CodeSonar : pvm3.4.6 : Null Pointer Dereference

pvm3.4.6 : pvm3.4.6 analysis 2 : Null Pointer Dereference at tdpro.c:1771

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	22099.28971
Procedure:	tm_tickle
Trace:	view
Modified:	Thu Nov 26 11:29:19 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/pvm3/src/tdpro.c

			Enter tm_tickle

	1647		tm_tickle(tp, mp)
	1648		struct task *tp;
	1649		struct pmsg *mp;
	1650		{
	1651		int nar;
	1652		int arg[10];
	1653		int i;
	1654		char *p;
	1655		struct hostd *hp;
	1656
	1657		upkint(mp, &nar );
	1658		if (nar < 1 \|\| nar > 10) {
	1659		pvmlogprintf("tm_tickle() bad msg format\n");
	1660		return 0;
	1661		}
	1662		for (i = 0; i < nar; i++)
	1663		upkint(mp, &arg[i]);
	1664		while (i < sizeof(arg)/sizeof(arg[0]))
	1665		arg[i++] = 0;
	1666
	1667		pvmlogprintf("tm_tickle() #");
	1668		for (i = 0; i < nar; i++)
	1669		pvmlogprintf(" %d", arg[i]);
	1670		pvmlogprintf("\n");
	1671
	1672		mp = replymessage (mp );
	1673
	1674		switch (arg[0]) {
	1675
	1676		case 0:
	1677		i_dump(1);
	1678		pkint(mp, 0);
	1679		break;
	1680
	1681		case 1:
	1682		ht_dump(hosts );
	1683		pkint(mp, 0);
	1684		break;
			...
	1752		case 100:
	1753		#ifdef SHMEM
	1754		peer_dump();
	1755		pidtid_dump();
	1756		#else
	1757		pvmlogerror("tm_tickle() not using shared memory\n");
	1758		#endif
	1759		pkint(mp, 0);
	1760		break;
	1761
	1762		case 20:
	1763		{
	1764		struct pmsg *mp2;
	1765		int i, j;
	1766
	1767		for (j = 0; j < arg[1]; j++) {

true

1768

mp2 = mesg_new (0);

1769

for (i = 0; i < 1000; i++)

1770

pkint(mp2, i );

mp2 <= 4095

1771

mp2->m_dst = arg[2]; /* Null Pointer Dereference */

Preconditions

arg[0] = 20
arg[1] >= 1
numfrags = 0
numpmsgs = 1

Postconditions

freepmsgs.m_link->m_link->m_rlink' = freepmsgs.m_link->m_rlink
freepmsgs.m_link->m_rlink->m_link' = freepmsgs.m_link->m_link
((char*)$unknown_991852)[4]' = &$unknown_991851
$unknown_991851' = &freefrags.fr_link
((char*)&$unknown_991851)[4]' = ((char*)&$unknown_991852)[4]
atnewline' = 0
errno' != 0
freefrags.fr_link' = &$unknown_991851 - 48
freefrags.fr_rlink' = &$unknown_991851
freepmsgs.m_link' = &freepmsgs.m_link
freepmsgs.m_rlink' = &freepmsgs.m_link
i' = 1000
i' = 10
j' = 0
mp' = freepmsgs.m_link
mp2' = 0
nar' = 10
numfrags' = 499
numpmsgs' = numpmsgs - 1
tmbuf.tm_sec' = &$unknown_991850

Change Warning 22099.28971 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: