Bug Summary

File:_build/../src/xticker.c
Warning:line 115, column 6
Memory copy function accesses out-of-bound array element

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name xticker.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/rootdir/_build -fcoverage-compilation-dir=/rootdir/_build -resource-dir /usr/lib/llvm-19/lib/clang/19 -I src/xticker.p -I src -I ../src -I . -I .. -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -D _FILE_OFFSET_BITS=64 -D BTE_DISABLE_DEPRECATION_WARNINGS -internal-isystem /usr/lib/llvm-19/lib/clang/19/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-address-of-packed-member -Wno-missing-field-initializers -Wno-packed -Wno-switch-enum -Wno-unused-parameter -Wwrite-strings -std=gnu11 -fconst-strings -ferror-limit 19 -stack-protector 2 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-checker deadcode.DeadStores -analyzer-checker alpha.deadcode.UnreachableCode -analyzer-checker alpha.core.CastSize -analyzer-checker alpha.core.CastToStruct -analyzer-checker alpha.core.IdenticalExpr -analyzer-checker alpha.security.ArrayBoundV2 -analyzer-checker alpha.security.MallocOverflow -analyzer-checker alpha.security.ReturnPtrRange -analyzer-checker alpha.unix.SimpleStream -analyzer-checker alpha.unix.cstring.BufferOverlap -analyzer-checker alpha.unix.cstring.NotNullTerminated -analyzer-checker alpha.unix.cstring.OutOfBounds -analyzer-checker alpha.core.FixedAddr -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /rootdir/html-report/2025-10-10-084040-10834-1 -x c ../src/xticker.c
1/*
2 * Copyright (C) 2003 Red Hat, Inc.
3 *
4 * This library is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU Lesser General Public
6 * License as published by the Free Software Foundation; either
7 * version 2.1 of the License, or (at your option) any later version.
8 *
9 * This library is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * Lesser General Public License for more details.
13 *
14 * You should have received a copy of the GNU Lesser General Public
15 * License along with this library; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17 */
18
19#include <config.h>
20#include <sys/types.h>
21#include <sys/stat.h>
22#include <sys/time.h>
23#include <errno(*__errno_location ()).h>
24#include <fcntl.h>
25#include <stdlib.h>
26#include <stdio.h>
27#include <string.h>
28#include <unistd.h>
29#include <glib.h>
30
31/* How's this for useless? Slowly dribble the contents of files through the
32 * title bar. Apparently can be backgrounded. */
33
34#define DEFAULT_WIDTH80 80
35#define DEFAULT_DELAY70000 70000
36
37static void
38my_usleep(long delay)
39{
40 struct timeval tv;
41 tv.tv_sec = delay / 1000000;
42 tv.tv_usec = delay % 1000000;
43 select(0, NULL((void*)0), NULL((void*)0), NULL((void*)0), &tv);
44}
45
46int
47main(int argc, char **argv)
48{
49 long length = DEFAULT_WIDTH80, delay = DEFAULT_DELAY70000, i, j;
50 int c;
51 struct stat st;
52 char *buffer, *outbuf;
53
54 while ((c = getopt(argc, argv, "d:w:")) != -1) {
1
Assuming the condition is true
→
2
←
Loop condition is true. Entering loop body
→
6
←
 Execution continues on line 54
→
7
←
Assuming the condition is false
→
8
←
Loop condition is false. Execution continues on line 75
→
55 switch (c) {
3
←
Control jumps to 'case 119:' at line 62
→
56 case 'd':
57 delay = atol(optarg);
58 if (delay == 0) {
59 delay = DEFAULT_DELAY70000;
60 }
61 break;
62 case 'w':
63 length = atol(optarg);
64 if (length == 0) {
4
←
Assuming 'length' is not equal to 0
→
5
←
Taking false branch
→
65 length = DEFAULT_WIDTH80;
66 }
67 break;
68 default:
69 g_print("Usage: xticker [-d delay] [-w width] file [...]\n");
70 return 1;
71 break;
72 }
73 }
74
75 outbuf = g_malloc(length + 5);
76
77 for (i = optind; i < argc; i++) {
9
←
Assuming 'i' is < 'argc'
→
10
←
Loop condition is true. Entering loop body
→
78 long fd = open(argv[i], O_RDONLY00);
79 if (fd != -1) {
11
←
Taking true branch
→
80 if (fstat(fd, &st) != -1) {
12
←
Taking true branch
→
81 buffer = g_malloc(st.st_size);
82#pragma GCC diagnostic push
83#pragma GCC diagnostic ignored "-Wunused-result"
84 read(fd, buffer, st.st_size);
85#pragma GCC diagnostic pop
86 for (j = 0; j < st.st_size; j++) {
13
←
Assuming 'j' is < field 'st_size'
→
14
←
Loop condition is true. Entering loop body
→
18
←
Assuming 'j' is >= field 'st_size'
→
19
←
Loop condition is false. Execution continues on line 109
→
87 switch (buffer[j]) {
15
←
Control jumps to the 'default' case at line 95
→
88 case '\r':
89 case '\n':
90 case '\t':
91 case '\b':
92 case '\0':
93 buffer[j] = ' ';
94 break;
95 default:
96 break;
97 }
98 if (j
16.1
'j' is <= 0
 > 0) {
16
←
 Execution continues on line 98
→
17
←
Taking false branch
→
99 if ((buffer[j] == ' ') &&
100 (buffer[j - 1] == ' ')) {
101 memmove(buffer + j - 1,
102 buffer + j,
103 st.st_size - j);
104 st.st_size--;
105 j--;
106 }
107 }
108 }
109 close(fd);
110 for (j = 0; j < st.st_size - length; j++) {
20
←
Assuming the condition is true
→
21
←
Loop condition is true. Entering loop body
→
111 outbuf[0] = '\033';
112 outbuf[1] = ']';
113 outbuf[2] = '0';
114 outbuf[3] = ';';
115 memcpy(outbuf + 4,
22
←
Memory copy function accesses out-of-bound array element
116 buffer + j,
117 length);
118 outbuf[length + 4] = '\007';
119#pragma GCC diagnostic push
120#pragma GCC diagnostic ignored "-Wunused-result"
121 write(STDERR_FILENO2,
122 outbuf,
123 length + 5);
124#pragma GCC diagnostic pop
125 my_usleep(delay);
126 if ((j == 0) ||
127 (j == st.st_size - length - 1)) {
128 my_usleep(1000000);
129 }
130 }
131 g_free(buffer);
132 } else {
133 close(fd);
134 }
135 } else {
136 char *errbuf;
137 errbuf = g_strdup_printf("\033]0;Error opening %s: %s."
138 "\007",
139 argv[i],
140 strerror(errno(*__errno_location ())));
141#pragma GCC diagnostic push
142#pragma GCC diagnostic ignored "-Wunused-result"
143 write(STDERR_FILENO2, errbuf, strlen(errbuf));
144#pragma GCC diagnostic pop
145 g_free(errbuf);
146 my_usleep(1000000);
147 }
148 }
149
150 g_free(outbuf);
151
152 return 0;
153}