bugGNU roff - Bugs: bug #65180, [xditview,groff] warnings from...

 
 

bug #65180: [xditview,groff] warnings from -Wanalyzer-null-dereference -fanalyzer

Submitter:  Bjarni Ingi Gislason <bjarniig>
Submitted:  Thu 18 Jan 2024 09:40:01 PM UTC
   
 
Category:  Core Severity:  2 - Minor
Item Group:  Build/Installation Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 19 Jan 2024 05:49:22 PM UTC, comment #2: 

   The whole file is 23401 bytes.  The following is the part about
"groff/pipeline.c" and is in the attachment.


(file #55587)

Bjarni Ingi Gislason <bjarniig>
Fri 19 Jan 2024 02:16:49 PM UTC, comment #1: 

The attachment did not behave well for me.  The content was only ~24KiB.


Subject: output with CFLAGS += -Wanalyzer-null-dereference
 -fanalyzer

[...]
  CC       src/devices/xditview/gxditview-device.o
../src/devices/xditview/device.c: In function 'find_file':
../src/devices/xditview/device.c:468:5: warning: check of 'path' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  468 |     strcat(path, env);
      |     ^~~~~~~~~~~~~~~~~
  'find_file': events 1-4
    |
    |  466 |   *path = '\0';
    |      |   ~~~~~~^~~~~~
    |      |         |
    |      |         (1) pointer 'path' is dereferenced here
    |  467 |   if (env && *env) {
    |      |      ~
    |      |      |
    |      |      (2) following 'true' branch...
    |  468 |     strcat(path, env);
    |      |     ~~~~~~~~~~~~~~~~~
    |      |     |
    |      |     (3) ...to here
    |      |     (4) pointer 'path' is checked for NULL here but it was already dereferenced at (1)
    |
../src/devices/xditview/device.c:468:5: warning: check of 'path' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  468 |     strcat(path, env);
      |     ^~~~~~~~~~~~~~~~~
  'open_device_file': events 1-5
    |
    |  525 | FILE *open_device_file(const char *device_name, const char *file_name,
    |      |       ^~~~~~~~~~~~~~~~
    |      |       |
    |      |       (1) entry to 'open_device_file'
    |......
    |  531 |   buf = XtMalloc(3 + strlen(device_name) + 1 + strlen(file_name) + 1);
    |      |                      ~~~~~~~~~~~~~~~~~~~       ~~~~~~~~~~~~~~~~~
    |      |                      |                         |
    |      |                      |                         (3) ...to here
    |      |                      (2) following 'false' branch...
    |  532 |   sprintf(buf, "dev%s/%s", device_name, file_name);
    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |   |
    |      |   (4) following 'false' branch (when 'buf' is non-NULL)...
    |      |   (5) inlined call to 'sprintf' from 'open_device_file'
    |
    +--> 'sprintf': event 6
           |
           |/usr/include/x86_64-linux-gnu/bits/stdio2.h:30:10:
           |   30 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
           |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |          |
           |      |          (6) ...to here
           |   31 |                                   __glibc_objsize (__s), __fmt,
           |      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |   32 |                                   __va_arg_pack ());
           |      |                                   ~~~~~~~~~~~~~~~~~
           |
    <------+
    |
  'open_device_file': event 7
    |
    |../src/devices/xditview/device.c:533:8:
    |  533 |   fp = find_file(buf, result);
    |      |        ^~~~~~~~~~~~~~~~~~~~~~
    |      |        |
    |      |        (7) calling 'find_file' from 'open_device_file'
    |
    +--> 'find_file': events 8-12
           |
           |  454 | FILE *find_file(const char *file, char **result)
           |      |       ^~~~~~~~~
           |      |       |
           |      |       (8) entry to 'find_file'
           |......
           |  466 |   *path = '\0';
           |      |   ~~~~~~~~~~~~
           |      |         |
           |      |         (9) pointer 'path' is dereferenced here
           |  467 |   if (env && *env) {
           |      |      ~
           |      |      |
           |      |      (10) following 'true' branch...
           |  468 |     strcat(path, env);
           |      |     ~~~~~~~~~~~~~~~~~
           |      |     |
           |      |     (11) ...to here
           |      |     (12) pointer 'path' is checked for NULL here but it was already dereferenced at (9)
           |
../src/devices/xditview/device.c:468:5: warning: check of 'path' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  468 |     strcat(path, env);
      |     ^~~~~~~~~~~~~~~~~
  'load_font': events 1-2
    |
    |  186 | DeviceFont *load_font(Device *dev, const char *name)
    |      |             ^~~~~~~~~
    |      |             |
    |      |             (1) entry to 'load_font'
    |......
    |  193 |     fp = open_device_file(dev->name, name, &current_filename);
