, schtid)

1402

struct pmsg *mp; /* the request message */

1403

struct pmsg *rmp; /* reply message blank */

1404

int schtid; /* scheduler for new tasks */

1405

{

1406

struct pmsg *mp2; /* reply message hdl */

1407

int i;

1408

struct timeval now;

1409

struct waitc_spawn *wxp; /* new task parameters */

int munge_tenv = 0;

char tmp[255];

char *wd = 0;

char *savewd = 0;

wxp = TALLOC(1, struct waitc_spawn, "waix"); /* Integer Overflow of Allocation Size (ID: 120.28741) */

1416

BZERO((char*)wxp, sizeof(struct waitc_spawn)); /* Null Pointer Dereference (ID: 125.28746) */

/* unpack message */

if (upkuint(mp, &wxp->w_ptid )

1421

|| upkstralloc(mp, &wxp->w_file )

1422

|| upkint(mp, &wxp->w_flags )

1423

|| upkint(mp, &wxp->w_veclen )

1424

|| upkint(mp, &wxp->w_argc ))

1425

goto bad;

1426

1427

if (wxp->w_veclen < 1)

1428

goto bad;

1429

wxp->w_vec = TALLOC(wxp->w_veclen, int, "tids"); /* Integer Overflow of Allocation Size (ID: 124.28745) */

1430

1431

wxp->w_argc += 2;

1432

wxp->w_argv = TALLOC(wxp->w_argc + 1, char*, "argv"); /* Integer Overflow of Allocation Size (ID: 123.28744) */

1433

BZERO((char*)wxp->w_argv, (wxp->w_argc + 1) * sizeof(char*)); /* Null Pointer Dereference (ID: 122.28743) */

1434

wxp->w_argv++;

1435

wxp->w_argv[0] = wxp->w_file; /* Null Pointer Dereference (ID: 121.28742) */

1436

wxp->w_file = 0;

1437

wxp->w_argv[--wxp->w_argc] = 0;

1438

for (i = 1; i < wxp->w_argc; i++)

1439

if (upkstralloc(mp, &wxp->w_argv[i]))

1440

goto bad;

1441

1442

if (upkuint(mp, &wxp->w_outtid )

1443

|| upkuint(mp, &wxp->w_outctx )

1444

|| upkuint(mp, &wxp->w_outtag )

1445

|| upkuint(mp, &wxp->w_trctid )

1446

|| upkuint(mp, &wxp->w_trcctx )

1447

|| upkuint(mp, &wxp->w_trctag )

1448

|| upkuint(mp, &wxp->w_nenv ))

1449

goto bad;

1450

1451

wxp->w_hosttotal = wxp->w_veclen; /* this is the task count! */

1452

1453

if (pvmtracer.trctid) {

1454

if (!(wxp->w_trctid) && pvmtracer.trctag) {

1455

wxp->w_trctid = pvmtracer.trctid;

1456

wxp->w_trcctx = pvmtracer.trcctx;

1457

wxp->w_trctag = pvmtracer.trctag;

munge_tenv++;

}

}

if (pvmtracer.outtid) {

1463

if (!(wxp->w_outtid) && pvmtracer.outtag) {

1464

wxp->w_outtid = pvmtracer.outtid;

1465

wxp->w_outctx = pvmtracer.outctx;

1466

wxp->w_outtag = pvmtracer.outtag;

}

}

wxp->w_env = TALLOC((wxp->w_nenv + 1), char*, "env");

1471

BZERO(wxp->w_env, (wxp->w_nenv + 1) * sizeof(char*)); /* Null Pointer Dereference (ID: 119.28740) */

1472

1473

for (i = 0; i < wxp->w_nenv; i++)

1474

if (upkstralloc(mp, &wxp->w_env[i]))

1475

goto bad;

1476

1477

if ( upkuint(mp, &wxp->w_instance ) || upkuint(mp, &wxp->w_outof ))

1478

goto bad;

1479

1480

/* check for spawn working directory */

1481

1482

for (i = 0; i < wxp->w_nenv; i++)

1483

if ( !strncmp( "PVMSPAWNWD=", wxp->w_env[i],

1484

strlen("PVMSPAWNWD=") ) )

1485

wd = STRALLOC( wxp->w_env[i] + strlen("PVMSPAWNWD=") ); /* Null Pointer Dereference (ID: 22060.28738) */

