/usr/src/gnu/usr.bin/binutils-2.17/bfd/dwarf1.c

Bug Summary

File:	src/gnu/usr.bin/binutils-2.17/bfd/dwarf1.c
Warning:	line 410, column 12 Dereference of null pointer

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name dwarf1.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/binutils-2.17/obj/bfd -resource-dir /usr/local/lib/clang/13.0.0 -D HAVE_CONFIG_H -I . -I /usr/src/gnu/usr.bin/binutils-2.17/bfd -I . -D NETBSD_CORE -I . -I /usr/src/gnu/usr.bin/binutils-2.17/bfd -I /usr/src/gnu/usr.bin/binutils-2.17/bfd/../include -I /usr/src/gnu/usr.bin/binutils-2.17/bfd/../intl -I ../intl -D PIE_DEFAULT=1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/gnu/usr.bin/binutils-2.17/obj/bfd -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/usr.bin/binutils-2.17/bfd/dwarf1.c

1/* DWARF 1 find nearest line (_bfd_dwarf1_find_nearest_line).
 Copyright 1998, 1999, 2000, 2001, 2002, 2004, 2005
 Free Software Foundation, Inc.

 Written by Gavin Romig-Koch of Cygnus Solutions (gavin@cygnus.com).

 This file is part of BFD.

 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or (at
 your option) any later version.

 This program is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 General Public License for more details.

 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA.  */

23#include "bfd.h"
24#include "sysdep.h"
25#include "libiberty.h"
26#include "libbfd.h"
27#include "elf-bfd.h"
28#include "elf/dwarf.h"

30/* dwarf1_debug is the starting point for all dwarf1 info.  */

32struct dwarf1_debug
33{
/* The bfd we are working with.  */
bfd* abfd;

/* List of already parsed compilation units.  */
struct dwarf1_unit* lastUnit;

/* The buffer for the .debug section.
   Zero indicates that the .debug section failed to load.  */
char* debug_section;

/* Pointer to the end of the .debug_info section memory buffer.  */
char* debug_section_end;

/* The buffer for the .line section.  */
char* line_section;

/* End of that buffer.  */
char* line_section_end;

/* The current or next unread die within the .debug section.  */
char* currentDie;
55};

57/* One dwarf1_unit for each parsed compilation unit die.  */

59struct dwarf1_unit
60{
/* Linked starting from stash->lastUnit.  */
struct dwarf1_unit* prev;

/* Name of the compilation unit.  */
char* name;

/* The highest and lowest address used in the compilation unit.  */
unsigned long low_pc;
unsigned long high_pc;

/* Does this unit have a statement list?  */
int has_stmt_list;

/* If any, the offset of the line number table in the .line section.  */
unsigned long stmt_list_offset;

/* If non-zero, a pointer to the first child of this unit.  */
char* first_child;

/* How many line entries?  */
unsigned long line_count;

/* The decoded line number table (line_count entries).  */
struct linenumber* linenumber_table;

/* The list of functions in this unit.  */
struct dwarf1_func* func_list;
88};

90/* One dwarf1_func for each parsed function die.  */

92struct dwarf1_func
93{
/* Linked starting from aUnit->func_list.  */
struct dwarf1_func* prev;

/* Name of function.  */
char* name;

/* The highest and lowest address used in the compilation unit.  */
unsigned long low_pc;
unsigned long high_pc;
103};

105/* Used to return info about a parsed die.  */
106struct die_info
107{
unsigned long length;
unsigned long sibling;
unsigned long low_pc;
unsigned long high_pc;
unsigned long stmt_list_offset;

char* name;

int has_stmt_list;

unsigned short tag;
119};

121/* Parsed line number information.  */
122struct linenumber
123{
/* First address in the line.  */
unsigned long addr;

/* The line number.  */
unsigned long linenumber;
129};

131/* Find the form of an attr, from the attr field.  */
132#define FORM_FROM_ATTR(attr)((attr) & 0xF)	((attr) & 0xF)	/* Implicitly specified.  */

134/* Return a newly allocated dwarf1_unit.  It should be cleared and
 then attached into the 'stash' at 'stash->lastUnit'.  */

137static struct dwarf1_unit*
138alloc_dwarf1_unit (struct dwarf1_debug* stash)
139{
bfd_size_type amt = sizeof (struct dwarf1_unit);

struct dwarf1_unit* x = bfd_zalloc (stash->abfd, amt);
x->prev = stash->lastUnit;
stash->lastUnit = x;

return x;
147}

149/* Return a newly allocated dwarf1_func.  It must be cleared and
 attached into 'aUnit' at 'aUnit->func_list'.  */

