Bug Summary

File:weather-met.c
Warning:line 111, column 8
Out of bound memory access (access exceeds upper limit of memory block)

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name weather-met.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/rootdir/libcafeweather -resource-dir /usr/lib/llvm-16/lib/clang/16 -D HAVE_CONFIG_H -I . -I .. -I /usr/include/ctk-3.0 -I /usr/include/pango-1.0 -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -I /usr/include/harfbuzz -I /usr/include/freetype2 -I /usr/include/libpng16 -I /usr/include/libmount -I /usr/include/blkid -I /usr/include/fribidi -I /usr/include/cairo -I /usr/include/pixman-1 -I /usr/include/gdk-pixbuf-2.0 -I /usr/include/x86_64-linux-gnu -I /usr/include/webp -I /usr/include/gio-unix-2.0 -I /usr/include/atk-1.0 -I /usr/include/at-spi2-atk/2.0 -I /usr/include/at-spi-2.0 -I /usr/include/dbus-1.0 -I /usr/lib/x86_64-linux-gnu/dbus-1.0/include -I .. -I . -I /usr/include/libxml2 -I /usr/include/libsoup-3.0 -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -I /usr/include/libmount -I /usr/include/blkid -I /usr/include/glib-2.0 -I /usr/lib/x86_64-linux-gnu/glib-2.0/include -I /usr/include/sysprof-6 -I /usr/include/libmount -I /usr/include/blkid -D G_LOG_DOMAIN="CafeWeather" -D CAFELOCALEDIR="/usr/share/locale" -D CAFEWEATHER_XML_LOCATION_DIR="/usr/share/libcafeweather" -D PIC -internal-isystem /usr/lib/llvm-16/lib/clang/16/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir=/rootdir/libcafeweather -ferror-limit 19 -fgnuc-version=4.2.1 -analyzer-checker deadcode.DeadStores -analyzer-checker alpha.deadcode.UnreachableCode -analyzer-checker alpha.core.CastSize -analyzer-checker alpha.core.CastToStruct -analyzer-checker alpha.core.IdenticalExpr -analyzer-checker alpha.core.SizeofPtr -analyzer-checker alpha.security.ArrayBoundV2 -analyzer-checker alpha.security.MallocOverflow -analyzer-checker alpha.security.ReturnPtrRange -analyzer-checker alpha.unix.SimpleStream -analyzer-checker alpha.unix.cstring.BufferOverlap -analyzer-checker alpha.unix.cstring.NotNullTerminated -analyzer-checker alpha.unix.cstring.OutOfBounds -analyzer-checker alpha.core.FixedAddr -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /rootdir/html-report/2024-08-25-170056-14500-1 -x c weather-met.c
1/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 4 -*- */
2/* weather-met.c - UK Met Office forecast source
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License as
6 * published by the Free Software Foundation; either version 2 of the
7 * License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see
16 * <http://www.gnu.org/licenses/>.
17 */
18
19#ifdef HAVE_CONFIG_H1
20#include <config.h>
21#endif
22
23#include <ctype.h>
24#include <stdlib.h>
25#include <string.h>
26
27#define CAFEWEATHER_I_KNOW_THIS_IS_UNSTABLE
28#include "weather.h"
29#include "weather-priv.h"
30
31static char *
32met_reprocess (char *x, int len)
33{
34 char *p = x;
35 char *o;
36 int spacing = 0;
37 static gchar *buf;
38 static gint buflen = 0;
39 gchar *lastspace = NULL((void*)0);
40 int count = 0;
41
42 if (buflen < len)
18
←
Assuming 'buflen' is < 'len'
→
19
←
Taking true branch
→
43 {
44 if (buf
19.1
'buf' is null
)
20
←
Taking false branch
→
45 g_free (buf);
46 buf = g_malloc (len + 1);
47 buflen = len;
48 }
49
50 o = buf;
51 x += len; /* End mark */
52
53 while (*p && p
21.1
'p' is < 'x'
 < x) {
21
←
Assuming the condition is true
→
22
←
Loop condition is true. Entering loop body
→
37
←
 Execution continues on line 53
→
38
←
Assuming the condition is true
→
39
←
Assuming 'p' is >= 'x'
→
40
←
Loop condition is false. Execution continues on line 111
→
54 if (g_ascii_isspace (*p)((g_ascii_table[(guchar) (*p)] & G_ASCII_SPACE) != 0)) {
23
←
Assuming the condition is false
→
24
←
Taking false branch
→
55 if (!spacing) {
56 spacing = 1;
57 lastspace = o;
58 count++;
59 *o++ = ' ';
60 }
61 p++;
62 continue;
63 }
64 spacing = 0;
65 if (count
24.1
'count' is <= 75
 > 75 && lastspace) {
66 count = o - lastspace - 1;
67 *lastspace = '\n';
68 lastspace = NULL((void*)0);
69 }
70
71 if (*p == '&') {
25
←
Assuming the condition is false
→
26
←
Taking false branch
→
72 if (g_ascii_strncasecmp (p, "&amp;", 5) == 0) {
73 *o++ = '&';
74 count++;
75 p += 5;
76 continue;
77 }
78 if (g_ascii_strncasecmp (p, "&lt;", 4) == 0) {
79 *o++ = '<';
80 count++;
81 p += 4;
82 continue;
83 }
84 if (g_ascii_strncasecmp (p, "&gt;", 4) == 0) {
85 *o++ = '>';
86 count++;
87 p += 4;
88 continue;
89 }
90 }
91 if (*p == '<') {
27
←
Assuming the condition is true
→
28
←
Taking true branch
→
92 if (g_ascii_strncasecmp (p, "<BR>", 4) == 0) {
29
←
Assuming the condition is true
→
30
←
Taking true branch
→
93 *o++ = '\n';
94 count = 0;
95 }
96 if (g_ascii_strncasecmp (p, "<B>", 3) == 0) {
31
←
Assuming the condition is true
→
32
←
Taking true branch
→
97 *o++ = '\n';
98 *o++ = '\n';
99 count = 0;
100 }
101 p++;
102 while (*p && *p != '>')
33
←
Assuming the condition is true
→
34
←
Assuming the condition is false
→
35
←
Loop condition is false. Execution continues on line 104
→
103 p++;
104 if (*p)
36
←
Taking true branch
→
105 p++;
106 continue;
107 }
108 *o++ = *p++;
109 count++;
110 }
111 *o = 0;
41
←
Out of bound memory access (access exceeds upper limit of memory block)
112 return buf;
113}
114
115
116/*
117 * Parse the metoffice forecast info.
