dereference of NULL ‘str_obj’ [CWE-476] [-Wanalyzer-null-dereference]
83 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~^~~~~
new_string_obj
new_string_obj: events 1-2
69 base_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(1) entry to ‘new_string_obj’
[...]
75 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 3-4
59 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(3) entry to ‘alloc_obj’
[...]
62 if (!obj)
~
|
(4) following ‘true’ branch (when ‘obj’ is NULL)... ─>─┐
│
alloc_obj: event 5
│
┌────────────────────────────────────────────────────────────┘
63│ return NULL; /* { dg-message "using NULL here" } */
│ ^~~~
│ |
└──────────>(5) ...to here
alloc_obj: event 6
63 return NULL; /* { dg-message "using NULL here" } */
^~~~
|
(6) using NULL here
new_string_obj: events 7-9
75 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(7) returning to ‘new_string_obj’ from ‘alloc_obj’
[...]
83 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~~~~~~
|
(9) ⚠️ dereference of NULL ‘str_obj’
[...]
86 return (base_obj *)str_obj;
~~~~~~~~~~~~~~~~~~~
|
(8) ‘str_obj’ is NULL
leak of ‘obj’ [CWE-401] [-Wanalyzer-malloc-leak]
99 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
^
test_1
test_1: events 1-2
95 void test_1 (const char *str)
^~~~~~
|
(1) entry to ‘test_1’
96 {
97 base_obj *obj = new_string_obj (str);
~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘new_string_obj’ from ‘test_1’
new_string_obj
new_string_obj: events 3-4
69 base_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(3) entry to ‘new_string_obj’
[...]
75 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(4) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 5-9
59 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(5) entry to ‘alloc_obj’
60 {
61 base_obj *obj = (base_obj *)malloc (sz);
~~~~~~~~~~~
|
(6) allocated here
62 if (!obj)
~
|
(7) assuming ‘obj’ is non-NULL
(8) following ‘false’ branch (when ‘obj’ is non-NULL)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────┘
63│ return NULL; /* { dg-message "using NULL here" } */
64│ obj->ob_type = ob_type;
│ ~~~~~~~~~~~~~~~~~~~~~~
│ |
└──────────────>(9) ...to here
new_string_obj: event 10
75 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(10) returning to ‘new_string_obj’ from ‘alloc_obj’
test_1: events 11-12
97 base_obj *obj = new_string_obj (str);
^~~~~~~~~~~~~~~~~~~~
|
(11) returning to ‘test_1’ from ‘new_string_obj’
98 unref (obj);
~~~~~~~~~~~
|
(12) calling ‘unref’ from ‘test_1’
unref
unref: events 13-15
89 void unref (base_obj *obj)
^~~~~
|
(13) entry to ‘unref’
90 {
91 if (--obj->ob_refcnt == 0) /* { dg-bogus "dereference of uninitialized pointer 'obj'" } */
~
|
(14) following ‘false’ branch... ─>─┐
│
│
┌─────────────────────────────────────────┘
92│ obj->ob_type->tp_dealloc (obj);
93│}
│~
│|
└(15) ...to here
test_1: events 16-17
98 unref (obj);
^~~~~~~~~~~
|
(16) returning to ‘test_1’ from ‘unref’
99 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
~
|
(17) ⚠️ ‘obj’ leaks here; was allocated at (6)