Bug Summary

File:_build/../src/reflect.c
Warning:line 97, column 18
Access to field 'len' results in a dereference of a null pointer (loaded from variable 'contents')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name reflect.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/rootdir/_build -fcoverage-compilation-dir=/rootdir/_build -resource-dir /usr/lib/llvm-19/lib/clang/19 -I src/reflect-textview.p -I src -I ../src -I . -I .. -I /usr/include/ctk-3.0 -I /usr/include/pango-1.0 -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -I /usr/include/harfbuzz -I /usr/include/freetype2 -I /usr/include/libpng16 -I /usr/include/libmount -I /usr/include/blkid -I /usr/include/fribidi -I /usr/include/cairo -I /usr/include/pixman-1 -I /usr/include/gdk-pixbuf-2.0 -I /usr/include/x86_64-linux-gnu -I /usr/include/webp -I /usr/include/gio-unix-2.0 -I /usr/include/atk-1.0 -I /usr/include/at-spi2-atk/2.0 -I /usr/include/at-spi-2.0 -I /usr/include/dbus-1.0 -I /usr/lib/x86_64-linux-gnu/dbus-1.0/include -D _FILE_OFFSET_BITS=64 -D USE_TEXT_VIEW -internal-isystem /usr/lib/llvm-19/lib/clang/19/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-address-of-packed-member -Wno-missing-field-initializers -Wno-packed -Wno-switch-enum -Wno-unused-parameter -Wwrite-strings -std=gnu11 -fconst-strings -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-checker deadcode.DeadStores -analyzer-checker alpha.deadcode.UnreachableCode -analyzer-checker alpha.core.CastSize -analyzer-checker alpha.core.CastToStruct -analyzer-checker alpha.core.IdenticalExpr -analyzer-checker alpha.security.ArrayBoundV2 -analyzer-checker alpha.security.MallocOverflow -analyzer-checker alpha.security.ReturnPtrRange -analyzer-checker alpha.unix.SimpleStream -analyzer-checker alpha.unix.cstring.BufferOverlap -analyzer-checker alpha.unix.cstring.NotNullTerminated -analyzer-checker alpha.unix.cstring.OutOfBounds -analyzer-checker alpha.core.FixedAddr -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /rootdir/html-report/2025-10-10-084040-10834-1 -x c ../src/reflect.c
1/*
2 * Copyright (C) 2003 Red Hat, Inc.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17 */
18
19#include <config.h>
20#include <sys/types.h>
21#include <stdio.h>
22#include <stdlib.h>
23#include <string.h>
24#include <unistd.h>
25#include <ctk/ctk.h>
26#include <atk/atk.h>
27#ifdef USE_BTE
28#include <bte/bte.h>
29#endif
30
31static GArray *contents = NULL((void*)0);
32
33#ifdef USE_TEXT_VIEW1
34/*
35 * Implementation for a TextView widget.
36 */
37static void
38terminal_init_text_view(CtkWidget **widget)
39{
40 *widget = ctk_text_view_new();
3
←
Null pointer value stored to 'contents'
→
41 ctk_text_view_set_editable(CTK_TEXT_VIEW(*widget)((((CtkTextView*) (void *) ((*widget))))), TRUE(!(0)));
42}
43static void
44terminal_shell_text_view(CtkWidget *widget)
45{
46 /* no-op */
47}
48static CtkAdjustment *
49terminal_adjustment_text_view(CtkWidget *terminal)
50{
51 return ctk_scrollable_get_vadjustment(CTK_SCROLLABLE(terminal)((((CtkScrollable*) (void *) ((terminal))))));
52}
53#endif
54#ifdef USE_BTE
55/*
56 * Implementation for a BteTerminal widget.
