From: Dan Nicolaescu <dann@ics.uci.edu>
Subject: Problem report #15
Date: Tue, 11 Apr 2006 08:48:17 -0700 [thread overview]
Message-ID: <200604111548.k3BFmH6g015084@scanner2.ics.uci.edu> (raw)
CID: 15
Checker: FORWARD_NULL (help)
File: emacs/src/process.c
Function: conv_lisp_to_sockaddr
Description: Incrementing possibly NULL value "cp"
Event assign_zero: Variable "cp" assigned value 0.
Also see events: [dereference]
2335 register unsigned char *cp = NULL;
2336 register int i;
2337
2338 bzero (sa, len);
2339 sa->sa_family = family;
2340
At conditional (1): "address & 7 == 4" taking true path
At conditional (2): "((0), (address & -8))->size & 1073741824 == 0" taking true path
2341 if (VECTORP (address))
2342 {
2343 p = XVECTOR (address);
At conditional (3): "family == 2" taking false path
2344 if (family == AF_INET)
2345 {
2346 struct sockaddr_in *sin = (struct sockaddr_in *) sa;
2347 len = sizeof (sin->sin_addr) + 1;
2348 i = XINT (p->contents[--len]);
2349 sin->sin_port = htons (i);
2350 cp = (unsigned char *)&sin->sin_addr;
2351 }
2352 #ifdef AF_INET6
At conditional (4): "family == 10" taking false path
2353 else if (family == AF_INET6)
2354 {
2355 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sa;
2356 uint16_t *ip6 = (uint16_t *)&sin6->sin6_addr;
2357 len = sizeof (sin6->sin6_addr) + 1;
2358 i = XINT (p->contents[--len]);
2359 sin6->sin6_port = htons (i);
2360 for (i = 0; i < len; i++)
2361 if (INTEGERP (p->contents[i]))
2362 {
2363 int j = XFASTINT (p->contents[i]) & 0xffff;
2364 ip6[i] = ntohs (j);
2365 }
2366 return;
2367 }
2368 #endif
2369 }
2370 else if (STRINGP (address))
2371 {
2372 #ifdef HAVE_LOCAL_SOCKETS
2373 if (family == AF_LOCAL)
2374 {
2375 struct sockaddr_un *sockun = (struct sockaddr_un *) sa;
2376 cp = SDATA (address);
2377 for (i = 0; i < sizeof (sockun->sun_path) && *cp; i++)
2378 sockun->sun_path[i] = *cp++;
2379 }
2380 #endif
2381 return;
2382 }
2383 else
2384 {
2385 p = XVECTOR (XCDR (address));
2386 cp = (unsigned char *)sa + sizeof (sa->sa_family);
2387 }
2388
At conditional (5): "i < len" taking true path
2389 for (i = 0; i < len; i++)
At conditional (6): "(p)->contents[i] & 7 == 0" taking true path
2390 if (INTEGERP (p->contents[i]))
Event dereference: Incrementing possibly NULL value "cp"
Also see events: [assign_zero]
2391 *cp++ = XFASTINT (p->contents[i]) & 0xff;
2392 }
next reply other threads:[~2006-04-11 15:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-04-11 15:48 Dan Nicolaescu [this message]
2006-04-11 17:44 ` Problem report #15 Stuart D. Herring
2006-04-12 17:10 ` Richard Stallman
2006-04-12 17:36 ` Stuart D. Herring
2006-04-13 3:20 ` Richard Stallman
2006-04-13 15:28 ` Stuart D. Herring
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200604111548.k3BFmH6g015084@scanner2.ics.uci.edu \
--to=dann@ics.uci.edu \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).