/usr/src/gnu/usr.bin/binutils/bfd/dwarf1.c

Bug Summary

File:	src/gnu/usr.bin/binutils/bfd/dwarf1.c
Warning:	line 432, column 12 Dereference of null pointer

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name dwarf1.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/binutils/obj/bfd -resource-dir /usr/local/lib/clang/13.0.0 -D HAVE_CONFIG_H -I . -I /usr/src/gnu/usr.bin/binutils/bfd -I . -D _GNU_SOURCE -D NETBSD_CORE -I . -I /usr/src/gnu/usr.bin/binutils/bfd -I /usr/src/gnu/usr.bin/binutils/bfd/../include -I /usr/src/gnu/usr.bin/binutils/bfd/../intl -I ../intl -D PIE_DEFAULT=1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/gnu/usr.bin/binutils/obj/bfd -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/usr.bin/binutils/bfd/dwarf1.c

1/* DWARF 1 find nearest line (_bfd_dwarf1_find_nearest_line).
 Copyright 1998, 1999, 2000, 2001, 2002 Free Software Foundation, Inc.

4Written by Gavin Romig-Koch of Cygnus Solutions (gavin@cygnus.com).

6This file is part of BFD.

8This program is free software; you can redistribute it and/or modify
9it under the terms of the GNU General Public License as published by
10the Free Software Foundation; either version 2 of the License, or (at
11your option) any later version.

13This program is distributed in the hope that it will be useful, but
14WITHOUT ANY WARRANTY; without even the implied warranty of
15MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16General Public License for more details.

18You should have received a copy of the GNU General Public License
19along with this program; if not, write to the Free Software
20Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.  */

22#include "bfd.h"
23#include "sysdep.h"
24#include "libiberty.h"
25#include "libbfd.h"
26#include "elf-bfd.h"
27#include "elf/dwarf.h"

29/* dwarf1_debug is the starting point for all dwarf1 info.  */

31struct dwarf1_debug {

/* The bfd we are working with.  */
bfd* abfd;

/* List of already parsed compilation units.  */
struct dwarf1_unit* lastUnit;

/* The buffer for the .debug section.
   Zero indicates that the .debug section failed to load.  */
char* debug_section;

/* Pointer to the end of the .debug_info section memory buffer.  */
char* debug_section_end;

/* The buffer for the .line section.  */
char* line_section;

/* End of that buffer.  */
char* line_section_end;

/* The current or next unread die within the .debug section.  */
char* currentDie;
54};

56/* One dwarf1_unit for each parsed compilation unit die.  */

58struct dwarf1_unit {
/* Linked starting from stash->lastUnit.  */
struct dwarf1_unit* prev;

/* Name of the compilation unit.  */
char* name;

/* The highest and lowest address used in the compilation unit.  */
unsigned long low_pc;
unsigned long high_pc;

/* Does this unit have a statement list? */
int has_stmt_list;

/* If any, the offset of the line number table in the .line section.  */
unsigned long stmt_list_offset;

/* If non-zero, a pointer to the first child of this unit.  */
char* first_child;

/* How many line entries? */
unsigned long line_count;

/* The decoded line number table (line_count entries).  */
struct linenumber* linenumber_table;

/* The list of functions in this unit.  */
struct dwarf1_func* func_list;
86};

88/* One dwarf1_func for each parsed function die.  */

90struct dwarf1_func {
/* Linked starting from aUnit->func_list.  */
struct dwarf1_func* prev;

/* Name of function.  */
char* name;

/* The highest and lowest address used in the compilation unit.  */
unsigned long low_pc;
unsigned long high_pc;
100};

102/* Used to return info about a parsed die.  */
103struct die_info {
unsigned long length;
unsigned long sibling;
unsigned long low_pc;
unsigned long high_pc;
unsigned long stmt_list_offset;

char* name;

int has_stmt_list;

unsigned short tag;
115};

117/* Parsed line number information.  */
118struct linenumber {
/* First address in the line.  */
unsigned long addr;

/* The line number.  */
unsigned long linenumber;
124};

126/* Find the form of an attr, from the attr field.  */
127#define FORM_FROM_ATTR(attr)((attr) & 0xF)	((attr) & 0xF)	/* Implicitly specified */

