Bug Summary

File:src/games/monop/prop.c
Warning:line 108, column 11
Access to field 'next' results in a dereference of a null pointer (loaded from variable 'op')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name prop.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/games/monop/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/games/monop/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/games/monop/prop.c
1/* $OpenBSD: prop.c,v 1.11 2016/01/08 18:20:33 mestre Exp $ */
2/* $NetBSD: prop.c,v 1.3 1995/03/23 08:35:06 cgd Exp $ */
3
4/*
5 * Copyright (c) 1980, 1993
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33#include <err.h>
34#include <stdio.h>
35#include <stdlib.h>
36
37#include "monop.ext"
38
39static int value(SQUARE *);
40
41/*
42 * This routine deals with buying property, setting all the
43 * appropriate flags.
44 */
45void
46buy(int plr, SQUARE *sqrp)
47{
48 trading = FALSE(0);
49 sqrp->owner = plr;
50 add_list(plr, &(play[plr].own_list), cur_p->loc);
51}
52/*
53 * This routine adds an item to the list.
54 */
55void
56add_list(int plr, OWN **head, int op_sqr)
57{
58 int val;
59 OWN *tp, *last_tp;
60 OWN *op;
61
62 if ((op = calloc(1, sizeof (OWN))) == NULL((void *)0))
63 err(1, NULL((void *)0));
64 op->sqr = &board[op_sqr];
65 val = value(op->sqr);
66 last_tp = NULL((void *)0);
67 for (tp = *head; tp && value(tp->sqr) < val; tp = tp->next)
68 if (val == value(tp->sqr)) {
69 free(op);
70 return;
71 }
72 else
73 last_tp = tp;
74 op->next = tp;
75 if (last_tp != NULL((void *)0))
76 last_tp->next = op;
77 else
78 *head = op;
79 if (!trading)
80 set_ownlist(plr);
81}
82/*
83 * This routine deletes property from the list.
84 */
85void
86del_list(int plr, OWN **head, shrtchar op_sqr)
87{
88 OWN *op, *last_op;
89
90 switch (board[(int)op_sqr].type) {
1
'Default' branch taken. Execution continues on line 101
→
91 case PRPTY0:
92 board[(int)op_sqr].desc->mon_desc->num_own--;
93 break;
94 case RR1:
95 play[plr].num_rr--;
96 break;
97 case UTIL2:
98 play[plr].num_util--;
99 break;
100 }
101 last_op = NULL((void *)0);
102 for (op = *head; op; op = op->next)
2
←
Value assigned to 'op'
→
3
←
Assuming pointer value is null
→
4
←
Loop condition is false. Execution continues on line 107
→
103 if (op->sqr == &board[(int)op_sqr])
104 break;
105 else
106 last_op = op;
107 if (last_op
4.1
'last_op' is equal to NULL
 == NULL((void *)0))
5
←
Taking true branch
→
108 *head = op->next;
6
←
Access to field 'next' results in a dereference of a null pointer (loaded from variable 'op')
109 else {
110 last_op->next = op->next;
111 free(op);
112 }
113}
114/*
115 * This routine calculates the value for sorting of the
116 * given square.
117 */
118static int
119value(SQUARE *sqp)
120{
121 int sqr;
122
123 sqr = sqnum(sqp)(sqp - board);
124 switch (sqp->type) {
125 case SAFE3:
126 return 0;
127 default: /* Specials, etc */
128 return 1;
129 case UTIL2:
130 if (sqr == 12)
131 return 2;
132 else
133 return 3;
134 case RR1:
135 return 4 + sqr/10;
136 case PRPTY0:
137 return 8 + (sqp->desc) - prop;
138 }
139}
140/*
141 * This routine accepts bids for the current piece of property.
142 */
143void
144bid(void)
145{
146 static boolint8_t in[MAX_PL9];
147 int i, num_in, cur_max;
148 char buf[257];
149 int cur_bid;
150
151 printf("\nSo it goes up for auction. Type your bid after your name\n");
152 for (i = 0; i < num_play; i++)
153 in[i] = TRUE(1);
154 i = -1;
155 cur_max = 0;
156 num_in = num_play;
157 while (num_in > 1 || (cur_max == 0 && num_in > 0)) {
158 i = (i + 1) % num_play;
159 if (in[i]) {
160 do {
161 (void)snprintf(buf, sizeof(buf), "%s: ", name_list[i]);
162 cur_bid = get_int(buf);
163 if (cur_bid == 0) {
164 in[i] = FALSE(0);
165 if (--num_in == 0)
166 break;
167 } else if (cur_bid <= cur_max) {
168 printf("You must bid higher than %d to stay in\n", cur_max);
169 printf("(bid of 0 drops you out)\n");
170 } else if (cur_bid > play[i].money) {
171 printf("You can't bid more than your cash ($%d)\n",
172 play[i].money);
173 cur_bid = -1;
174 }
175 } while (cur_bid != 0 && cur_bid <= cur_max);
176 cur_max = (cur_bid ? cur_bid : cur_max);
177 }
178 }
179 if (cur_max != 0) {
180 while (!in[i])
181 i = (i + 1) % num_play;
182 printf("It goes to %s (%d) for $%d\n",play[i].name,i+1,cur_max);
183 buy(i, &board[(int)cur_p->loc]);
184 play[i].money -= cur_max;
185 }
186 else
187 printf("Nobody seems to want it, so we'll leave it for later\n");
188}
189/*
190 * This routine calculates the value of the property
191 * of given player.
192 */
193int
194prop_worth(PLAY *plp)
195{
196 OWN *op;
197 int worth;
198
199 worth = 0;
200 for (op = plp->own_list; op; op = op->next) {
201 if (op->sqr->type == PRPTY0 && op->sqr->desc->monop)
202 worth += op->sqr->desc->mon_desc->h_cost * 50 *
203 op->sqr->desc->houses;
204 worth += op->sqr->cost;
205 }
206 return worth;
207}