Problem report #22

Problem report #22

[Dan Nicolaescu]

CID: 22
Checker: FORWARD_NULL (help)
File: emacs/src/xselect.c
Function: x_get_window_property_as_lisp_data
Description: Variable "data" tracked as NULL was passed to a function that dereferences it.

Event var_compare_op: Added "data" due to comparison "data == 0"
Also see events: [var_deref_op][var_deref_model][var_deref_model][var_deref_model]
At conditional (1): "data == 0" taking true path

1713 	  if (! data)
1714 	    {
1715 	      int there_is_a_selection_owner;
1716 	      BLOCK_INPUT;
1717 	      there_is_a_selection_owner
1718 		= XGetSelectionOwner (display, selection_atom);

At conditional (2): "interrupt_input_blocked == 0" taking true path
At conditional (3): "interrupt_input_pending != 0" taking true path
At conditional (4): "pending_atimers != 0" taking true path
At conditional (5): "0" taking false path

1719 	      UNBLOCK_INPUT;

At conditional (6): "there_is_a_selection_owner != 0" taking true path
At conditional (7): "actual_type != 0" taking true path

1720 	      Fsignal (Qerror,
1721 		       there_is_a_selection_owner
1722 		       ? Fcons (build_string ("selection owner couldn't convert"),
1723 				actual_type
1724 				? Fcons (target_type,
1725 					 Fcons (x_atom_to_symbol (display,
1726 								  actual_type),
1727 						Qnil))
1728 				: Fcons (target_type, Qnil))
1729 		       : Fcons (build_string ("no selection"),
1730 				Fcons (x_atom_to_symbol (display,
1731 							 selection_atom),
1732 				       Qnil)));
1733 	    }
1734 	

At conditional (8): "actual_type == (dpyinfo)->Xatom_INCR" taking false path

1735 	  if (actual_type == dpyinfo->Xatom_INCR)
1736 	    {
1737 	      /* That wasn't really the data, just the beginning.  */
1738 	

Event var_deref_op: Variable "data" tracked as NULL was dereferenced.
Also see events: [var_compare_op][var_deref_model][var_deref_model][var_deref_model]

Re: Problem report #22

[Stuart D. Herring]

> 1713 	  if (! data)
> 1714 	    {
> 1715 	      int there_is_a_selection_owner;
> 1716 	      BLOCK_INPUT;
> 1717 	      there_is_a_selection_owner
> 1718 		= XGetSelectionOwner (display, selection_atom);
>
> At conditional (2): "interrupt_input_blocked == 0" taking true path
> At conditional (3): "interrupt_input_pending != 0" taking true path
> At conditional (4): "pending_atimers != 0" taking true path
> At conditional (5): "0" taking false path
>
> 1719 	      UNBLOCK_INPUT;
>
> At conditional (6): "there_is_a_selection_owner != 0" taking true path
> At conditional (7): "actual_type != 0" taking true path
>
> 1720 	      Fsignal (Qerror,
> [...]

If data is NULL, FSignal is always called and does a _longjmp in
unwind_to_catch...

> Event var_deref_op: Variable "data" tracked as NULL was dereferenced.
> Also see events:
> [var_compare_op][var_deref_model][var_deref_model][var_deref_model]

...So this is never reached.  No bug.

Davis

-- 
This product is sold by volume, not by mass.  If it appears too dense or
too sparse, it is because mass-energy conversion has occurred during
shipping.