57 */
58static void
59terminal_init_bte(CtkWidget **terminal)
60{
61 *terminal = bte_terminal_new();
62 g_signal_connect(G_OBJECT(*terminal), "eof",g_signal_connect_data ((((((GObject*) (void *) ((*terminal)))
))), ("eof"), (((GCallback) (ctk_main_quit))), (((void*)0)), (
(void*)0), (GConnectFlags) 0)
63 G_CALLBACK(ctk_main_quit), NULL)g_signal_connect_data ((((((GObject*) (void *) ((*terminal)))
))), ("eof"), (((GCallback) (ctk_main_quit))), (((void*)0)), (
(void*)0), (GConnectFlags) 0);
64 g_signal_connect(G_OBJECT(*terminal), "child-exited",g_signal_connect_data ((((((GObject*) (void *) ((*terminal)))
))), ("child-exited"), (((GCallback) (ctk_main_quit))), (((void
*)0)), ((void*)0), (GConnectFlags) 0)
65 G_CALLBACK(ctk_main_quit), NULL)g_signal_connect_data ((((((GObject*) (void *) ((*terminal)))
))), ("child-exited"), (((GCallback) (ctk_main_quit))), (((void
*)0)), ((void*)0), (GConnectFlags) 0);
66}
67static void
68terminal_shell_bte(CtkWidget *terminal)
69{
70 char *argv[2];
71
72 argv[0] = bte_get_user_shell ();
73 argv[1] = NULL((void*)0);
74 bte_terminal_spawn_sync(BTE_TERMINAL(terminal),
75 BTE_PTY_DEFAULT,
76 g_get_home_dir() ? g_get_home_dir() : NULL((void*)0),
77 argv,
78 NULL((void*)0),
79 0, NULL((void*)0), NULL((void*)0),
80 NULL((void*)0),
81 NULL((void*)0),
82 NULL((void*)0));
83}
84#endif
85
86/*
87 * Update the contents of the widget with the data from our contents array.
88 */
89static void
90update_contents(AtkObject *obj, CtkWidget *widget)
91{
92 guint caret, i;
93 GString *s;
94
95 caret = (guint)atk_text_get_caret_offset(ATK_TEXT(obj)(((AtkText*) (void *) ((obj)))));
96 s = g_string_new(NULL((void*)0));
97 for (i = 0; i < contents->len; i++) {
13
←
Access to field 'len' results in a dereference of a null pointer (loaded from variable 'contents')
98 if (i == caret) {
99 s = g_string_append(s, "[CARET]")(__builtin_constant_p ("[CARET]") ? __extension__ ({ const char
* const __val = ("[CARET]"); g_string_append_len_inline (s, __val
, (__builtin_expect (__extension__ ({ int _g_boolean_var_13 =
0; if (__val != ((void*)0)) _g_boolean_var_13 = 1; _g_boolean_var_13
; }), 1)) ? (gssize) strlen (((__val) + !(__val))) : (gssize)
-1); }) : g_string_append_len_inline (s, "[CARET]", (gssize)
-1));
100 }
101 s = g_string_append_unichar(s,
102 g_array_index(contents,(((gunichar*) (void *) (contents)->data) [(i)])
103 gunichar,(((gunichar*) (void *) (contents)->data) [(i)])
104 i)(((gunichar*) (void *) (contents)->data) [(i)]));
105 }
106 if (i == caret) {
107 s = g_string_append(s, "[CARET]")(__builtin_constant_p ("[CARET]") ? __extension__ ({ const char
* const __val = ("[CARET]"); g_string_append_len_inline (s, __val
, (__builtin_expect (__extension__ ({ int _g_boolean_var_14 =
0; if (__val != ((void*)0)) _g_boolean_var_14 = 1; _g_boolean_var_14
; }), 1)) ? (gssize) strlen (((__val) + !(__val))) : (gssize)
-1); }) : g_string_append_len_inline (s, "[CARET]", (gssize)
-1));
108 }
109 if (CTK_IS_LABEL(widget)(((__extension__ ({ GTypeInstance *__inst = (GTypeInstance*) (
(widget)); GType __t = ((ctk_label_get_type ())); gboolean __r
; if (!__inst) __r = (0); else if (__inst->g_class &&
__inst->g_class->g_type == __t) __r = (!(0)); else __r
= g_type_check_instance_is_a (__inst, __t); __r; }))))) {
110 ctk_label_set_text(CTK_LABEL(widget)((((CtkLabel*) (void *) ((widget))))), s->str);
