{"thread":{"id":"39979","subject":"Fwd: New Defects reported by Coverity Scan for git","startedAt":"2015-07-31T11:24:13Z","lastAt":"2015-07-31T16:58:58Z","messageCount":3,"participants":["Duy Nguyen","Stefan Beller"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"267196","messageId":"CACsJy8AfYHOCBdSNyBZP0CdYJGkXbipn0t7E_C8j7c25LET4Qg@mail.gmail.com","threadId":"39979","inReplyTo":"55bb53d17f78c_2d71521318537c@scan.mail","subject":"Fwd: New Defects reported by Coverity Scan for git","fromName":"Duy Nguyen","fromEmail":"pclouds@gmail.com","sentAt":"2015-07-31T11:24:13Z","receivedAt":"2015-07-31T11:24:13Z","isPatch":false,"sender":{"key":"pclouds@gmail.com","avatar":"https://avatars.githubusercontent.com/u/720?v=4"},"body":"Jeff, I suppose you are the admin of git on scan.coverity, or knows\nhim/her, perhaps we can add a model for xmalloc to suppress these\n\"null pointer deferences\" reports? We are sure xmalloc() never returns\nNULL. Qemu did it [1] and it looks simple.. I think something like\nthis would do\n\nvoid *xmalloc(size_t size)\n{\n void *mem = malloc(size);\n if (!mem) __coverity_panic__();\n return mem;\n}\n\n[1] http://git.qemu.org/?p=qemu.git;a=blob;f=scripts/coverity-model.c;h=4c99a85cfc292caa9edd9d041e2683ee53490a8d;hb=e40cdb0e6efb795e4d19368987d53e3e4ae19cf7#l104\n\n\n---------- Forwarded message ----------\nFrom: \nDate: Fri, Jul 31, 2015 at 5:54 PM\nSubject: New Defects reported by Coverity Scan for git\nTo: pclouds@gmail.com\n\n_______________________________________________________________________________________________________\n*** CID 1313836: Null pointer dereferences (FORWARD_NULL)\n/rerere.c: 150 in find_rerere_dir()\n144 return NULL; /* BUG */\n145 pos = sha1_pos(sha1, rerere_dir, rerere_dir_nr,\nrerere_dir_sha1);\n146 if (pos < 0) {\n147 rr_dir = xmalloc(sizeof(*rr_dir));\n148 hashcpy(rr_dir->sha1, sha1);\n149 rr_dir->status_nr = rr_dir->status_alloc = 0;\n>>> CID 1313836: Null pointer dereferences (FORWARD_NULL)\n>>> Assigning: \"rr_dir->status\" = \"NULL\".\n150 rr_dir->status = NULL;\n151 pos = -1 - pos;\n152\n153 /* Make sure the array is big enough ... */\n154 ALLOC_GROW(rerere_dir, rerere_dir_nr + 1,\nrerere_dir_alloc);\n155 /* ... and add it in. */\n\n** CID 1313835: Null pointer dereferences (FORWARD_NULL)\n/builtin/fetch.c: 795 in prune_refs()\n-- \nDuy\n"},{"id":"267201","messageId":"CAGZ79kZMzy7x7HufeM1dotmhKn5HEw_Yoo5p8bYOfUKLbjxSww@mail.gmail.com","threadId":"39979","inReplyTo":"CACsJy8AfYHOCBdSNyBZP0CdYJGkXbipn0t7E_C8j7c25LET4Qg@mail.gmail.com","subject":"Re: New Defects reported by Coverity Scan for git","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2015-07-31T16:11:55Z","receivedAt":"2015-07-31T16:11:55Z","isPatch":false,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"On Fri, Jul 31, 2015 at 4:24 AM, Duy Nguyen wrote:\n> Jeff, I suppose you are the admin of git on scan.coverity, or knows\n> him/her, perhaps we can add a model for xmalloc to suppress these\n> \"null pointer deferences\" reports? We are sure xmalloc() never returns\n> NULL. Qemu did it [1] and it looks simple.. I think something like\n> this would do\n>\n> void *xmalloc(size_t size)\n> {\n> void *mem = malloc(size);\n> if (!mem) __coverity_panic__();\n> return mem;\n> }\n>\n> [1] http://git.qemu.org/?p=qemu.git;a=blob;f=scripts/coverity-model.c;h=4c99a85cfc292caa9edd9d041e2683ee53490a8d;hb=e40cdb0e6efb795e4d19368987d53e3e4ae19cf7#l104\n>\n\nTaking just that excerpt doesn't work. Upload fails with\n\"modeling_file.c\", line 12: error #20:\n identifier \"malloc\" is undefined\n void *mem = malloc(size);\n\nI'll look into your reference[1] a bit more and try to follow it as a guidance.\n\n\n>\n> ---------- Forwarded message ----------\n> From: \n> Date: Fri, Jul 31, 2015 at 5:54 PM\n> Subject: New Defects reported by Coverity Scan for git\n> To: pclouds@gmail.com\n>\n> _______________________________________________________________________________________________________\n> *** CID 1313836: Null pointer dereferences (FORWARD_NULL)\n> /rerere.c: 150 in find_rerere_dir()\n> 144 return NULL; /* BUG */\n> 145 pos = sha1_pos(sha1, rerere_dir, rerere_dir_nr,\n> rerere_dir_sha1);\n> 146 if (pos < 0) {\n> 147 rr_dir = xmalloc(sizeof(*rr_dir));\n> 148 hashcpy(rr_dir->sha1, sha1);\n> 149 rr_dir->status_nr = rr_dir->status_alloc = 0;\n>>>> CID 1313836: Null pointer dereferences (FORWARD_NULL)\n>>>> Assigning: \"rr_dir->status\" = \"NULL\".