129static struct dwarf1_unit *alloc_dwarf1_unit
PARAMS ((struct dwarf1_debug *))(struct dwarf1_debug *);
131static struct dwarf1_func *alloc_dwarf1_func
PARAMS ((struct dwarf1_debug *, struct dwarf1_unit *))(struct dwarf1_debug *, struct dwarf1_unit *);
133static bfd_boolean parse_die
PARAMS ((bfd *, struct die_info *, char *, char *))(bfd *, struct die_info *, char *, char *);
135static bfd_boolean parse_line_table
PARAMS ((struct dwarf1_debug *, struct dwarf1_unit *))(struct dwarf1_debug *, struct dwarf1_unit *);
137static bfd_boolean parse_functions_in_unit
PARAMS ((struct dwarf1_debug *, struct dwarf1_unit *))(struct dwarf1_debug *, struct dwarf1_unit *);
139static bfd_boolean dwarf1_unit_find_nearest_line
PARAMS ((struct dwarf1_debug *, struct dwarf1_unit *, unsigned long,(struct dwarf1_debug *, struct dwarf1_unit *, unsigned long, const
 char **, const char **, unsigned int *)
  const char **, const char **, unsigned int *))(struct dwarf1_debug *, struct dwarf1_unit *, unsigned long, const
 char **, const char **, unsigned int *);

143/* Return a newly allocated dwarf1_unit.  It should be cleared and
 then attached into the 'stash' at 'stash->lastUnit'.  */

146static struct dwarf1_unit*
147alloc_dwarf1_unit (stash)
struct dwarf1_debug* stash;
149{
bfd_size_type amt = sizeof (struct dwarf1_unit);

struct dwarf1_unit* x = (struct dwarf1_unit*) bfd_zalloc (stash->abfd, amt);
x->prev = stash->lastUnit;
stash->lastUnit = x;

return x;
157}

159/* Return a newly allocated dwarf1_func.  It must be cleared and
 attached into 'aUnit' at 'aUnit->func_list'.  */

162static struct dwarf1_func*
163alloc_dwarf1_func (stash, aUnit)
   struct dwarf1_debug* stash;
   struct dwarf1_unit* aUnit;
166{
bfd_size_type amt = sizeof (struct dwarf1_func);

struct dwarf1_func* x = (struct dwarf1_func*) bfd_zalloc (stash->abfd, amt);
x->prev = aUnit->func_list;
aUnit->func_list = x;

return x;
174}

176/* parse_die - parse a Dwarf1 die.
 Parse the die starting at 'aDiePtr' into 'aDieInfo'.
 'abfd' must be the bfd from which the section that 'aDiePtr'
 points to was pulled from.

 Return FALSE if the die is invalidly formatted; TRUE otherwise.  */

183static bfd_boolean
184parse_die (abfd, aDieInfo, aDiePtr, aDiePtrEnd)
   bfd* abfd;
   struct die_info* aDieInfo;
   char*            aDiePtr;
   char*            aDiePtrEnd;
189{
char* this_die = aDiePtr;
char* xptr = this_die;

memset (aDieInfo,0,sizeof (*aDieInfo));

/* First comes the length.  */
aDieInfo->length = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
xptr += 4;
if (aDieInfo->length == 0
    || (this_die + aDieInfo->length) >= aDiePtrEnd)
  return FALSE0;
if (aDieInfo->length < 6)
  {
    /* Just padding bytes.  */
    aDieInfo->tag = TAG_padding;
    return TRUE1;
  }

/* Then the tag.  */
aDieInfo->tag = bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
xptr += 2;

/* Then the attributes.  */
while (xptr < (this_die + aDieInfo->length))
  {
    unsigned short attr;

