Problem report #123: base/src/emacs/src/casefiddle.c (casify_region); UNINIT

Problem report #123: base/src/emacs/src/casefiddle.c (casify_region); UNINIT

[Dan Nicolaescu]

CID: 123
Checker: UNINIT (help)
File: base/src/emacs/src/casefiddle.c
Function: casify_region
Description: Using uninitialized value "last"

Event var_decl: Declared variable "last" without initializer
Also see events: [uninit_use]

211  	  EMACS_INT first = -1, last;	/* Position of first and last changes.  */
212  	  EMACS_INT opoint = PT;
213  	  EMACS_INT opoint_byte = PT_BYTE;
214  	

At conditional (2): "b == e" taking false path

215  	  if (EQ (b, e))
216  	    /* Not modifying because nothing marked */
217  	    return;
218  	
219  	  /* If the case table is flagged as modified, rescan it.  */

At conditional (3): "((0), ((current_buffer)->downcase_table & -8))->extras[1] == Qnil" taking true path

220  	  if (NILP (XCHAR_TABLE (current_buffer->downcase_table)->extras[1]))
221  	    Fset_case_table (current_buffer->downcase_table);
222  	
223  	  validate_region (&b, &e);
224  	  start = XFASTINT (b);
225  	  end = XFASTINT (e);
226  	  modify_region (current_buffer, start, end, 0);
227  	  record_change (start, end - start);
228  	  start_byte = CHAR_TO_BYTE (start);
229  	  end_byte = CHAR_TO_BYTE (end);
230  	

At conditional (4): "start < end" taking true path
At conditional (19): "start < end" taking false path

231  	  while (start < end)
232  	    {
233  	      int c2, len;
234  	

At conditional (5): "multibyte != 0" taking true path

235  	      if (multibyte)
236  		{

At conditional (6): "start_byte >= ((current_buffer)->text)->gpt_byte" taking true path
At conditional (7): "*(_fetch_multibyte_char_p + 0) & 128 == 0" taking true path

237  		  c = FETCH_MULTIBYTE_CHAR (start_byte);

At conditional (8): "c <= 127" taking true path

238  		  len = CHAR_BYTES (c);
239  		}
240  	      else
241  		{
242  		  c = FETCH_BYTE (start_byte);
243  		  MAKE_CHAR_MULTIBYTE (c);
244  		  len = 1;
245  		}
246  	      c2 = c;

At conditional (9): "inword != 0" taking true path
At conditional (10): "flag != 3" taking true path

247  	      if (inword && flag != CASE_CAPITALIZE_UP)

At conditional (11): "case_temp1 < 128" taking true path
At conditional (12): "((0), ((current_buffer)->downcase_table & -8))->ascii & 7 == 4" taking true path
At conditional (13): "((0), (((0), ((current_buffer)->downcase_table & -8))->ascii & -8))->size & 4611686018428436480 == 4611686018428436480" taking true path
At conditional (14): "((0), (((0), ((current_buffer)->downcase_table & -8))->ascii & -8))->contents[case_temp1] != Qnil" taking true path
At conditional (15): "case_temp2 & 7 == 0" taking true path
At conditional (16): "case_temp2 >> 3 >= 0" taking true path

248  		c = DOWNCASE (c);
249  	      else if (!UPPERCASEP (c)
250  		       && (!inword || flag != CASE_CAPITALIZE_UP))
251  		c = UPCASE1 (c);

At conditional (17): "flag >= 2" taking false path

252  	      if ((int) flag >= (int) CASE_CAPITALIZE)
253  		inword = ((SYNTAX (c) == Sword) && (inword || !SYNTAX_PREFIX (c)));

At conditional (18): "c != c2" taking false path

254  	      if (c != c2)
255  		{
256  		  last = start;
257  		  if (first < 0)
258  		    first = start;
259  	
260  		  if (! multibyte)
261  		    {
262  		      MAKE_CHAR_UNIBYTE (c);
263  		      FETCH_BYTE (start_byte) = c;
264  		    }
265  		  else if (ASCII_CHAR_P (c2) && ASCII_CHAR_P (c))
266  		    FETCH_BYTE (start_byte) = c;
267  		  else
268  		    {
269  		      int tolen = CHAR_BYTES (c);
270  		      int j;
271  		      unsigned char str[MAX_MULTIBYTE_LENGTH];
272  	
273  		      CHAR_STRING (c, str);
274  		      if (len == tolen)
275  			{
276  			  /* Length is unchanged.  */
277  			  for (j = 0; j < len; ++j)
278  			    FETCH_BYTE (start_byte + j) = str[j];
279  			}
280  		      else
281  			{
282  			  /* Replace one character with the other,
283  			     keeping text properties the same.  */
284  			  replace_range_2 (start, start_byte,
285  					   start + 1, start_byte + len,
286  					   str, 1, tolen,
287  					   0);
288  			  len = tolen;
289  			}
290  		    }
291  		}
292  	      start++;
293  	      start_byte += len;
294  	    }
295  	

At conditional (20): "((current_buffer)->pt + 0) != opoint" taking true path

296  	  if (PT != opoint)
297  	    TEMP_SET_PT_BOTH (opoint, opoint_byte);
298  	

At conditional (21): "first >= 0" taking true path

299  	  if (first >= 0)
300  	    {

Event uninit_use: Using uninitialized value "last"
Also see events: [var_decl]

301  	      signal_after_change (first, last + 1 - first, last + 1 - first);
302  	      update_compositions (first, last + 1, CHECK_ALL);
303  	    }

Re: Problem report #123: base/src/emacs/src/casefiddle.c (casify_region); UNINIT

[Chong Yidong]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> CID: 123
> Checker: UNINIT (help)
> File: base/src/emacs/src/casefiddle.c
> Function: casify_region
> Description: Using uninitialized value "last"

This is bogus.  The variable "last" always has an assigned value if
"first" is non-zero, as is the case here.

> 211  	  EMACS_INT first = -1, last;
...
> 254  	      if (c != c2)
> 255  		{
> 256  		  last = start;
> 257  		  if (first < 0)
> 258  		    first = start;
...
> At conditional (21): "first >= 0" taking true path
>
> 299  	  if (first >= 0)
> 300  	    {
>
> Event uninit_use: Using uninitialized value "last"
> Also see events: [var_decl]
>
> 301  	      signal_after_change (first, last + 1 - first, last + 1 - first);