Problem report #15

[Dan Nicolaescu]

CID: 15
Checker: FORWARD_NULL (help)
File: emacs/src/process.c
Function: conv_lisp_to_sockaddr
Description: Incrementing possibly NULL value "cp"

Event assign_zero: Variable "cp" assigned value 0.
Also see events: [dereference]

2335      register unsigned char *cp = NULL;
2336      register int i;
2337    
2338      bzero (sa, len);
2339      sa->sa_family = family;
2340    

At conditional (1): "address & 7 == 4" taking true path
At conditional (2): "((0), (address & -8))->size & 1073741824 == 0" taking true 
path

2341      if (VECTORP (address))
2342        {
2343          p = XVECTOR (address);

At conditional (3): "family == 2" taking false path

2344          if (family == AF_INET)
2345            {
2346              struct sockaddr_in *sin = (struct sockaddr_in *) sa;
2347              len = sizeof (sin->sin_addr) + 1;
2348              i = XINT (p->contents[--len]);
2349              sin->sin_port = htons (i);
2350              cp = (unsigned char *)&sin->sin_addr;
2351            }
2352    #ifdef AF_INET6

At conditional (4): "family == 10" taking false path

2353          else if (family == AF_INET6)
2354            {
2355              struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) sa;
2356              uint16_t *ip6 = (uint16_t *)&sin6->sin6_addr;
2357              len = sizeof (sin6->sin6_addr) + 1;
2358              i = XINT (p->contents[--len]);
2359              sin6->sin6_port = htons (i);
2360              for (i = 0; i < len; i++)
2361                if (INTEGERP (p->contents[i]))
2362                  {
2363                    int j = XFASTINT (p->contents[i]) & 0xffff;
2364                    ip6[i] = ntohs (j);
2365                  }
2366              return;
2367            }
2368    #endif
2369        }
2370      else if (STRINGP (address))
2371        {
2372    #ifdef HAVE_LOCAL_SOCKETS
2373          if (family == AF_LOCAL)
2374            {
2375              struct sockaddr_un *sockun = (struct sockaddr_un *) sa;
2376              cp = SDATA (address);
2377              for (i = 0; i < sizeof (sockun->sun_path) && *cp; i++)
2378                sockun->sun_path[i] = *cp++;
2379            }
2380    #endif
2381          return;
2382        }
2383      else
2384        {
2385          p = XVECTOR (XCDR (address));
2386          cp = (unsigned char *)sa + sizeof (sa->sa_family);
2387        }
2388    

At conditional (5): "i < len" taking true path

2389      for (i = 0; i < len; i++)

At conditional (6): "(p)->contents[i] & 7 == 0" taking true path

2390        if (INTEGERP (p->contents[i]))

Event dereference: Incrementing possibly NULL value "cp"
Also see events: [assign_zero]

2391          *cp++ = XFASTINT (p->contents[i]) & 0xff;
2392    }