Problem report #14

Problem report #14

[Dan Nicolaescu]

CID: 14
Checker: FORWARD_NULL (help)
File: emacs/src/fileio.c
Function: e_write
Description: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it.

Event var_deref_model: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it. [model]
Also see events: [var_compare_op]

5625 	      result = encode_coding (coding, addr, buf, nbytes, WRITE_BUF_SIZE);
5626 	      if (coding->produced > 0)
5627 		{
5628 		  coding->produced -= emacs_write (desc, buf, coding->produced);
5629 		  if (coding->produced)
5630 		    {
5631 		      return_val = -1;
5632 		      break;
5633 		    }
5634 		}
5635 	      nbytes -= coding->consumed;
5636 	      addr += coding->consumed;
5637 	      if (result == CODING_FINISH_INSUFFICIENT_SRC
5638 		  && nbytes > 0)
5639 		{
5640 		  /* The source text ends by an incomplete multibyte form.
5641 	             There's no way other than write it out as is.  */
5642 		  nbytes -= emacs_write (desc, addr, nbytes);
5643 		  if (nbytes)
5644 		    {
5645 		      return_val = -1;
5646 		      break;
5647 		    }
5648 		}
5649 	      if (nbytes <= 0)
5650 		break;
5651 	      start += coding->consumed_char;

Event var_compare_op: Added "(coding)->cmp_data" due to comparison "(coding)->cmp_data != 0"
Also see events: [var_deref_model]
At conditional (1): "(coding)->cmp_data != 0" taking false path

5652 	      if (coding->cmp_data)
5653 		coding_adjust_composition_offset (coding, start);

Re: Problem report #14 FALSE

[Kenichi Handa]

In article <200604111549.k3BFnBwQ015115@scanner2.ics.uci.edu>, Dan Nicolaescu <dann@ics.uci.edu> writes:

> CID: 14
> Checker: FORWARD_NULL (help)
> File: emacs/src/fileio.c
> Function: e_write
> Description: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it.

In e_write, coding->cmp_data is allocated by xmalloc in
advance if coding->composing != COMPOSITION_DISABLED, and

> Event var_deref_model: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it. [model]
> Also see events: [var_compare_op]

> 5625 	      result = encode_coding (coding, addr, buf, nbytes, WRITE_BUF_SIZE);

this function dereferences coding->cmp_data only when
coding->composing != COMPOSITION_DISABLED.

So, I think there's no bug.

---
Kenichi Handa
handa@m17n.org