111 ctk_label_set_selectable(CTK_LABEL(widget)((((CtkLabel*) (void *) ((widget))))),
112 atk_text_get_n_selections(ATK_TEXT(obj)(((AtkText*) (void *) ((obj))))) > 0);
113 if (ctk_label_get_selectable(CTK_LABEL(widget)((((CtkLabel*) (void *) ((widget))))))) {
114 int selection_start, selection_end;
115 atk_text_get_selection(ATK_TEXT(obj)(((AtkText*) (void *) ((obj)))), 0,
116 &selection_start,
117 &selection_end);
118 ctk_label_select_region(CTK_LABEL(widget)((((CtkLabel*) (void *) ((widget))))),
119 selection_start, selection_end);
120 }
121 }
122 g_string_free(s, TRUE)(__builtin_constant_p ((!(0))) ? (((!(0))) ? (g_string_free) (
(s), ((!(0)))) : g_string_free_and_steal (s)) : (g_string_free
) ((s), ((!(0)))));
123}
124
125/* Handle inserted text by inserting the text into our gunichar array. */
126static void
127text_changed_insert(AtkObject *obj, gint offset, gint length, gpointer data)
128{
129 char *inserted, *p;
130 gunichar c;
131 int i;
132
133 inserted = atk_text_get_text(ATK_TEXT(obj)(((AtkText*) (void *) ((obj)))), offset, offset + length);
134
135 if (!g_utf8_validate(inserted, -1, NULL((void*)0))) {
136 g_free(inserted);
137 g_error("UTF-8 validation error");
138 return;
139 }
140
141 p = inserted;
142 i = 0;
143 while (i < length) {
144 c = g_utf8_get_char(p);
145 if ((guint)(offset + i) >= contents->len) {
146 g_array_append_val(contents, c)g_array_append_vals (contents, &(c), 1);
147 } else {
148 g_array_insert_val(contents, offset + i, c)g_array_insert_vals (contents, offset + i, &(c), 1);
149 }
150 i++;
151 p = g_utf8_next_char(p)((p) + g_utf8_skip[*(const guchar *)(p)]);
152 }
153
154#ifdef BTE_DEBUG
155 if ((getenv("REFLECT_VERBOSE") != NULL((void*)0)) &&
156 (atol(getenv("REFLECT_VERBOSE")) != 0)) {
157 g_printerr("Inserted %d chars ('%.*s') at %d,",
158 length, (int)(p - inserted), inserted, offset);
159 g_printerr(" buffer contains %d characters.\n",
160 contents->len);
161 }
162#endif
163
164 g_free(inserted);
165
166 update_contents(obj, CTK_WIDGET(data)((((CtkWidget*) (void *) ((data))))));
167}
168
169/* Handle deleted text by removing the text from our gunichar array. */
170static void
171text_changed_delete(AtkObject *obj, gint offset, gint length, gpointer data)
172{
173 int i;
174 for (i = offset + length - 1; i >= offset; i--) {
175 if ((guint)i > contents->len - 1) {
176 g_warning("Invalid character %d was deleted.\n", i);
177 }
178 g_array_remove_index(contents, i);
179 }
180#ifdef BTE_DEBUG
181 if ((getenv("REFLECT_VERBOSE") != NULL((void*)0)) &&
182 (atol(getenv("REFLECT_VERBOSE")) != 0)) {
183 g_printerr("Deleted %d chars at %d.\n", length, offset);
184 }
185#endif
186 update_contents(obj, CTK_WIDGET(data)((((CtkWidget*) (void *) ((data))))));
187}
188
189static void
190text_caret_moved(AtkObject *obj, gint offset, gpointer data)
191{
192 update_contents(obj, CTK_WIDGET(data)((((CtkWidget*) (void *) ((data))))));
193}
194
195static void
196text_selection_changed(AtkObject *obj, gpointer data)
197{
198 update_contents(obj, CTK_WIDGET(data)((((CtkWidget*) (void *) ((data))))));
199}
200
201/* Wrapper versions. */
202static void
203terminal_init(CtkWidget **terminal)
204{
205 *terminal = NULL((void*)0);
206#ifdef USE_TEXT_VIEW1
207 terminal_init_text_view(terminal);
2
←
Calling 'terminal_init_text_view'
→
4
←
Returning from 'terminal_init_text_view'
→
208 return;
209#endif
