Re: clang static analyzer

From: Junio C Hamano <gitster@pobox.com>
Date: Dec 7, 2009, 00:26 UTC
Message-ID: <7vpr6rd3ye.fsf@alter.siamese.dyndns.org>
In-Reply-To: <33ABC714-2BCC-4910-BCAE-D331AAF2A724@dbservice.com>

Tomas Carnecky <tom@dbservice.com> writes:

> xdiff-interface.c:xdiff_set_find_func() - When 'value' is a string with
> no newline character in it, the loop at line 291 sets 'value' to NULL on
> its first iteration and then passes 'value' to strchr() in the second
> iteration.

Thanks, but I am confused with your analysis.

If value doesn't have '\n', then regs->nr is 1 when you go into the loop at ll. 291-, because we counted the number of LF in the first loop in the function.

The first iteration of the second loop sets ep to NULL, expression is set to value, then we run regcomp on the expression. Then at the end of the loop we do set value to a bogus "(char*)1". But incrementing i makes it go over regs->nr and satisfy the termination condition of the loop; we happily exit the loop before we use the now bogus "value".