Problem report #50

Problem report #50

[Dan Nicolaescu]

ERROR
CID: 50
Checker: REVERSE_INULL (help)
File: emacs/src/xrdb.c
Function: get_user_app
Description: Pointer "free_it" dereferenced before NULL check

Event deref_ptr_in_call: Dereferences pointer "free_it" [model]
Also see events: [check_after_deref]
At conditional (1): "file = search_magic_path != 0" taking false path
At conditional (2): "file = search_magic_path != 0" taking false path

419  	  if (((path = getenv ("XUSERFILESEARCHPATH"))
420  	       && (file = search_magic_path (path, class, 0, 0)))
421  	
422  	      /* Check for APPLRESDIR; it is a path of directories.  In each,
423  		 we have to search for LANG/CLASS and then CLASS.  */
424  	      || ((path = getenv ("XAPPLRESDIR"))
425  		  && ((file = search_magic_path (path, class, "/%L/%N", 0))
426  		      || (file = search_magic_path (path, class, "/%N", 0))))
427  	
428  	      /* Check in the home directory.  This is a bit of a hack; let's
429  		 hope one's home directory doesn't contain any %-escapes.  */
430  	      || (free_it = gethomedir (),
431  		  ((file = search_magic_path (free_it, class, "%L/%N", 0))
432  		   || (file = search_magic_path (free_it, class, "%N", 0)))))
433  	    {
434  	      XrmDatabase db = XrmGetFileDatabase (file);
435  	      free (file);
436  	      if (free_it)
437  		free (free_it);
438  	      return db;
439  	    }
440  	

Event check_after_deref: Pointer "free_it" dereferenced before NULL check
Also see events: [deref_ptr_in_call]

441  	  if (free_it)
442  	    free (free_it);
443  	  return NULL;
444  	}
445 

Re: Problem report #50

[Andreas Schwab]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> 428  	      /* Check in the home directory.  This is a bit of a hack; let's
> 429  		 hope one's home directory doesn't contain any %-escapes.  */
> 430  	      || (free_it = gethomedir (),
> 431  		  ((file = search_magic_path (free_it, class, "%L/%N", 0))
> 432  		   || (file = search_magic_path (free_it, class, "%N", 0)))))
> 433  	    {
> 434  	      XrmDatabase db = XrmGetFileDatabase (file);
> 435  	      free (file);
> 436  	      if (free_it)
> 437  		free (free_it);
> 438  	      return db;
> 439  	    }
> 440  	
>
> Event check_after_deref: Pointer "free_it" dereferenced before NULL check
> Also see events: [deref_ptr_in_call]

This is wrong, since gethomedir always returns non-NULL (but not always a
heap pointer, which i've fixed now).

Andreas.

-- 
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux Products GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
PGP key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."