dereference of NULL ‘str_obj’ [CWE-476] [-Wanalyzer-null-dereference]
67 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~^~~~~
new_string_obj
new_string_obj: events 1-2
53 string_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(1) entry to ‘new_string_obj’
[...]
59 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 3-4
43 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(3) entry to ‘alloc_obj’
[...]
46 if (!obj)
~
|
(4) following ‘true’ branch (when ‘obj’ is NULL)... ─>─┐
│
alloc_obj: event 5
│
┌────────────────────────────────────────────────────────────┘
47│ return NULL; /* { dg-message "using NULL here" } */
│ ^~~~
│ |
└──────────>(5) ...to here
alloc_obj: event 6
47 return NULL; /* { dg-message "using NULL here" } */
^~~~
|
(6) using NULL here
new_string_obj: events 7-9
59 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(7) returning to ‘new_string_obj’ from ‘alloc_obj’
[...]
67 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~~~~~~
|
(9) ⚠️ dereference of NULL ‘str_obj’
[...]
70 return str_obj;
~~~~~~~
|
(8) ‘str_obj’ is NULL
leak of ‘obj’ [CWE-401] [-Wanalyzer-malloc-leak]
89 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
^
test_1
test_1: events 1-2
83 void test_1 (const char *str)
^~~~~~
|
(1) entry to ‘test_1’
84 {
85 string_obj *obj = new_string_obj (str);
~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘new_string_obj’ from ‘test_1’
new_string_obj
new_string_obj: events 3-4
53 string_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(3) entry to ‘new_string_obj’
[...]
59 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(4) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 5-9
43 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(5) entry to ‘alloc_obj’
44 {
45 base_obj *obj = (base_obj *)malloc (sz);
~~~~~~~~~~~
|
(6) allocated here
46 if (!obj)
~
|
(7) assuming ‘obj’ is non-NULL
(8) following ‘false’ branch (when ‘obj’ is non-NULL)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────┘
47│ return NULL; /* { dg-message "using NULL here" } */
48│ obj->ob_type = ob_type;
│ ~~~~~~~~~~~~~~~~~~~~~~
│ |
└──────────────>(9) ...to here
new_string_obj: event 10
59 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(10) returning to ‘new_string_obj’ from ‘alloc_obj’
test_1: events 11-14
85 string_obj *obj = new_string_obj (str);
^~~~~~~~~~~~~~~~~~~~
|
(11) returning to ‘test_1’ from ‘new_string_obj’
86 //__analyzer_dump();
87 if (obj)
~
|
(12) following ‘true’ branch (when ‘obj’ is non-NULL)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────┘
88│ unref (obj);
│ ~~~~~~~~~~~
│ |
└───>(13) ...to here
(14) calling ‘unref’ from ‘test_1’
unref
unref: events 15-17
73 void unref (string_obj *obj)
^~~~~
|
(15) entry to ‘unref’
[...]
76 if (--obj->str_base.ob_refcnt == 0)
~
|
(16) following ‘false’ branch... ─>─┐
│
[...]
│
┌─────────────────────────────────────────┘
81│}
│~
│|
└(17) ...to here
test_1: events 18-19
88 unref (obj);
^~~~~~~~~~~
|
(18) returning to ‘test_1’ from ‘unref’
89 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
~
|
(19) ⚠️ ‘obj’ leaks here; was allocated at (6)