    |      |          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |          |
    |      |          (2) calling 'open_device_file' from 'load_font'
    |
    +--> 'open_device_file': events 3-7
           |
           |  525 | FILE *open_device_file(const char *device_name, const char *file_name,
           |      |       ^~~~~~~~~~~~~~~~
           |      |       |
           |      |       (3) entry to 'open_device_file'
           |......
           |  531 |   buf = XtMalloc(3 + strlen(device_name) + 1 + strlen(file_name) + 1);
           |      |                      ~~~~~~~~~~~~~~~~~~~       ~~~~~~~~~~~~~~~~~
           |      |                      |                         |
           |      |                      |                         (5) ...to here
           |      |                      (4) following 'false' branch...
           |  532 |   sprintf(buf, "dev%s/%s", device_name, file_name);
           |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |   |
           |      |   (6) following 'false' branch (when 'buf' is non-NULL)...
           |      |   (7) inlined call to 'sprintf' from 'open_device_file'
           |
           +--> 'sprintf': event 8
                  |
                  |/usr/include/x86_64-linux-gnu/bits/stdio2.h:30:10:
                  |   30 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
                  |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |          |
                  |      |          (8) ...to here
                  |   31 |                                   __glibc_objsize (__s), __fmt,
                  |      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |   32 |                                   __va_arg_pack ());
                  |      |                                   ~~~~~~~~~~~~~~~~~
                  |
           <------+
           |
         'open_device_file': event 9
           |
           |../src/devices/xditview/device.c:533:8:
           |  533 |   fp = find_file(buf, result);
           |      |        ^~~~~~~~~~~~~~~~~~~~~~
           |      |        |
           |      |        (9) calling 'find_file' from 'open_device_file'
           |
           +--> 'find_file': events 10-14
                  |
                  |  454 | FILE *find_file(const char *file, char **result)
                  |      |       ^~~~~~~~~
                  |      |       |
                  |      |       (10) entry to 'find_file'
                  |......
                  |  466 |   *path = '\0';
                  |      |   ~~~~~~~~~~~~
                  |      |         |
                  |      |         (11) pointer 'path' is dereferenced here
                  |  467 |   if (env && *env) {
                  |      |      ~
                  |      |      |
                  |      |      (12) following 'true' branch...
                  |  468 |     strcat(path, env);
                  |      |     ~~~~~~~~~~~~~~~~~
                  |      |     |
                  |      |     (13) ...to here
                  |      |     (14) pointer 'path' is checked for NULL here but it was already dereferenced at (11)
                  |
../src/devices/xditview/device.c:468:5: warning: check of 'path' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  468 |     strcat(path, env);
      |     ^~~~~~~~~~~~~~~~~
  'device_find_font': events 1-4
    |
    |  173 | DeviceFont *device_find_font(Device *dev, const char *name)
    |      |             ^~~~~~~~~~~~~~~~
    |      |             |
    |      |             (1) entry to 'device_find_font'
    |......
    |  177 |     if (!dev)
    |      |        ~
    |      |        |
    |      |        (2) following 'false' branch (when 'dev' is non-NULL)...
    |  178 |         return 0;
    |  179 |     for (f = dev->fonts; f; f = f->next)
    |      |          ~~~~~~~~~~~~~~
    |      |            |
    |      |            (3) ...to here
    |......
    |  182 |     return load_font(dev, name);
    |      |            ~~~~~~~~~~~~~~~~~~~~
    |      |            |
    |      |            (4) calling 'load_font' from 'device_find_font'
    |
    +--> 'load_font': events 5-6
           |
           |  186 | DeviceFont *load_font(Device *dev, const char *name)
           |      |             ^~~~~~~~~
           |      |             |
           |      |             (5) entry to 'load_font'
           |......
           |  193 |     fp = open_device_file(dev->name, name, &current_filename);
           |      |          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |          |
           |      |          (6) calling 'open_device_file' from 'load_font'
           |
           +--> 'open_device_file': events 7-11
                  |
                  |  525 | FILE *open_device_file(const char *device_name, const char *file_name,