152static struct dwarf1_func *
153alloc_dwarf1_func (struct dwarf1_debug* stash, struct dwarf1_unit* aUnit)
154{
bfd_size_type amt = sizeof (struct dwarf1_func);

struct dwarf1_func* x = bfd_zalloc (stash->abfd, amt);
x->prev = aUnit->func_list;
aUnit->func_list = x;

return x;
162}

164/* parse_die - parse a Dwarf1 die.
 Parse the die starting at 'aDiePtr' into 'aDieInfo'.
 'abfd' must be the bfd from which the section that 'aDiePtr'
 points to was pulled from.

 Return FALSE if the die is invalidly formatted; TRUE otherwise.  */

171static bfd_boolean
172parse_die (bfd *             abfd,
  struct die_info * aDieInfo,
  char *            aDiePtr,
  char *            aDiePtrEnd)
176{
char* this_die = aDiePtr;
char* xptr = this_die;

memset (aDieInfo, 0, sizeof (* aDieInfo));

/* First comes the length.  */
aDieInfo->length = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
xptr += 4;
if (aDieInfo->length == 0
    || (this_die + aDieInfo->length) >= aDiePtrEnd)
  return FALSE0;
if (aDieInfo->length < 6)
  {
    /* Just padding bytes.  */
    aDieInfo->tag = TAG_padding;
    return TRUE1;
  }

/* Then the tag.  */
aDieInfo->tag = bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
xptr += 2;

/* Then the attributes.  */
while (xptr < (this_die + aDieInfo->length))
  {
    unsigned short attr;

    /* Parse the attribute based on its form.  This section
       must handle all dwarf1 forms, but need only handle the
actual attributes that we care about.  */
    attr = bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
    xptr += 2;

    switch (FORM_FROM_ATTR (attr)((attr) & 0xF))
{
case FORM_DATA2:
 xptr += 2;
 break;
case FORM_DATA4:
case FORM_REF:
 if (attr == AT_sibling)
   aDieInfo->sibling = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 else if (attr == AT_stmt_list)
   {
     aDieInfo->stmt_list_offset = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
     aDieInfo->has_stmt_list = 1;
   }
 xptr += 4;
 break;
case FORM_DATA8:
 xptr += 8;
 break;
case FORM_ADDR:
 if (attr == AT_low_pc)
   aDieInfo->low_pc = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 else if (attr == AT_high_pc)
   aDieInfo->high_pc = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 xptr += 4;
 break;
case FORM_BLOCK2:
 xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
 break;
case FORM_BLOCK4:
 xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 break;
case FORM_STRING:
 if (attr == AT_name)
   aDieInfo->name = xptr;
 xptr += strlen (xptr) + 1;
 break;
}
  }

return TRUE1;
251}

253/* Parse a dwarf1 line number table for 'aUnit->stmt_list_offset'
 into 'aUnit->linenumber_table'.  Return FALSE if an error
 occurs; TRUE otherwise.  */

257static bfd_boolean
258parse_line_table (struct dwarf1_debug* stash, struct dwarf1_unit* aUnit)
259{
char* xptr;

/* Load the ".line" section from the bfd if we haven't already.  */
if (stash->line_section == 0)
16
←
Assuming field 'line_section' is not equal to null→
17
←
Taking false branch→
  {
    asection *msec;
    bfd_size_type size;

    msec = bfd_get_section_by_name (stash->abfd, ".line");
    if (! msec)
return FALSE0;

    size = msec->rawsize ? msec->rawsize : msec->size;
    stash->line_section = bfd_alloc (stash->abfd, size);

    if (! stash->line_section)
return FALSE0;

    if (! bfd_get_section_contents (stash->abfd, msec, stash->line_section,
		      0, size))
{
 stash->line_section = 0;
 return FALSE0;
}

    stash->line_section_end = stash->line_section + size;
  }

xptr = stash->line_section + aUnit->stmt_list_offset;
if (xptr < stash->line_section_end)
18
←
Assuming 'xptr' is >= field 'line_section_end'→
19
←
Taking false branch→
  {
    unsigned long eachLine;
    char *tblend;
    unsigned long base;
    bfd_size_type amt;

    /* First comes the length.  */
    tblend = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
)) + xptr;
    xptr += 4;

    /* Then the base address for each address in the table.  */
    base = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
    xptr += 4;

    /* How many line entrys?
10 = 4 (line number) + 2 (pos in line) + 4 (address in line).  */
    aUnit->line_count = (tblend - xptr) / 10;