    /* Parse the attribute based on its form.  This section
       must handle all dwarf1 forms, but need only handle the
actual attributes that we care about.  */

    attr = bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
    xptr += 2;

    switch (FORM_FROM_ATTR (attr)((attr) & 0xF))
{
case FORM_DATA2:
 xptr += 2;
 break;
case FORM_DATA4:
case FORM_REF:
 if (attr == AT_sibling)
   aDieInfo->sibling = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 else if (attr == AT_stmt_list)
   {
     aDieInfo->stmt_list_offset = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
     aDieInfo->has_stmt_list = 1;
   }
 xptr += 4;
 break;
case FORM_DATA8:
 xptr += 8;
 break;
case FORM_ADDR:
 if (attr == AT_low_pc)
   aDieInfo->low_pc = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 else if (attr == AT_high_pc)
   aDieInfo->high_pc = bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 xptr += 4;
 break;
case FORM_BLOCK2:
 xptr += 2 + bfd_get_16 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx16)) ((bfd_byte *) xptr));
 break;
case FORM_BLOCK4:
 xptr += 4 + bfd_get_32 (abfd, (bfd_byte *) xptr)((*((abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr));
 break;
case FORM_STRING:
 if (attr == AT_name)
   aDieInfo->name = xptr;
 xptr += strlen (xptr) + 1;
 break;
}
  }

return TRUE1;
265}

267/* Parse a dwarf1 line number table for 'aUnit->stmt_list_offset'
 into 'aUnit->linenumber_table'.  Return FALSE if an error
 occurs; TRUE otherwise.  */

271static bfd_boolean
272parse_line_table (stash, aUnit)
struct dwarf1_debug* stash;
struct dwarf1_unit* aUnit;
275{
char* xptr;

/* Load the ".line" section from the bfd if we haven't already.  */
if (stash->line_section == 0)
16
←
Assuming field 'line_section' is not equal to null→
17
←
Taking false branch→
  {
    asection *msec;
    bfd_size_type size;

    msec = bfd_get_section_by_name (stash->abfd, ".line");
    if (! msec)
return FALSE0;

    size = bfd_get_section_size_before_reloc (msec)((msec)->_raw_size);
    stash->line_section = (char *) bfd_alloc (stash->abfd, size);

    if (! stash->line_section)
return FALSE0;

    if (! bfd_get_section_contents (stash->abfd, msec, stash->line_section,
		      (bfd_vma) 0, size))
{
 stash->line_section = 0;
 return FALSE0;
}

    stash->line_section_end = stash->line_section + size;
  }

xptr = stash->line_section + aUnit->stmt_list_offset;
if (xptr < stash->line_section_end)
18
←
Assuming 'xptr' is >= field 'line_section_end'→
19
←
Taking false branch→
  {
    unsigned long eachLine;
    char *tblend;
    unsigned long base;
    bfd_size_type amt;

    /* First comes the length.  */
    tblend = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
)) + xptr;
    xptr += 4;

    /* Then the base address for each address in the table.  */
    base = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
    xptr += 4;

    /* How many line entrys?
10 = 4 (line number) + 2 (pos in line) + 4 (address in line) */
    aUnit->line_count = (tblend - xptr) / 10;

    /* Allocate an array for the entries.  */
    amt = sizeof (struct linenumber) * aUnit->line_count;
    aUnit->linenumber_table = ((struct linenumber *)
		 bfd_alloc (stash->abfd, amt));

    for (eachLine = 0; eachLine < aUnit->line_count; eachLine++)
{
 /* A line number.  */
 aUnit->linenumber_table[eachLine].linenumber
   = bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
 xptr += 4;

 /* Skip the position within the line.  */
 xptr += 2;

 /* And finally the address.  */
 aUnit->linenumber_table[eachLine].addr
   = base + bfd_get_32 (stash->abfd, (bfd_byte *) xptr)((*((stash->abfd)->xvec->bfd_getx32)) ((bfd_byte *) xptr
));
 xptr += 4;
}
  }

return TRUE1;
20
←
Returning without writing to 'aUnit->func_list', which participates in a condition later→
21
←
Returning without writing to 'aUnit->linenumber_table'→
22
←
Returning the value 1, which participates in a condition later→
347}

349/* Parse each function die in a compilation unit 'aUnit'.
 The first child die of 'aUnit' should be in 'aUnit->first_child',
 the result is placed in 'aUnit->func_list'.
 Return FALSE if error; TRUE otherwise.  */

