Bug Summary

File:compiler-rt/lib/tsan/rtl/tsan_stack_trace.cpp
Warning:line 38, column 23
Array access (via field 'trace_buffer') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name tsan_stack_trace.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +sse4.2 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/build-llvm -resource-dir /usr/lib/llvm-14/lib/clang/14.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I projects/compiler-rt/lib/tsan -I /build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/compiler-rt/lib/tsan -I include -I /build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/llvm/include -I /build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/compiler-rt/lib/tsan/.. -D NDEBUG -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/x86_64-linux-gnu/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/backward -internal-isystem /usr/lib/llvm-14/lib/clang/14.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-command-line-argument -Wno-unknown-warning-option -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-class-memaccess -Wno-redundant-move -Wno-pessimizing-move -Wno-noexcept-type -Wno-comment -Wno-unused-parameter -Wno-variadic-macros -std=c++14 -fdeprecated-macro -fdebug-compilation-dir=/build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/build-llvm -ferror-limit 19 -fvisibility hidden -fvisibility-inlines-hidden -fno-builtin -fno-rtti -fgnuc-version=4.2.1 -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2021-11-10-160236-22541-1 -x c++ /build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/compiler-rt/lib/tsan/rtl/tsan_stack_trace.cpp

/build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/compiler-rt/lib/tsan/rtl/tsan_stack_trace.cpp

→
1//===-- tsan_stack_trace.cpp ----------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of ThreadSanitizer (TSan), a race detector.
10//
11//===----------------------------------------------------------------------===//
12#include "tsan_stack_trace.h"
13#include "tsan_rtl.h"
14#include "tsan_mman.h"
15
16namespace __tsan {
17
18VarSizeStackTrace::VarSizeStackTrace()
19 : StackTrace(nullptr, 0), trace_buffer(nullptr) {}
20
21VarSizeStackTrace::~VarSizeStackTrace() {
22 ResizeBuffer(0);
23}
24
25void VarSizeStackTrace::ResizeBuffer(uptr new_size) {
26 Free(trace_buffer);
3
←
Calling 'Free<unsigned long>'
→
7
←
Returning from 'Free<unsigned long>'
→
27 trace_buffer = (new_size > 0)
8
←
Assuming 'new_size' is <= 0
→
9
←
'?' condition is false
→
10
←
Null pointer value stored to field 'trace_buffer'
→
28 ? (uptr *)Alloc(new_size * sizeof(trace_buffer[0]))
29 : nullptr;
30 trace = trace_buffer;
31 size = new_size;
32}
33
34void VarSizeStackTrace::Init(const uptr *pcs, uptr cnt, uptr extra_top_pc) {
35 ResizeBuffer(cnt + !!extra_top_pc);
1
Assuming 'extra_top_pc' is not equal to 0
→
2
←
Calling 'VarSizeStackTrace::ResizeBuffer'
→
11
←
Returning from 'VarSizeStackTrace::ResizeBuffer'
→
36 internal_memcpy(trace_buffer, pcs, cnt * sizeof(trace_buffer[0]));
37 if (extra_top_pc
11.1
'extra_top_pc' is not equal to 0
11.1
'extra_top_pc' is not equal to 0
)
12
←
Taking true branch
→
38 trace_buffer[cnt] = extra_top_pc;
13
←
Array access (via field 'trace_buffer') results in a null pointer dereference
39}
40
41void VarSizeStackTrace::ReverseOrder() {
42 for (u32 i = 0; i < (size >> 1); i++)
43 Swap(trace_buffer[i], trace_buffer[size - 1 - i]);
44}
45
46} // namespace __tsan
47
48#if !SANITIZER_GO0
49void __sanitizer::BufferedStackTrace::UnwindImpl(
50 uptr pc, uptr bp, void *context, bool request_fast, u32 max_depth) {
51 uptr top = 0;
52 uptr bottom = 0;
53 GetThreadStackTopAndBottom(false, &top, &bottom);
54 bool fast = StackTrace::WillUseFastUnwind(request_fast);
55 Unwind(max_depth, pc, bp, context, top, bottom, fast);
56}
57#endif // SANITIZER_GO
←

/build/llvm-toolchain-snapshot-14~++20211110111138+cffbfd01e37b/compiler-rt/lib/tsan/rtl/tsan_mman.h

1//===-- tsan_mman.h ---------------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of ThreadSanitizer (TSan), a race detector.
10//
11//===----------------------------------------------------------------------===//
12#ifndef TSAN_MMAN_H
13#define TSAN_MMAN_H
14
15#include "tsan_defs.h"
16
17namespace __tsan {
18
19const uptr kDefaultAlignment = 16;
20
21void InitializeAllocator();
22void InitializeAllocatorLate();
23void ReplaceSystemMalloc();
24void AllocatorProcStart(Processor *proc);
25void AllocatorProcFinish(Processor *proc);
26void AllocatorPrintStats();
27
28// For user allocations.
29void *user_alloc_internal(ThreadState *thr, uptr pc, uptr sz,
30 uptr align = kDefaultAlignment, bool signal = true);
31// Does not accept NULL.
32void user_free(ThreadState *thr, uptr pc, void *p, bool signal = true);
33// Interceptor implementations.
34void *user_alloc(ThreadState *thr, uptr pc, uptr sz);
35void *user_calloc(ThreadState *thr, uptr pc, uptr sz, uptr n);
36void *user_realloc(ThreadState *thr, uptr pc, void *p, uptr sz);
37void *user_reallocarray(ThreadState *thr, uptr pc, void *p, uptr sz, uptr n);
38void *user_memalign(ThreadState *thr, uptr pc, uptr align, uptr sz);
39int user_posix_memalign(ThreadState *thr, uptr pc, void **memptr, uptr align,
40 uptr sz);
41void *user_aligned_alloc(ThreadState *thr, uptr pc, uptr align, uptr sz);
42void *user_valloc(ThreadState *thr, uptr pc, uptr sz);
43void *user_pvalloc(ThreadState *thr, uptr pc, uptr sz);
44uptr user_alloc_usable_size(const void *p);
45
46// Invoking malloc/free hooks that may be installed by the user.
47void invoke_malloc_hook(void *ptr, uptr size);
48void invoke_free_hook(void *ptr);
49
50// For internal data structures.
51void *Alloc(uptr sz);
52void FreeImpl(void *p);
53
54template <typename T, typename... Args>
55T *New(Args &&...args) {
56 return new (Alloc(sizeof(T))) T(static_cast<Args &&>(args)...);
57}
58
59template <typename T>
60void Free(T *&p) {
61 if (p == nullptr)
4
←
Assuming the condition is true
→
5
←
Taking true branch
→
62 return;
6
←
Returning without writing to 'p'
→
63 FreeImpl(p);
64 p = nullptr;
65}
66
67template <typename T>
68void DestroyAndFree(T *&p) {
69 if (p == nullptr)
70 return;
71 p->~T();
72 Free(p);
73}
74
75} // namespace __tsan
76#endif // TSAN_MMAN_H