\n> 150 rr_dir->status = NULL;\n> 151 pos = -1 - pos;\n> 152\n> 153 /* Make sure the array is big enough ... */\n> 154 ALLOC_GROW(rerere_dir, rerere_dir_nr + 1,\n> rerere_dir_alloc);\n> 155 /* ... and add it in. */\n>\n> ** CID 1313835: Null pointer dereferences (FORWARD_NULL)\n> /builtin/fetch.c: 795 in prune_refs()\n> --\n> Duy\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at http://vger.kernel.org/majordomo-info.html\n"},{"id":"267203","messageId":"CAGZ79kYKykLBD9VddmuV7BXJGF5YncJbn8pvs-wdEy-=1ucpuA@mail.gmail.com","threadId":"39979","inReplyTo":"CAGZ79kZMzy7x7HufeM1dotmhKn5HEw_Yoo5p8bYOfUKLbjxSww@mail.gmail.com","subject":"Re: New Defects reported by Coverity Scan for git","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2015-07-31T16:58:58Z","receivedAt":"2015-07-31T16:58:58Z","isPatch":false,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"On Fri, Jul 31, 2015 at 9:11 AM, Stefan Beller wrote:\n> On Fri, Jul 31, 2015 at 4:24 AM, Duy Nguyen wrote:\n>> Jeff, I suppose you are the admin of git on scan.coverity, or knows\n>> him/her, perhaps we can add a model for xmalloc to suppress these\n>> \"null pointer deferences\" reports? We are sure xmalloc() never returns\n>> NULL. Qemu did it [1] and it looks simple.. I think something like\n>> this would do\n>>\n>> void *xmalloc(size_t size)\n>> {\n>> void *mem = malloc(size);\n>> if (!mem) __coverity_panic__();\n>> return mem;\n>> }\n>>\n>> [1] http://git.qemu.org/?p=qemu.git;a=blob;f=scripts/coverity-model.c;h=4c99a85cfc292caa9edd9d041e2683ee53490a8d;hb=e40cdb0e6efb795e4d19368987d53e3e4ae19cf7#l104\n>>\n>\n> Taking just that excerpt doesn't work. Upload fails with\n> \"modeling_file.c\", line 12: error #20:\n> identifier \"malloc\" is undefined\n> void *mem = malloc(size);\n>\n> I'll look into your reference[1] a bit more and try to follow it as a guidance.\n\nSo I put in these lines into the modeling file:\nvoid *malloc(size_t);\nvoid *calloc(size_t, size_t);\nvoid *realloc(void *, size_t);\nvoid free(void *);\n\n\nvoid *xrealloc(void *ptr, size_t size)\n{\n void *ret = realloc(ptr, size);\n if (!ret) __coverity_panic__();\n return ret;\n}\n\nvoid *xmalloc(size_t size)\n{\n void *mem = malloc(size);\n if (!mem) __coverity_panic__();\n return mem;\n}\n\nvoid xcalloc(size_t num, size_t size)\n{\n void *ret = calloc(num, size);\n if (!ret) __coverity_panic__();\n return ret;\n}\n\nand there seem to be 42 new defects and 20 fixed defects by the modeling of\nmemory allocations. We'd need to check if coverity understood the modeling\nas we intended it. Looking at the first few issues, they seem to be\ncorrectly finding\nleaks.\n\n\n>\n>\n>>\n>> ---------- Forwarded message ----------\n>> From: \n>> Date: Fri, Jul 31, 2015 at 5:54 PM\n>> Subject: New Defects reported by Coverity Scan for git\n>> To: pclouds@gmail.com\n>>\n>> _______________________________________________________________________________________________________\n>> *** CID 1313836: Null pointer dereferences (FORWARD_NULL)\n>> /rerere.c: 150 in find_rerere_dir()\n>> 144 return NULL; /* BUG */\n>> 145 pos = sha1_pos(sha1, rerere_dir, rerere_dir_nr,\n>> rerere_dir_sha1);\n>> 146 if (pos < 0) {\n>> 147 rr_dir = xmalloc(sizeof(*rr_dir));\n>> 148 hashcpy(rr_dir->sha1, sha1);\n>> 149 rr_dir->status_nr = rr_dir->status_alloc = 0;\n>>>>> CID 1313836: Null pointer dereferences (FORWARD_NULL)\n>>>>> Assigning: \"rr_dir->status\" = \"NULL\".\n>> 150 rr_dir->status = NULL;\n>> 151 pos = -1 - pos;\n>> 152\n>> 153 /* Make sure the array is big enough ... */\n>> 154 ALLOC_GROW(rerere_dir, rerere_dir_nr + 1,\n>> rerere_dir_alloc);\n>> 155 /* ... and add it in. */\n>>\n>> ** CID 1313835: Null pointer dereferences (FORWARD_NULL)\n>> /builtin/fetch.c: 795 in prune_refs()\n>> --\n>> Duy\n>> --\n>> To unsubscribe from this list: send the line \"unsubscribe git\" in\n>> the body of a message to majordomo@vger.kernel.org\n>> More majordomo info at http://vger.kernel.org/majordomo-info.html\n"}]}