354static bfd_boolean
355parse_functions_in_unit (stash, aUnit)
   struct dwarf1_debug* stash;
   struct dwarf1_unit* aUnit;
358{
char* eachDie;

if (aUnit->first_child)
  for (eachDie = aUnit->first_child;
eachDie < stash->debug_section_end;
)
    {
struct die_info eachDieInfo;

if (! parse_die (stash->abfd, &eachDieInfo, eachDie,
	 stash->debug_section_end))
 return FALSE0;

if (eachDieInfo.tag == TAG_global_subroutine
   || eachDieInfo.tag == TAG_subroutine
   || eachDieInfo.tag == TAG_inlined_subroutine
   || eachDieInfo.tag == TAG_entry_point)
 {
   struct dwarf1_func* aFunc = alloc_dwarf1_func (stash,aUnit);

   aFunc->name = eachDieInfo.name;
   aFunc->low_pc = eachDieInfo.low_pc;
   aFunc->high_pc = eachDieInfo.high_pc;
 }

/* Move to next sibling, if none, end loop */
if (eachDieInfo.sibling)
 eachDie = stash->debug_section + eachDieInfo.sibling;
else
 break;
    }

return TRUE1;
392}

394/* Find the nearest line to 'addr' in 'aUnit'.
 Return whether we found the line (or a function) without error.  */

397static bfd_boolean
398dwarf1_unit_find_nearest_line (stash, aUnit, addr,
       filename_ptr, functionname_ptr,
       linenumber_ptr)
struct dwarf1_debug* stash;
struct dwarf1_unit* aUnit;
unsigned long addr;
const char **filename_ptr;
const char **functionname_ptr;
unsigned int *linenumber_ptr;
407{
int line_p = FALSE0;
int func_p = FALSE0;

if (aUnit->low_pc <= addr9.1
'addr' is >= field 'low_pc'
 && addr9.2
'addr' is < field 'high_pc'
 < aUnit->high_pc)
10
←
Taking true branch→
  {
    if (aUnit->has_stmt_list)
11
←
Assuming field 'has_stmt_list' is not equal to 0→
12
←
Taking true branch→
{
 unsigned long i;
 struct dwarf1_func* eachFunc;

 if (! aUnit->linenumber_table)
13
←
Assuming field 'linenumber_table' is null→
14
←
Taking true branch→
   {
     if (! parse_line_table (stash, aUnit))
15
←
Calling 'parse_line_table'→
23
←
Returning from 'parse_line_table'→
24
←
Taking false branch→
return FALSE0;
   }

 if (! aUnit->func_list)
25
←
Assuming field 'func_list' is non-null→
26
←
Taking false branch→
   {
     if (! parse_functions_in_unit (stash, aUnit))
return FALSE0;
   }

 for (i = 0; i < aUnit->line_count; i++)
27
←
Assuming 'i' is < field 'line_count'→
28
←
Loop condition is true.  Entering loop body→
   {
     if (aUnit->linenumber_table[i].addr <= addr
29
←
Dereference of null pointer
  && addr < aUnit->linenumber_table[i+1].addr)
{
  *filename_ptr = aUnit->name;
  *linenumber_ptr = aUnit->linenumber_table[i].linenumber;
  line_p = TRUE1;
  break;
}
   }

 for (eachFunc = aUnit->func_list;
      eachFunc;
      eachFunc = eachFunc->prev)
   {
     if (eachFunc->low_pc <= addr
  && addr < eachFunc->high_pc)
{
  *functionname_ptr = eachFunc->name;
  func_p = TRUE1;
  break;
}
   }
}
  }

return line_p || func_p;
458}

460/* The DWARF 1 version of find_nearest line.
 Return TRUE if the line is found without error.  */

463bfd_boolean
464_bfd_dwarf1_find_nearest_line (abfd, section, symbols, offset,
                            filename_ptr, functionname_ptr, linenumber_ptr)
   bfd *abfd;
   asection *section;
   asymbol **symbols ATTRIBUTE_UNUSED__attribute__ ((__unused__));
   bfd_vma offset;
   const char **filename_ptr;
   const char **functionname_ptr;
   unsigned int *linenumber_ptr;
473{
struct dwarf1_debug *stash = elf_tdata (abfd)((abfd) -> tdata.elf_obj_data)->dwarf1_find_line_info;

struct dwarf1_unit* eachUnit;

/* What address are we looking for? */
unsigned long addr = (unsigned long)(offset + section->vma);

*filename_ptr = NULL((void*)0);
*functionname_ptr = NULL((void*)0);
*linenumber_ptr = 0;

if (! stash)
1
Assuming 'stash' is non-null→
2
←
Taking false branch→
  {
    asection *msec;
    bfd_size_type size = sizeof (struct dwarf1_debug);

    stash = elf_tdata (abfd)((abfd) -> tdata.elf_obj_data)->dwarf1_find_line_info
= (struct dwarf1_debug *) bfd_zalloc (abfd, size);

    if (! stash)
return FALSE0;

    msec = bfd_get_section_by_name (abfd, ".debug");
    if (! msec)
{
 /* No dwarf1 info.  Note that at this point the stash
    has been allocated, but contains zeros, this lets
    future calls to this function fail quicker.  */
 return FALSE0;
}

    size = bfd_get_section_size_before_reloc (msec)((msec)->_raw_size);
    stash->debug_section = (char *) bfd_alloc (abfd, size);

    if (! stash->debug_section)
return FALSE0;

    if (! bfd_get_section_contents (abfd, msec, stash->debug_section,
		      (bfd_vma) 0, size))
{
 stash->debug_section = 0;
 return FALSE0;
}

    stash->debug_section_end = stash->debug_section + size;
    stash->currentDie = stash->debug_section;
    stash->abfd = abfd;
  }

/* A null debug_section indicates that there was no dwarf1 info
   or that an error occured while setting up the stash.  */

if (! stash->debug_section)
3
←
Assuming field 'debug_section' is non-null→
4
←
Taking false branch→
  return FALSE0;

/* Look at the previously parsed units to see if any contain
   the addr.  */
for (eachUnit = stash->lastUnit; eachUnit; eachUnit = eachUnit->prev)
5
←
Loop condition is true.  Entering loop body→
  {
    if (eachUnit->low_pc <= addr && addr < eachUnit->high_pc)
6
←
Assuming 'addr' is >= field 'low_pc'→
7
←
Assuming 'addr' is < field 'high_pc'→
8
←
Taking true branch→
return dwarf1_unit_find_nearest_line (stash, eachUnit, addr,
9
←
Calling 'dwarf1_unit_find_nearest_line'→
			      filename_ptr,
			      functionname_ptr,
			      linenumber_ptr);
  }

while (stash->currentDie < stash->debug_section_end)
  {
    struct die_info aDieInfo;

    if (! parse_die (stash->abfd, &aDieInfo, stash->currentDie,
       stash->debug_section_end))
return FALSE0;

    if (aDieInfo.tag == TAG_compile_unit)
{
 struct dwarf1_unit* aUnit
   = alloc_dwarf1_unit (stash);

 aUnit->name = aDieInfo.name;
 aUnit->low_pc = aDieInfo.low_pc;
 aUnit->high_pc = aDieInfo.high_pc;
 aUnit->has_stmt_list = aDieInfo.has_stmt_list;
 aUnit->stmt_list_offset = aDieInfo.stmt_list_offset;

 /* A die has a child if it's followed by a die that is
    not it's sibling.  */
 if (aDieInfo.sibling
     && stash->currentDie + aDieInfo.length
                  < stash->debug_section_end
     && stash->currentDie + aDieInfo.length
           != stash->debug_section + aDieInfo.sibling)
   aUnit->first_child = stash->currentDie + aDieInfo.length;
 else
   aUnit->first_child = 0;

 if (aUnit->low_pc <= addr && addr < aUnit->high_pc)
   return dwarf1_unit_find_nearest_line (stash, aUnit, addr,
				  filename_ptr,
				  functionname_ptr,
				  linenumber_ptr);
}

    if (aDieInfo.sibling != 0)
stash->currentDie = stash->debug_section + aDieInfo.sibling;
    else
stash->currentDie += aDieInfo.length;
  }

return FALSE0;
584}

586/* EOF */