                  |      |       ^~~~~~~~~~~~~~~~
                  |      |       |
                  |      |       (7) entry to 'open_device_file'
                  |......
                  |  531 |   buf = XtMalloc(3 + strlen(device_name) + 1 + strlen(file_name) + 1);
                  |      |                      ~~~~~~~~~~~~~~~~~~~       ~~~~~~~~~~~~~~~~~
                  |      |                      |                         |
                  |      |                      |                         (9) ...to here
                  |      |                      (8) following 'false' branch...
                  |  532 |   sprintf(buf, "dev%s/%s", device_name, file_name);
                  |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  |      |   |
                  |      |   (10) following 'false' branch (when 'buf' is non-NULL)...
                  |      |   (11) inlined call to 'sprintf' from 'open_device_file'
                  |
                  +--> 'sprintf': event 12
                         |
                         |/usr/include/x86_64-linux-gnu/bits/stdio2.h:30:10:
                         |   30 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
                         |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |          |
                         |      |          (12) ...to here
                         |   31 |                                   __glibc_objsize (__s), __fmt,
                         |      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |   32 |                                   __va_arg_pack ());
                         |      |                                   ~~~~~~~~~~~~~~~~~
                         |
                  <------+
                  |
                'open_device_file': event 13
                  |
                  |../src/devices/xditview/device.c:533:8:
                  |  533 |   fp = find_file(buf, result);
                  |      |        ^~~~~~~~~~~~~~~~~~~~~~
                  |      |        |
                  |      |        (13) calling 'find_file' from 'open_device_file'
                  |
                  +--> 'find_file': events 14-18
                         |
                         |  454 | FILE *find_file(const char *file, char **result)
                         |      |       ^~~~~~~~~
                         |      |       |
                         |      |       (14) entry to 'find_file'
                         |......
                         |  466 |   *path = '\0';
                         |      |   ~~~~~~~~~~~~
                         |      |         |
                         |      |         (15) pointer 'path' is dereferenced here
                         |  467 |   if (env && *env) {
                         |      |      ~
                         |      |      |
                         |      |      (16) following 'true' branch...
                         |  468 |     strcat(path, env);
                         |      |     ~~~~~~~~~~~~~~~~~
                         |      |     |
                         |      |     (17) ...to here
                         |      |     (18) pointer 'path' is checked for NULL here but it was already dereferenced at (15)
                         |
  CC       src/devices/xditview/gxditview-draw.o
[...]
  CC       src/roff/groff/pipeline.o
../src/roff/groff/pipeline.c: In function 'run_pipeline':
../src/roff/groff/pipeline.c:470:12: warning: leak of file descriptor 'dup(last_input)' [CWE-775] [-Wanalyzer-fd-leak]
  470 |         if (dup(last_input) < 0)
      |            ^
  'run_pipeline': events 1-23
    |
    |  454 |   for (i = 0; i < ncommands; i++) {
    |      |               ~~^~~~~~~~~~~
    |      |                 |
    |

G. Branden Robinson <gbranden>
Group administrator
Thu 18 Jan 2024 09:40:01 PM UTC, original submission:  

Subject: make output with CFLAGS += -Wanalyzer-null-dereference
 -fanalyzer

  The file is in the attachment.

Bjarni Ingi Gislason <bjarniig>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #55587:  groff.analyzer.pipeline.bug added by bjarniig (10KiB - application/octet-stream)
file #55586:  groff.analyzer.bug added by bjarniig (23KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gbranden (Posted a comment)
  • -email is unavailable- added by bjarniig (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-01-19 bjarniig Attached File- Added groff.analyzer.pipeline.bug, #55587
    2024-01-19 gbranden Severity3 - Normal 2 - Minor
        Summarymake output with CFLAGS += -Wanalyzer-null-dereference -fanalyzer [xditview,groff] warnings from -Wanalyzer-null-dereference -fanalyzer
    2024-01-18 bjarniig Attached File- Added groff.analyzer.bug, #55586

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code