210#ifdef USE_BTE
211 terminal_init_bte(terminal);
212 return;
213#endif
214 g_assert_not_reached()do { g_assertion_message_expr (((gchar*) 0), "../src/reflect.c"
, 214, ((const char*) (__func__)), ((void*)0)); } while (0);
215}
216static void
217terminal_shell(CtkWidget *terminal)
218{
219#ifdef USE_TEXT_VIEW1
220 terminal_shell_text_view(terminal);
221 return;
222#endif
223#ifdef USE_BTE
224 terminal_shell_bte(terminal);
225 return;
226#endif
227 g_assert_not_reached()do { g_assertion_message_expr (((gchar*) 0), "../src/reflect.c"
, 227, ((const char*) (__func__)), ((void*)0)); } while (0);
228}
229static CtkAdjustment *
230terminal_adjustment(CtkWidget *terminal)
231{
232#ifdef USE_TEXT_VIEW1
233 return terminal_adjustment_text_view(terminal);
234#endif
235#ifdef USE_BTE
236 return ctk_scrollable_get_vadjustment(CTK_SCROLLABLE(terminal)((((CtkScrollable*) (void *) ((terminal))))));
237#endif
238 g_assert_not_reached()do { g_assertion_message_expr (((gchar*) 0), "../src/reflect.c"
, 238, ((const char*) (__func__)), ((void*)0)); } while (0);
239}
240
241int
242main(int argc, char **argv)
243{
244 CtkWidget *label, *terminal, *tophalf, *pane, *window, *sw;
245 AtkObject *obj;
246 char *text, *p;
247 gunichar c;
248 guint count;
249
250 ctk_init(&argc, &argv);
251
252 contents = g_array_new(TRUE(!(0)), FALSE(0), sizeof(gunichar));
253
254 terminal_init(&terminal);
1
Calling 'terminal_init'
→
5
←
Returning from 'terminal_init'
→
255
256#ifdef USE_TEXT_VIEW1
257 tophalf = ctk_scrolled_window_new(NULL((void*)0), terminal_adjustment(terminal));
258 ctk_scrolled_window_set_policy(CTK_SCROLLED_WINDOW(tophalf)((((CtkScrolledWindow*) (void *) ((tophalf))))),
259 CTK_POLICY_AUTOMATIC,
260 CTK_POLICY_AUTOMATIC);
261 ctk_container_add(CTK_CONTAINER(tophalf)((((CtkContainer*) (void *) ((tophalf))))), terminal);
262#else
263 tophalf = ctk_grid_new();
264
265 ctk_grid_attach(CTK_GRID(tophalf)((((CtkGrid*) (void *) ((tophalf))))), terminal, 0, 0, 1, 1);
266 ctk_widget_show(terminal);
267
268 CtkWidget* scrollbar = ctk_scrollbar_new(CTK_ORIENTATION_VERTICAL,
269 terminal_adjustment(terminal));
270 ctk_grid_attach(CTK_GRID(tophalf)((((CtkGrid*) (void *) ((tophalf))))), scrollbar, 1, 0, 1, 1);
271 ctk_widget_show(scrollbar);
272#endif
273 ctk_widget_show(terminal);
274
275 label = ctk_label_new("");
276 ctk_label_set_justify(CTK_LABEL(label)((((CtkLabel*) (void *) ((label))))), CTK_JUSTIFY_LEFT);
277 ctk_label_set_xalign(CTK_LABEL(label)((((CtkLabel*) (void *) ((label))))), 0.0);
278 ctk_label_set_yalign(CTK_LABEL(label)((((CtkLabel*) (void *) ((label))))), 0.0);
279
280 sw = ctk_scrolled_window_new(NULL((void*)0), NULL((void*)0));
281 ctk_container_add(CTK_CONTAINER(sw)((((CtkContainer*) (void *) ((sw))))), label);
282 ctk_widget_show(label);
283
284 pane = ctk_paned_new (CTK_ORIENTATION_VERTICAL);
285 ctk_paned_pack1(CTK_PANED(pane)((((CtkPaned*) (void *) ((pane))))), tophalf, TRUE(!(0)), FALSE(0));
286 ctk_paned_pack2(CTK_PANED(pane)((((CtkPaned*) (void *) ((pane))))), sw, TRUE(!(0)), FALSE(0));
287 ctk_widget_show(tophalf);
288 ctk_widget_show(sw);
289
290 window = ctk_window_new(CTK_WINDOW_TOPLEVEL);
291 g_signal_connect(G_OBJECT(window), "delete_event",g_signal_connect_data ((((((GObject*) (void *) ((window))))))
, ("delete_event"), (((GCallback) (ctk_main_quit))), (((void*
)0)), ((void*)0), (GConnectFlags) 0)
