Problem report #13

[Dan Nicolaescu <dann@ics.uci.edu>]

CID: 13
Checker: FORWARD_NULL (help)
File: emacs/src/coding.c
Function: encode_coding_string
Description: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it.

Event var_compare_op: Added "(coding)->cmp_data" due to comparison "(coding)->cmp_data == 0"
Also see events: [var_deref_model]
At conditional (1): "(coding)->cmp_data == 0" taking true path

6435 	  if (coding->type != coding_type_ccl
6436 	      && (! coding->cmp_data || coding->cmp_data->used == 0))
6437 	    {

At conditional (2): "(to_byte - from) > shrink_conversion_region_threshhold" taking true path
At conditional (3): "1" taking true path
At conditional (4): "0" taking false path

6438 	      SHRINK_CONVERSION_REGION (&from, &to_byte, coding, SDATA (str),
6439 					1);

At conditional (5): "from == to_byte" taking false path

6440 	      if (from == to_byte)
6441 		{
6442 		  coding_free_composition_data (coding);
6443 		  goto no_need_of_encoding;
6444 		}

At conditional (6): "((0), (str & -8))->size_byte < 0" taking true path

6445 	      shrinked_bytes = from + (SBYTES (str) - to_byte);
6446 	    }
6447 	
6448 	  len = encoding_buffer_size (coding, to_byte - from);

At conditional (7): "len < 16384" taking true path
At conditional (8): "0" taking false path

6449 	  allocate_conversion_buffer (buf, len);
6450 	
6451 	  consumed = consumed_char = produced = produced_char = 0;

At conditional (9): "1" taking true path

6452 	  while (1)
6453 	    {

Event var_deref_model: Variable "(coding)->cmp_data" tracked as NULL was passed to a function that dereferences it. [model]
Also see events: [var_compare_op]

6454 	      result = encode_coding (coding, SDATA (str) + from + consumed,
6455 				      buf.data + produced, to_byte - from - consumed,
6456 				      buf.size - produced);