emacs-devel
[Top][All Lists]

## Problem report #15

 From: Dan Nicolaescu Subject: Problem report #15 Date: Tue, 11 Apr 2006 08:48:17 -0700

```CID: 15
Checker: FORWARD_NULL (help)
File: emacs/src/process.c
Description: Incrementing possibly NULL value "cp"

Event assign_zero: Variable "cp" assigned value 0.
Also see events: [dereference]

2335      register unsigned char *cp = NULL;
2336      register int i;
2337
2338      bzero (sa, len);
2339      sa->sa_family = family;
2340

At conditional (1): "address & 7 == 4" taking true path
At conditional (2): "((0), (address & -8))->size & 1073741824 == 0" taking true
path

2342        {

At conditional (3): "family == 2" taking false path

2344          if (family == AF_INET)
2345            {
2347              len = sizeof (sin->sin_addr) + 1;
2348              i = XINT (p->contents[--len]);
2349              sin->sin_port = htons (i);
2350              cp = (unsigned char *)&sin->sin_addr;
2351            }
2352    #ifdef AF_INET6

At conditional (4): "family == 10" taking false path

2353          else if (family == AF_INET6)
2354            {
2356              uint16_t *ip6 = (uint16_t *)&sin6->sin6_addr;
2357              len = sizeof (sin6->sin6_addr) + 1;
2358              i = XINT (p->contents[--len]);
2359              sin6->sin6_port = htons (i);
2360              for (i = 0; i < len; i++)
2361                if (INTEGERP (p->contents[i]))
2362                  {
2363                    int j = XFASTINT (p->contents[i]) & 0xffff;
2364                    ip6[i] = ntohs (j);
2365                  }
2366              return;
2367            }
2368    #endif
2369        }
2371        {
2372    #ifdef HAVE_LOCAL_SOCKETS
2373          if (family == AF_LOCAL)
2374            {
2377              for (i = 0; i < sizeof (sockun->sun_path) && *cp; i++)
2378                sockun->sun_path[i] = *cp++;
2379            }
2380    #endif
2381          return;
2382        }
2383      else
2384        {
2385          p = XVECTOR (XCDR (address));
2386          cp = (unsigned char *)sa + sizeof (sa->sa_family);
2387        }
2388

At conditional (5): "i < len" taking true path

2389      for (i = 0; i < len; i++)

At conditional (6): "(p)->contents[i] & 7 == 0" taking true path

2390        if (INTEGERP (p->contents[i]))

Event dereference: Incrementing possibly NULL value "cp"
Also see events: [assign_zero]

2391          *cp++ = XFASTINT (p->contents[i]) & 0xff;
2392    }

```