1486

1487

/* munge env for tracing stuff */

1488

1489

if ( munge_tenv ) {

1490

sprintf( tmp, "PVMTMASK=%s", pvmtracer.tmask );

1491

pvmenvinsert( &(wxp->w_env), tmp );

1492

1493

sprintf( tmp, "PVMTRCBUF=%d", pvmtracer.trcbuf );

1494

pvmenvinsert( &(wxp->w_env), tmp );

1495

1496

sprintf( tmp, "PVMTRCOPT=%d", pvmtracer.trcopt );

1497

pvmenvinsert( &(wxp->w_env), tmp );

1498

1499

for ( wxp->w_nenv = 0 ; wxp->w_env[ wxp->w_nenv ] ;

(wxp->w_nenv)++ );

}

/* call ppi_load to get tasks running */

1504

1505

wxp->w_sched = schtid;

1506

1507

/* change to desired working directory (if specified) */

1508

if (wd) {

1509

savewd = (char *) getcwd( (char *) NULL, 255 );

chdir( wd );

}

#if defined(IMA_PGON) || defined(IMA_SP2MPI) || defined(IMA_AIX4SP2) \

1514

|| defined(IMA_AIX5SP2) || defined(IMA_BEOLIN)

1515

if (!(wxp->w_flags & PvmMppFront))

{

mpp_load(wxp);

}

else

#endif

{

ppi_load(wxp );

}

/* go back to original directory (if getcwd() was successful) */

if (savewd)

chdir( savewd );

for (i = 0; i < wxp->w_veclen; i++) {

1530

if (wxp->w_vec[i] > 0) {

1531

if (wxp->w_trctid > 0) {

1532

tev_send_newtask(

1533

wxp->w_trctid, wxp->w_trcctx, wxp->w_trctag,

1534

wxp->w_vec[i], wxp->w_ptid, wxp->w_flags,

1535

wxp->w_argv[0] );

1536

}

1537

if (wxp->w_outtid > 0) {

mp2 = mesg_new (0);

mp2->m_dst = wxp->w_outtid; /* Null Pointer Dereference */

1540

mp2->m_ctx = wxp->w_outctx;

1541

mp2->m_tag = wxp->w_outtag;

1542

pkint(mp2, wxp->w_vec[i]);

1543

pkint(mp2, TO_NEW );

1544

pkint(mp2, wxp->w_ptid );

1545

sendmessage(mp2 );

Preconditions

&$unknown_426872 >= 1
((char*)&$heap_62302)[24] >= 2
((char*)&$heap_62302)[32] >= 1
((char*)&$heap_62302)[44] = 0
pvmtracer.trctid != 0
pvmtracer.trctag = 0
pvmtracer.outtid != 0

Postconditions

errno' != 0
freepmsgs.m_link' = &freepmsgs.m_link
freepmsgs.m_rlink' = &freepmsgs.m_link
$heap_62302' = 0
bytes_after(&$heap_62302)' = 84
$heap_62302' is allocated by malloc
bytes_before(&$heap_62302)' = 0
((char*)&$heap_62302)[20]' = &$heap_62304
((char*)&$heap_62302)[56]' = -1
((char*)&$heap_62302)[60]' = &$heap_62306
((char*)&$heap_62302)[68]' = schtid
((char*)&$heap_62302)[76]' = ((char*)&$heap_62302)[24]
((char*)&$heap_62302)[12]' = &$heap_62305 + 4
bytes_after(&$heap_62303)' = &$unknown_426872
$heap_62303' is allocated by malloc
bytes_before(&$heap_62303)' = 0
bytes_after(&$heap_62304)' = 4 * ((char*)&$heap_62302)[24]
$heap_62304' is allocated by malloc
$heap_62304' is allocated
bytes_before(&$heap_62304)' = 0
$heap_62305' = 0
$heap_62305' is allocated by malloc
bytes_before(&$heap_62305)' = 0
((char*)&$heap_62305)[4]' = &$heap_62303
bytes_after(&$heap_62306)' = 0
$heap_62306' is allocated by malloc
$heap_62306' is allocated
bytes_before(&$heap_62306)' = 0
i' = ((char*)&$heap_62302)[24] - 1
mp2' = 0
munge_tenv' = 0
numpmsgs' = 0
savewd' = 0
wd' = 0
wxp' = &$heap_62302

Change Warning 118.28739 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: