<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - A null pointer dereference error in FileAnalysis::parseSectionContents"
href="https://bugs.llvm.org/show_bug.cgi?id=48119">48119</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>A null pointer dereference error in FileAnalysis::parseSectionContents
</td>
</tr>
<tr>
<th>Product</th>
<td>tools
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>analyze
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>alansnape3058@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>According to the bug reports of my clang static analyzer fork, in function
`FileAnalysis::parseSectionContents`, a dereference on null smart pointer may
happen under some circumstances.
In file llvm/tools/llvm-cfi-verify/lib/FileAnalysis.cpp
1. call function `FileAnalysis::Create`
73 Expected<FileAnalysis> FileAnalysis::Create(StringRef Filename) {
2. call constructor of `FileAnalysis`, set `Analysis.Disassembler` to nullptr
82 FileAnalysis Analysis(std::move(Binary));
3. call function `FileAnalysis::initialiseDisassemblyMembers`
102 if (auto InitResponse = Analysis.initialiseDisassemblyMembers())
4. call function `Target::createMCRegInfo`
387 RegisterInfo.reset(ObjectTarget->createMCRegInfo(TripleName));
5. assume `MCRegInfoCtorFn` is nullptr, take the true branch
365 if (!MCRegInfoCtorFn)
6. return nullptr
366 return nullptr;
7. set `RegisterInfo` to nullptr, take the true branch, function returns an
error
387 RegisterInfo.reset(ObjectTarget->createMCRegInfo(TripleName));
388 if (!RegisterInfo)
389 return make_error<UnsupportedDisassembly>(
390 "Failed to initialise RegisterInfo.");
Note:
1. the initialization for `Analysis.Disassembler` on line 410 is skipped
2. Besides, if not skipped above, in function
`Target::createMCDisassembler`, if `MCDisassemblerCtorFn` is null,
`Analysis.Disassembler` will be set to nullptr as well and the function will
also return an error on line 414.
8. returned error ignored.
102 if (auto InitResponse = Analysis.initialiseDisassemblyMembers())
103 return std::move(InitResponse);
104
9. call function 'FileAnalysis::parseCodeSections'
105 if (auto SectionParseResponse = Analysis.parseCodeSections())
10. call function `FileAnalysis::parseSectionContents`
466 parseSectionContents(SectionBytes,
467 {Section.getAddress(), Section.getIndex()});
11. dereference on null smart pointer `Analysis.Disassembler`
480 bool ValidInstruction =
481 Disassembler->getInstruction(Instruction, InstructionSize,
482 SectionBytes.drop_front(Byte), 0,
483 outs()) == MCDisassembler::Success;
Although the problem will not be triggered by the path presented, the problem
still worth noting.
See the HTML report for more details:
<a href="http://lcs.ios.ac.cn/~maxt/SPelton/reports/llvm/report-ccba4c.html#EndPath">http://lcs.ios.ac.cn/~maxt/SPelton/reports/llvm/report-ccba4c.html#EndPath</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>