    /* Allocate an array for the entries.  */
    amt = sizeof (struct linenumber) * aUnit->line_count;
    aUnit->linenumber_table = bfd_alloc (stash->abfd, amt);

    for (eachLine = 0; eachLine < aUnit->line_count; eachLine++)
{
 /* A line number.  */
 aUnit->linenumber_table[eachLine].linenumber
   = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
 xptr += 4;

 /* Skip the position within the line.  */
 xptr += 2;

 /* And finally the address.  */
 aUnit->linenumber_table[eachLine].addr
   = base + bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
 xptr += 4;
}
  }

return TRUE1;
20
←
Returning without writing to 'aUnit->func_list', which participates in a condition later→
21
←
Returning without writing to 'aUnit->linenumber_table'→
22
←
Returning the value 1, which participates in a condition later→
330}

332/* Parse each function die in a compilation unit 'aUnit'.
 The first child die of 'aUnit' should be in 'aUnit->first_child',
 the result is placed in 'aUnit->func_list'.
 Return FALSE if error; TRUE otherwise.  */

337static bfd_boolean
338parse_functions_in_unit (struct dwarf1_debug* stash, struct dwarf1_unit* aUnit)
339{
char* eachDie;

if (aUnit->first_child)
  for (eachDie = aUnit->first_child;
 eachDie < stash->debug_section_end;
)
    {
struct die_info eachDieInfo;

if (! parse_die (stash->abfd, &eachDieInfo, eachDie,
	 stash->debug_section_end))
 return FALSE0;

if (eachDieInfo.tag == TAG_global_subroutine
   || eachDieInfo.tag == TAG_subroutine
   || eachDieInfo.tag == TAG_inlined_subroutine
   || eachDieInfo.tag == TAG_entry_point)
 {
   struct dwarf1_func* aFunc = alloc_dwarf1_func (stash,aUnit);

   aFunc->name = eachDieInfo.name;
   aFunc->low_pc = eachDieInfo.low_pc;
   aFunc->high_pc = eachDieInfo.high_pc;
 }

/* Move to next sibling, if none, end loop */
if (eachDieInfo.sibling)
 eachDie = stash->debug_section + eachDieInfo.sibling;
else
 break;
    }

return TRUE1;
373}

375/* Find the nearest line to 'addr' in 'aUnit'.
 Return whether we found the line (or a function) without error.  */

378static bfd_boolean
379dwarf1_unit_find_nearest_line (struct dwarf1_debug* stash,
	       struct dwarf1_unit* aUnit,
	       unsigned long addr,
	       const char **filename_ptr,
	       const char **functionname_ptr,
	       unsigned int *linenumber_ptr)
385{
int line_p = FALSE0;
int func_p = FALSE0;

if (aUnit->low_pc <= addr9.1
'addr' is >= field 'low_pc'
 && addr9.2
'addr' is < field 'high_pc'
 < aUnit->high_pc)
10
←
Taking true branch→
  {
    if (aUnit->has_stmt_list)
11
←
Assuming field 'has_stmt_list' is not equal to 0→
12
←
Taking true branch→
{
 unsigned long i;
 struct dwarf1_func* eachFunc;

 if (! aUnit->linenumber_table)
13
←
Assuming field 'linenumber_table' is null→
14
←
Taking true branch→
   {
     if (! parse_line_table (stash, aUnit))
15
←
Calling 'parse_line_table'→
23
←
Returning from 'parse_line_table'→
24
←
Taking false branch→
return FALSE0;
   }

 if (! aUnit->func_list)
25
←
Assuming field 'func_list' is non-null→
26
←
Taking false branch→
   {
     if (! parse_functions_in_unit (stash, aUnit))
return FALSE0;
   }

 for (i = 0; i < aUnit->line_count; i++)
27
←
Assuming 'i' is < field 'line_count'→
28
←
Loop condition is true.  Entering loop body→
   {
     if (aUnit->linenumber_table[i].addr <= addr
29
←
Dereference of null pointer
  && addr < aUnit->linenumber_table[i+1].addr)
{
  *filename_ptr = aUnit->name;
  *linenumber_ptr = aUnit->linenumber_table[i].linenumber;
  line_p = TRUE1;
  break;
}
   }

 for (eachFunc = aUnit->func_list;
      eachFunc;
      eachFunc = eachFunc->prev)
   {
     if (eachFunc->low_pc <= addr
  && addr < eachFunc->high_pc)
{
  *functionname_ptr = eachFunc->name;
  func_p = TRUE1;
  break;
}
   }
}
  }

return line_p || func_p;
436}

438/* The DWARF 1 version of find_nearest line.
 Return TRUE if the line is found without error.  */

