Bug Summary

File:projects/compiler-rt/lib/tsan/rtl/tsan_stack_trace.cpp
Warning:line 42, column 23
Array access (via field 'trace_buffer') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name tsan_stack_trace.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -pic-is-pie -mthread-model posix -mframe-pointer=none -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -target-feature +sse3 -dwarf-column-info -debugger-tuning=gdb -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-10/lib/clang/10.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-10~svn374877/build-llvm/projects/compiler-rt/lib/tsan -I /build/llvm-toolchain-snapshot-10~svn374877/projects/compiler-rt/lib/tsan -I /build/llvm-toolchain-snapshot-10~svn374877/build-llvm/include -I /build/llvm-toolchain-snapshot-10~svn374877/include -I /build/llvm-toolchain-snapshot-10~svn374877/projects/compiler-rt/lib/tsan/.. -U NDEBUG -isysroot . -internal-isystem ./usr/local/include -internal-isystem /usr/lib/llvm-10/lib/clang/10.0.0/include -internal-externc-isystem ./include -internal-externc-isystem ./usr/include -O3 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -Wno-unused-parameter -Wno-variadic-macros -Wno-non-virtual-dtor -std=c++14 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-10~svn374877/build-llvm/projects/compiler-rt/lib/tsan -fdebug-prefix-map=/build/llvm-toolchain-snapshot-10~svn374877=. -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -fvisibility-inlines-hidden -fno-builtin -fno-rtti -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -o /tmp/scan-build-2019-10-15-233810-7101-1 -x c++ /build/llvm-toolchain-snapshot-10~svn374877/projects/compiler-rt/lib/tsan/rtl/tsan_stack_trace.cpp
1//===-- tsan_stack_trace.cpp ----------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of ThreadSanitizer (TSan), a race detector.
10//
11//===----------------------------------------------------------------------===//
12#include "tsan_stack_trace.h"
13#include "tsan_rtl.h"
14#include "tsan_mman.h"
15
16namespace __tsan {
17
18VarSizeStackTrace::VarSizeStackTrace()
19 : StackTrace(nullptr, 0), trace_buffer(nullptr) {}
20
21VarSizeStackTrace::~VarSizeStackTrace() {
22 ResizeBuffer(0);
23}
24
25void VarSizeStackTrace::ResizeBuffer(uptr new_size) {
26 if (trace_buffer) {
3
Assuming field 'trace_buffer' is null
4
Taking false branch
27 internal_free(trace_buffer);
28 }
29 trace_buffer =
7
Null pointer value stored to field 'trace_buffer'
30 (new_size > 0)
5
Assuming 'new_size' is <= 0
6
'?' condition is false
31 ? (uptr *)internal_alloc(MBlockStackTrace,
32 new_size * sizeof(trace_buffer[0]))
33 : nullptr;
34 trace = trace_buffer;
35 size = new_size;
36}
37
38void VarSizeStackTrace::Init(const uptr *pcs, uptr cnt, uptr extra_top_pc) {
39 ResizeBuffer(cnt + !!extra_top_pc);
1
Assuming 'extra_top_pc' is not equal to 0
2
Calling 'VarSizeStackTrace::ResizeBuffer'
8
Returning from 'VarSizeStackTrace::ResizeBuffer'
40 internal_memcpy(trace_buffer, pcs, cnt * sizeof(trace_buffer[0]));
41 if (extra_top_pc
8.1
'extra_top_pc' is not equal to 0
)
9
Taking true branch
42 trace_buffer[cnt] = extra_top_pc;
10
Array access (via field 'trace_buffer') results in a null pointer dereference
43}
44
45void VarSizeStackTrace::ReverseOrder() {
46 for (u32 i = 0; i < (size >> 1); i++)
47 Swap(trace_buffer[i], trace_buffer[size - 1 - i]);
48}
49
50} // namespace __tsan
51
52#if !SANITIZER_GO0
53void __sanitizer::BufferedStackTrace::UnwindImpl(
54 uptr pc, uptr bp, void *context, bool request_fast, u32 max_depth) {
55 uptr top = 0;
56 uptr bottom = 0;
57 if (StackTrace::WillUseFastUnwind(request_fast)) {
58 GetThreadStackTopAndBottom(false, &top, &bottom);
59 Unwind(max_depth, pc, bp, nullptr, top, bottom, true);
60 } else
61 Unwind(max_depth, pc, 0, context, 0, 0, false);
62}
63#endif // SANITIZER_GO