Argv covscan fixes#4
Open
cmikk wants to merge 4 commits into
Open
Conversation
libmy/argv.c:3212: var_deref_model: Passing null pointer "queue_list" to "do_list", which dereferences it libmy/argv.c:3204: var_deref_model: Passing null pointer "queue_list" to "do_list", which dereferences it. Workaround to possibility no arguments is received Usually at least one arg is always passed in argv - program name. Do not dereference null queue_list in unlikely case no parameter in argv.
1. fstrm-0.6.0/libmy/argv.c:1782: addr_non_null: The address of an object "argv_types" is never null. 2. fstrm-0.6.0/libmy/argv.c:1782: assignment: Assigning: "type_p" = "argv_types". 3. fstrm-0.6.0/libmy/argv.c:1809: notnull: At condition "type_p == NULL", the value of "type_p" cannot be "NULL". 4. fstrm-0.6.0/libmy/argv.c:1809: dead_error_condition: The condition "type_p == NULL" cannot be true. 5. fstrm-0.6.0/libmy/argv.c:1810: dead_error_begin: Execution cannot reach this statement: "(void)fprintf(argv_error_st...". 40. fstrm-0.6.0/libmy/argv.c:2724: check_return: Calling "string_to_value" without checking return value (as is done elsewhere 6 out of 7 times).
34. fstrm-0.6.0/libmy/argv.c:2238: alloc_fn: Storage is returned from allocation function "realloc". 35. fstrm-0.6.0/libmy/argv.c:2238: var_assign: Assigning: "argv" = storage returned from "realloc(argv, 8UL * max)". 37. fstrm-0.6.0/libmy/argv.c:2254: var_assign: Assigning: "argv_p" = "argv". 47. fstrm-0.6.0/libmy/argv.c:2229: leaked_storage: Variable "argv_p" going out of scope leaks the storage it points to. 48. fstrm-0.6.0/libmy/argv.c:2229: leaked_storage: Variable "argv" going out of scope leaks the storage it points to.
libmy/argv.c:1352:7: warning[core.uninitialized.Assign]: The expression is an uninitialized value. The computed value will also be garbage
(*(int *)var)++;
^~~~~~~~~~~~~
libmy/argv.c:1207:29: note: Assuming field 'at_value' is not equal to 0
for (type_p = argv_types; type_p->at_value != 0; type_p++) {
^~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1207:3: note: Loop condition is true. Entering loop body
for (type_p = argv_types; type_p->at_value != 0; type_p++) {
^
libmy/argv.c:1208:9: note: Assuming 'val_type' is equal to field 'at_value'
if (type_p->at_value == val_type) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1208:5: note: Taking true branch
if (type_p->at_value == val_type) {
^
libmy/argv.c:1210:7: note: Execution continues on line 1214
break;
^
libmy/argv.c:1214:15: note: Field 'at_value' is not equal to 0
if (type_p->at_value == 0) {
^
libmy/argv.c:1214:3: note: Taking false branch
if (type_p->at_value == 0) {
^
libmy/argv.c:1222:7: note: Assuming the condition is true
if (type & ARGV_FLAG_ARRAY) {
^~~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1222:3: note: Taking true branch
if (type & ARGV_FLAG_ARRAY) {
^
libmy/argv.c:1225:9: note: Assuming field 'aa_entry_n' is equal to 0
if (arr_p->aa_entry_n == 0) {
^~~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1225:5: note: Taking true branch
if (arr_p->aa_entry_n == 0) {
^
libmy/argv.c:1226:35: note: Storing uninitialized value
arr_p->aa_entries = (char *)malloc(ARRAY_INCR *size);
^~~~~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1234:9: note: Assuming field 'aa_entries' is not equal to NULL
if (arr_p->aa_entries == NULL) {
^~~~~~~~~~~~~~~~~~~~~~~~~
libmy/argv.c:1234:5: note: Taking false branch
if (arr_p->aa_entries == NULL) {
^
libmy/argv.c:1251:3: note: Control jumps to 'case 17:' at line 1349
switch (val_type) {
^
libmy/argv.c:1351:9: note: Assuming 'arg' is equal to NULL
if (arg == NULL) {
^~~~~~~~~~~
libmy/argv.c:1351:5: note: Taking true branch
if (arg == NULL) {
^
libmy/argv.c:1352:7: note: The expression is an uninitialized value. The computed value will also be garbage
(*(int *)var)++;
^~~~~~~~~~~~~
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ported from farsightsec/fstrm#67