[llvm-bugs] [Bug 48119] New: A null pointer dereference error in FileAnalysis::parseSectionContents

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=48119

            Bug ID: 48119
           Summary: A null pointer dereference error in
                    FileAnalysis::parseSectionContents
           Product: tools
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: analyze
          Assignee: unassignedbugs at nondot.org
          Reporter: alansnape3058 at gmail.com
                CC: llvm-bugs at lists.llvm.org

According to the bug reports of my clang static analyzer fork, in function
`FileAnalysis::parseSectionContents`, a dereference on null smart pointer may
happen under some circumstances.

In file llvm/tools/llvm-cfi-verify/lib/FileAnalysis.cpp

1. call function `FileAnalysis::Create`
73 Expected<FileAnalysis> FileAnalysis::Create(StringRef Filename) {

2. call constructor of `FileAnalysis`, set `Analysis.Disassembler` to nullptr
82   FileAnalysis Analysis(std::move(Binary));

3. call function `FileAnalysis::initialiseDisassemblyMembers`
102   if (auto InitResponse = Analysis.initialiseDisassemblyMembers())

4. call function `Target::createMCRegInfo`
387   RegisterInfo.reset(ObjectTarget->createMCRegInfo(TripleName));

5. assume `MCRegInfoCtorFn` is nullptr, take the true branch
365     if (!MCRegInfoCtorFn)

6. return nullptr
366       return nullptr;

7. set `RegisterInfo` to nullptr, take the true branch, function returns an
error
387   RegisterInfo.reset(ObjectTarget->createMCRegInfo(TripleName));
388   if (!RegisterInfo)                                            
389     return make_error<UnsupportedDisassembly>(                  
390         "Failed to initialise RegisterInfo.");                  

  Note:
   1. the initialization for `Analysis.Disassembler` on line 410 is skipped
   2. Besides, if not skipped above, in function
`Target::createMCDisassembler`, if `MCDisassemblerCtorFn` is null,
`Analysis.Disassembler` will be set to nullptr as well and the function will
also return an error on line 414.

8. returned error ignored.
102   if (auto InitResponse = Analysis.initialiseDisassemblyMembers())
103     return std::move(InitResponse);
104

9. call function 'FileAnalysis::parseCodeSections'      
105   if (auto SectionParseResponse = Analysis.parseCodeSections())

10. call function `FileAnalysis::parseSectionContents`
466     parseSectionContents(SectionBytes,
467                          {Section.getAddress(), Section.getIndex()});

11. dereference on null smart pointer `Analysis.Disassembler`
480     bool ValidInstruction =                                             
481         Disassembler->getInstruction(Instruction, InstructionSize,
482                                      SectionBytes.drop_front(Byte), 0,  
483                                      outs()) == MCDisassembler::Success;

Although the problem will not be triggered by the path presented, the problem
still worth noting.

See the HTML report for more details: 
http://lcs.ios.ac.cn/~maxt/SPelton/reports/llvm/report-ccba4c.html#EndPath

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20201109/dc56678e/attachment.html>