118 * For cafe 3.0 we want to just embed an HTML cafecomponent component and
119 * be done with this ;)
120 */
121
122static gchar *
123met_parse (const gchar *meto)
124{
125 gchar *p;
126 gchar *rp;
127 gchar *r = g_strdup ("Met Office Forecast\n")g_strdup_inline ("Met Office Forecast\n");
128 gchar *t;
129
130 g_return_val_if_fail (meto != NULL, r)do { if ((meto != ((void*)0))) { } else { g_return_if_fail_warning
("CafeWeather", ((const char*) (__func__)), "meto != NULL");
return (r); } } while (0);
8
←
Assuming 'meto' is not equal to null
→
9
←
Taking true branch
→
10
←
Loop condition is false. Exiting loop
→
131
132 p = strstr (meto, "Summary: </b>");
133 g_return_val_if_fail (p != NULL, r)do { if ((p != ((void*)0))) { } else { g_return_if_fail_warning
("CafeWeather", ((const char*) (__func__)), "p != NULL"); return
(r); } } while (0);
11
←
Assuming 'p' is not equal to null
→
12
←
Taking true branch
→
13
←
Loop condition is false. Exiting loop
→
134
135 rp = strstr (p, "Text issued at:");
136 g_return_val_if_fail (rp != NULL, r)do { if ((rp != ((void*)0))) { } else { g_return_if_fail_warning
("CafeWeather", ((const char*) (__func__)), "rp != NULL"); return
(r); } } while (0);
14
←
Assuming 'rp' is not equal to null
→
15
←
Taking true branch
→
16
←
Loop condition is false. Exiting loop
→
137
138 p += 13;
139 /* p to rp is the text block we want but in HTML malformat */
140 t = g_strconcat (r, met_reprocess (p, rp - p), NULL((void*)0));
17
←
Calling 'met_reprocess'
→
141 g_free (r);
142
143 return t;
144}
145
146static void
147met_finish (GObject *object, GAsyncResult *result, gpointer data)
148{
149 SoupSession *session = SOUP_SESSION (object);
150 SoupMessage *msg = soup_session_get_async_result_message (session, result);
151 WeatherInfo *info = (WeatherInfo *)data;
152 GBytes *response_body = NULL((void*)0);
153 const gchar *msgdata;
154
155 g_return_if_fail (info != NULL)do { if ((info != ((void*)0))) { } else { g_return_if_fail_warning
("CafeWeather", ((const char*) (__func__)), "info != NULL");
return; } } while (0);
1
Assuming 'info' is not equal to null
→
2
←
Taking true branch
→
3
←
Loop condition is false. Exiting loop
→
156
157 response_body = soup_session_send_and_read_finish (session, result, NULL((void*)0));
158
159 if (!SOUP_STATUS_IS_SUCCESSFUL (soup_message_get_status (msg))((soup_message_get_status (msg)) >= 200 && (soup_message_get_status
(msg)) < 300)) {
4
←
Assuming the condition is true
→
5
←
Assuming the condition is true
→
6
←
Taking false branch
→
160 g_warning ("Failed to get Met Office forecast data: %d %s.\n",
161 soup_message_get_status (msg), soup_message_get_reason_phrase (msg));
162 request_done (info, FALSE(0));
163 g_bytes_unref (response_body);
164 return;
165 }
166
167 msgdata = g_bytes_get_data(response_body, NULL((void*)0));
168
169 info->forecast = met_parse (msgdata);
7
←
Calling 'met_parse'
→
170 request_done (info, TRUE(!(0)));
171 g_bytes_unref (response_body);
172}
173
174void
175metoffice_start_open (WeatherInfo *info)
176{
177 gchar *url;
178 SoupMessage *msg;
179 WeatherLocation *loc;
180
181 loc = info->location;
182 url = g_strdup_printf ("http://www.metoffice.gov.uk/weather/europe/uk/%s.html", loc->zone + 1);
183
184 msg = soup_message_new ("GET", url);
185 soup_session_send_and_read_async (info->session, msg, G_PRIORITY_DEFAULT0, NULL((void*)0), met_finish, info);
186 g_free (url);
187
188 info->requests_pending++;
189}