292 G_CALLBACK(ctk_main_quit), NULL)g_signal_connect_data ((((((GObject*) (void *) ((window))))))
, ("delete_event"), (((GCallback) (ctk_main_quit))), (((void*
)0)), ((void*)0), (GConnectFlags) 0);
293 ctk_container_add(CTK_CONTAINER(window)((((CtkContainer*) (void *) ((window))))), pane);
294 ctk_widget_show(pane);
295
296 obj = ctk_widget_get_accessible(terminal);
297 g_assert(obj != NULL)do { if (__builtin_expect (__extension__ ({ int _g_boolean_var_15
= 0; if (obj != ((void*)0)) _g_boolean_var_15 = 1; _g_boolean_var_15
; }), 1)) ; else g_assertion_message_expr (((gchar*) 0), "../src/reflect.c"
, 297, ((const char*) (__func__)), "obj != NULL"); } while (0
);
6
←
Assuming 'obj' is not equal to null
→
7
←
Taking true branch
→
8
←
Taking true branch
→
9
←
Loop condition is false. Exiting loop
→
298 g_signal_connect(G_OBJECT(obj), "text-changed::insert",g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-changed::insert"), (((GCallback) (text_changed_insert))
), (label), ((void*)0), (GConnectFlags) 0)
299 G_CALLBACK(text_changed_insert), label)g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-changed::insert"), (((GCallback) (text_changed_insert))
), (label), ((void*)0), (GConnectFlags) 0);
300 g_signal_connect(G_OBJECT(obj), "text-changed::delete",g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-changed::delete"), (((GCallback) (text_changed_delete))
), (label), ((void*)0), (GConnectFlags) 0)
301 G_CALLBACK(text_changed_delete), label)g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-changed::delete"), (((GCallback) (text_changed_delete))
), (label), ((void*)0), (GConnectFlags) 0);
302 g_signal_connect(G_OBJECT(obj), "text-caret-moved",g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-caret-moved"), (((GCallback) (text_caret_moved))), (label
), ((void*)0), (GConnectFlags) 0)
303 G_CALLBACK(text_caret_moved), label)g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-caret-moved"), (((GCallback) (text_caret_moved))), (label
), ((void*)0), (GConnectFlags) 0);
304 g_signal_connect(G_OBJECT(obj), "text-selection-changed",g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-selection-changed"), (((GCallback) (text_selection_changed
))), (label), ((void*)0), (GConnectFlags) 0)
305 G_CALLBACK(text_selection_changed), label)g_signal_connect_data ((((((GObject*) (void *) ((obj)))))), (
"text-selection-changed"), (((GCallback) (text_selection_changed
))), (label), ((void*)0), (GConnectFlags) 0);
306
307 count = (guint)atk_text_get_character_count(ATK_TEXT(obj)(((AtkText*) (void *) ((obj)))));
308 if (count > 0) {
10
←
Assuming 'count' is <= 0
→
11
←
Taking false branch
→
309 text = atk_text_get_text(ATK_TEXT(obj)(((AtkText*) (void *) ((obj)))), 0, count);
310 if (text != NULL((void*)0)) {
311 for (p = text;
312 contents->len < count;
313 p = g_utf8_next_char(p)((p) + g_utf8_skip[*(const guchar *)(p)])) {
314 c = g_utf8_get_char(p);
315 g_array_append_val(contents, c)g_array_append_vals (contents, &(c), 1);
316 }
317 g_free(text);
318 }
319 }
320 terminal_shell(terminal);
321
322 ctk_window_set_default_size(CTK_WINDOW(window)((((CtkWindow*) (void *) ((window))))), 600, 450);
323 ctk_widget_show(window);
324
325 update_contents(obj, terminal);
12
←
Calling 'update_contents'
→
326
327 ctk_main();
328
329 g_array_free(contents, TRUE(!(0)));
330 contents = NULL((void*)0);
331
332 return 0;
333}