441bfd_boolean
442_bfd_dwarf1_find_nearest_line (bfd *abfd,
	       asection *section,
	       asymbol **symbols ATTRIBUTE_UNUSED__attribute__ ((__unused__)),
	       bfd_vma offset,
	       const char **filename_ptr,
	       const char **functionname_ptr,
	       unsigned int *linenumber_ptr)
449{
struct dwarf1_debug *stash = elf_tdata (abfd)((abfd) -> tdata.elf_obj_data)->dwarf1_find_line_info;

struct dwarf1_unit* eachUnit;

/* What address are we looking for? */
unsigned long addr = (unsigned long)(offset + section->vma);

*filename_ptr = NULL((void*)0);
*functionname_ptr = NULL((void*)0);
*linenumber_ptr = 0;

if (! stash)
1
Assuming 'stash' is non-null→
2
←
Taking false branch→
  {
    asection *msec;
    bfd_size_type size = sizeof (struct dwarf1_debug);

    stash = elf_tdata (abfd)((abfd) -> tdata.elf_obj_data)->dwarf1_find_line_info
= bfd_zalloc (abfd, size);

    if (! stash)
return FALSE0;

    msec = bfd_get_section_by_name (abfd, ".debug");
    if (! msec)
/* No dwarf1 info.  Note that at this point the stash
  has been allocated, but contains zeros, this lets
  future calls to this function fail quicker.  */
return FALSE0;

    size = msec->rawsize ? msec->rawsize : msec->size;
    stash->debug_section = bfd_alloc (abfd, size);

    if (! stash->debug_section)
return FALSE0;

    if (! bfd_get_section_contents (abfd, msec, stash->debug_section,
		      0, size))
{
 stash->debug_section = 0;
 return FALSE0;
}

    stash->debug_section_end = stash->debug_section + size;
    stash->currentDie = stash->debug_section;
    stash->abfd = abfd;
  }

/* A null debug_section indicates that there was no dwarf1 info
   or that an error occured while setting up the stash.  */

if (! stash->debug_section)
3
←
Assuming field 'debug_section' is non-null→
4
←
Taking false branch→
  return FALSE0;

/* Look at the previously parsed units to see if any contain
   the addr.  */
for (eachUnit = stash->lastUnit; eachUnit; eachUnit = eachUnit->prev)
5
←
Loop condition is true.  Entering loop body→
  if (eachUnit->low_pc <= addr && addr < eachUnit->high_pc)
6
←
Assuming 'addr' is >= field 'low_pc'→
7
←
Assuming 'addr' is < field 'high_pc'→
8
←
Taking true branch→
    return dwarf1_unit_find_nearest_line (stash, eachUnit, addr,
9
←
Calling 'dwarf1_unit_find_nearest_line'→
			    filename_ptr,
			    functionname_ptr,
			    linenumber_ptr);

while (stash->currentDie < stash->debug_section_end)
  {
    struct die_info aDieInfo;

    if (! parse_die (stash->abfd, &aDieInfo, stash->currentDie,
       stash->debug_section_end))
return FALSE0;

    if (aDieInfo.tag == TAG_compile_unit)
{
 struct dwarf1_unit* aUnit
   = alloc_dwarf1_unit (stash);

 aUnit->name = aDieInfo.name;
 aUnit->low_pc = aDieInfo.low_pc;
 aUnit->high_pc = aDieInfo.high_pc;
 aUnit->has_stmt_list = aDieInfo.has_stmt_list;
 aUnit->stmt_list_offset = aDieInfo.stmt_list_offset;

 /* A die has a child if it's followed by a die that is
    not it's sibling.  */
 if (aDieInfo.sibling
     && stash->currentDie + aDieInfo.length
                  < stash->debug_section_end
     && stash->currentDie + aDieInfo.length
           != stash->debug_section + aDieInfo.sibling)
   aUnit->first_child = stash->currentDie + aDieInfo.length;
 else
   aUnit->first_child = 0;

 if (aUnit->low_pc <= addr && addr < aUnit->high_pc)
   return dwarf1_unit_find_nearest_line (stash, aUnit, addr,
				  filename_ptr,
				  functionname_ptr,
				  linenumber_ptr);
}

    if (aDieInfo.sibling != 0)
stash->currentDie = stash->debug_section + aDieInfo.sibling;
    else
stash->currentDie += aDieInfo.length;
  }

return FALSE0;
556}