dereference of NULL ‘str_obj’ [CWE-476] [-Wanalyzer-null-dereference]
61 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~^~~~~
new_string_obj
new_string_obj: events 1-2
47 string_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(1) entry to ‘new_string_obj’
[...]
53 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 3-4
37 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(3) entry to ‘alloc_obj’
[...]
40 if (!obj)
~
|
(4) following ‘true’ branch (when ‘obj’ is NULL)... ─>─┐
│
alloc_obj: event 5
│
┌────────────────────────────────────────────────────────────┘
41│ return NULL; /* { dg-message "using NULL here" } */
│ ^~~~
│ |
└──────────>(5) ...to here
alloc_obj: event 6
41 return NULL; /* { dg-message "using NULL here" } */
^~~~
|
(6) using NULL here
new_string_obj: events 7-9
53 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(7) returning to ‘new_string_obj’ from ‘alloc_obj’
[...]
61 str_obj->str_len = len; /* { dg-warning "dereference of NULL 'str_obj'" } */
~~~~~~~~~~~~~~~~~~~~~~
|
(9) ⚠️ dereference of NULL ‘str_obj’
[...]
64 return str_obj;
~~~~~~~
|
(8) ‘str_obj’ is NULL
leak of ‘obj’ [CWE-401] [-Wanalyzer-malloc-leak]
78 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
^
test_1
test_1: events 1-2
73 void test_1 (const char *str)
^~~~~~
|
(1) entry to ‘test_1’
74 {
75 string_obj *obj = new_string_obj (str);
~~~~~~~~~~~~~~~~~~~~
|
(2) calling ‘new_string_obj’ from ‘test_1’
new_string_obj
new_string_obj: events 3-4
47 string_obj *new_string_obj (const char *str)
^~~~~~~~~~~~~~
|
(3) entry to ‘new_string_obj’
[...]
53 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(4) calling ‘alloc_obj’ from ‘new_string_obj’
alloc_obj
alloc_obj: events 5-9
37 base_obj *alloc_obj (type_obj *ob_type, size_t sz)
^~~~~~~~~
|
(5) entry to ‘alloc_obj’
38 {
39 base_obj *obj = (base_obj *)malloc (sz);
~~~~~~~~~~~
|
(6) allocated here
40 if (!obj)
~
|
(7) assuming ‘obj’ is non-NULL
(8) following ‘false’ branch (when ‘obj’ is non-NULL)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────┘
41│ return NULL; /* { dg-message "using NULL here" } */
42│ obj->ob_type = ob_type;
│ ~~~~~~~~~~~~~~~~~~~~~~
│ |
└──────────────>(9) ...to here
new_string_obj: event 10
53 = (string_obj *)alloc_obj (&str_type, sizeof (string_obj) + len + 1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
(10) returning to ‘new_string_obj’ from ‘alloc_obj’
test_1: events 11-14
75 string_obj *obj = new_string_obj (str);
^~~~~~~~~~~~~~~~~~~~
|
(11) returning to ‘test_1’ from ‘new_string_obj’
76 if (obj)
~
|
(12) following ‘true’ branch (when ‘obj’ is non-NULL)... ─>─┐
│
│
┌─────────────────────────────────────────────────────────────────┘
77│ unref (obj);
│ ~~~~~~~~~~~
│ |
└───>(13) ...to here
(14) calling ‘unref’ from ‘test_1’
unref
unref: events 15-17
67 void unref (string_obj *obj)
^~~~~
|
(15) entry to ‘unref’
68 {
69 if (--obj->str_base.ob_refcnt == 0)
~
|
(16) following ‘false’ branch... ─>─┐
│
│
┌─────────────────────────────────────────┘
70│ free (obj);
71│}
│~
│|
└(17) ...to here
test_1: events 18-19
77 unref (obj);
^~~~~~~~~~~
|
(18) returning to ‘test_1’ from ‘unref’
78 } /* { dg-bogus "leak" "" { xfail *-*-* } } */
~
|
(19) ⚠️ ‘obj’ leaks here; was allocated at (6)