Bug Summary

File:src/usr.bin/rev/rev.c
Warning:line 95, column 7
Access to field '_flags' results in a dereference of a null pointer (loaded from variable 'fp')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name rev.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/rev/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/rev/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/rev/rev.c
1/* $OpenBSD: rev.c,v 1.13 2016/04/10 17:06:52 martijn Exp $ */
2/* $NetBSD: rev.c,v 1.5 1995/09/28 08:49:40 tls Exp $ */
3
4/*-
5 * Copyright (c) 1987, 1992, 1993
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#include <sys/types.h>
34
35#include <err.h>
36#include <errno(*__errno()).h>
37#include <locale.h>
38#include <stdio.h>
39#include <stdlib.h>
40#include <string.h>
41#include <unistd.h>
42
43int isu8cont(unsigned char);
44void usage(void);
45
46int
47main(int argc, char *argv[])
48{
49 char *filename, *p = NULL((void *)0), *t, *u;
50 FILE *fp;
51 ssize_t len;
52 size_t ps = 0;
53 int ch, rval;
54
55 setlocale(LC_CTYPE2, "");
56
57 if (pledge("stdio rpath", NULL((void *)0)) == -1)
1
Assuming the condition is false
→
2
←
Taking false branch
→
58 err(1, "pledge");
59
60 while ((ch = getopt(argc, argv, "")) != -1)
3
←
Assuming the condition is false
→
4
←
Loop condition is false. Execution continues on line 66
→
61 switch(ch) {
62 default:
63 usage();
64 }
65
66 argc -= optind;
67 argv += optind;
68
69 fp = stdin(&__sF[0]);
70 filename = "stdin";
71 rval = 0;
72 do {
11
←
Loop condition is true. Execution continues on line 73
→
73 if (*argv) {
5
←
Assuming the condition is true
→
6
←
Taking true branch
→
12
←
Assuming the condition is false
→
13
←
Taking false branch
→
74 if ((fp = fopen(*argv, "r")) == NULL((void *)0)) {
7
←
Value assigned to 'fp'
→
8
←
Assuming pointer value is null
→
9
←
Taking true branch
→
75 warn("%s", *argv);
76 rval = 1;
77 ++argv;
78 continue;
10
←
 Execution continues on line 100
→
79 }
80 filename = *argv++;
81 }
82 while ((len = getline(&p, &ps, fp)) != -1) {
14
←
Assuming the condition is false
→
15
←
Loop condition is false. Execution continues on line 95
→
83 if (p[len - 1] == '\n')
84 --len;
85 for (t = p + len - 1; t >= p; --t) {
86 if (isu8cont(*t))
87 continue;
88 u = t;
89 do {
90 putchar(*u)(!__isthreaded ? __sputc(*u, (&__sF[1])) : (putc)(*u, (&
__sF[1])));
91 } while (isu8cont(*(++u)));
92 }
93 putchar('\n')(!__isthreaded ? __sputc('\n', (&__sF[1])) : (putc)('\n',
(&__sF[1])));
94 }
95 if (ferror(fp)(!__isthreaded ? (((fp)->_flags & 0x0040) != 0) : (ferror
)(fp))) {
16
←
Assuming '__isthreaded' is 0
→
17
←
'?' condition is true
→
18
←
Access to field '_flags' results in a dereference of a null pointer (loaded from variable 'fp')
96 warn("%s", filename);
97 rval = 1;
98 }
99 (void)fclose(fp);
100 } while(*argv);
101 return rval;
102}
103
104int
105isu8cont(unsigned char c)
106{
107 return MB_CUR_MAX__mb_cur_max() > 1 && (c & (0x80 | 0x40)) == 0x80;
108}
109
110void
111usage(void)
112{
113 extern char *__progname;
114
115 (void)fprintf(stderr(&__sF[2]), "usage: %s [file ...]\n", __progname);
116 exit(1);
117}