CodeSonar : pvm3.4.6 : Null Pointer Dereference

pvm3.4.6 : pvm3.4.6 analysis 2 : Null Pointer Dereference at lpvm.c:3671

Categories:	LANG.MEM.NPD CWE:476
Warning ID:	22145.29136
Procedure:	pvm_start_pvmd
Trace:	view
Modified:	Thu Nov 26 11:34:48 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/pvm3/src/lpvm.c

			Enter pvm_start_pvmd

3526

pvm_start_pvmd(argc, argv, block)

3527

int argc; /* number of args to pass to pvmd (>= 0) */

3528

char **argv; /* args for pvmd or null */

3529

int block; /* if true, don't return until add hosts are started */

{

char *sfn;

struct stat sb;

int cc;

char *fn; /* file to exec */

3535

char **av;

3536

int pfd[2];

...

3541

#ifdef WIN32

3542

char *pathending = "\\lib\\win32\\pvmd3.exe";

3543

SECURITY_ATTRIBUTES saPipe;

3544

PROCESS_INFORMATION pi;

3545

STARTUPINFO si; /* for CreateProcess call */

HANDLE pvmdid;

int i = 0;

char cmd[256];

#endif

TEV_DECLS;

if (TEV_EXCLUSIVE) {

if (pvmmytid != -1

&& TEV_DO_TRACE (TEV_START_PVMD ,TEV_EVENT_ENTRY )) {

3556

TEV_PACK_INT( TEV_DID_BF, TEV_DATA_SCALAR, &block, 1, 1 );

3557

TEV_PACK_STRING( TEV_DID_AS, TEV_DATA_ARRAY,

argv, argc, 1 );

TEV_FIN;

}

}

if (argc < 0 || !argv)

argc = 0;

#ifndef WIN32

if ((pvm_useruid = getuid()) == -1) {

3568

pvmlogerror("can't getuid()\n");

cc = PvmSysErr;

goto bail;

}

pvmchkuid( pvm_useruid );

3573

#else

3574

if (!username)

3575

username = MyGetUserName();

3576

#endif

3577

3578

if (!(sfn = pvmdsockfile ())) {

3579

pvmlogerror("pvm_start_pvmd() pvmdsockfile() failed\n");

cc = PvmSysErr;

goto bail;

}

if (stat(sfn, &sb) != -1) {

cc = PvmDupHost;

goto bail;

}

#ifdef WIN32

cc = PvmSysErr;

fn = malloc(128 * sizeof(char));

...

PVM_FREE(av);

while (stat(sfn, &sb) == -1)

3653

Sleep(5000); /* what a hack */

#else

#ifdef IMA_TITN

if (socketpair(AF_UNIX, SOCK_STREAM, 0, pfd) == -1)

#else

if (pipe(pfd) == -1)

#endif

{

cc = PvmSysErr;

goto bail;

}

fn = pvmgetpvmd ();

av = TALLOC(argc + 2, char *, "argv"); /* Integer Overflow of Allocation Size (ID: 414.29137) */

3670

if (argc > 0)

av <= 4091

3671

BCOPY((char *)&argv[0], (char *)&av[1], argc * sizeof(char*)); /* Null Pointer Dereference */

Preconditions

argc >= 1
argv != 0
&$unknown_11050455 = 4 * argc
&$unknown_11050455 >= 4
strlen(td) >= -17
pp = 0
pvmtoplvl = 0
rd = 0
$input_12 >= 0
td != 0

Postconditions

av' = 0
strlen(&buf[0])' = strlen(td) + 17
buf[0]' is accessed by path name
errno' != 0
fn' = 0
$heap_386301' = $input_444
bytes_after(&$heap_386301)' = $input_12 + 1
$heap_386301' is allocated by malloc
$heap_386301' is a non-heap object
bytes_before(&$heap_386301)' = 0
strlen(&$heap_386301)' = $input_12
pp' = 0
pvm_useruid' != -1
pvmampushed' = 0
pvmamtraced' = pvmtoplvl
rd' = &$heap_386301
sfn' = &buf[0]

Change Warning 22145.29136 : Null Pointer Dereference

Priority:
State:
Finding:
Owner:
Note: