From owner-freebsd-bugs@FreeBSD.ORG Sat Jun 1 16:00:02 2013 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 242954E8 for ; Sat, 1 Jun 2013 16:00:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id E4AF3620 for ; Sat, 1 Jun 2013 16:00:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r51G010X099573 for ; Sat, 1 Jun 2013 16:00:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r51G01t9099572; Sat, 1 Jun 2013 16:00:01 GMT (envelope-from gnats) Resent-Date: Sat, 1 Jun 2013 16:00:01 GMT Resent-Message-Id: <201306011600.r51G01t9099572@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Philippe Michel Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id F2B4F4AD for ; Sat, 1 Jun 2013 15:55:21 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from oldred.FreeBSD.org (oldred.freebsd.org [8.8.178.121]) by mx1.freebsd.org (Postfix) with ESMTP id E4770605 for ; Sat, 1 Jun 2013 15:55:21 +0000 (UTC) Received: from oldred.FreeBSD.org ([127.0.1.6]) by oldred.FreeBSD.org (8.14.5/8.14.5) with ESMTP id r51FtLiP093408 for ; Sat, 1 Jun 2013 15:55:21 GMT (envelope-from nobody@oldred.FreeBSD.org) Received: (from nobody@localhost) by oldred.FreeBSD.org (8.14.5/8.14.5/Submit) id r51FtLiU093407; Sat, 1 Jun 2013 15:55:21 GMT (envelope-from nobody) Message-Id: <201306011555.r51FtLiU093407@oldred.FreeBSD.org> Date: Sat, 1 Jun 2013 15:55:21 GMT From: Philippe Michel To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: bin/179174: [patch] flex(1) generated files trigger an alarm from clang static analyzer X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Jun 2013 16:00:02 -0000 >Number: 179174 >Category: bin >Synopsis: [patch] flex(1) generated files trigger an alarm from clang static analyzer >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jun 01 16:00:01 UTC 2013 >Closed-Date: >Last-Modified: >Originator: Philippe Michel >Release: 9.1-STABLE >Organization: >Environment: FreeBSD metropolis 9.1-STABLE FreeBSD 9.1-STABLE #0 r250981: Sat May 25 20:58:04 CEST 2013 pm@metropolis:/usr/obj/usr/src/sys/MYKERNEL amd64 >Description: When compiled by clang static analyzer, C files generated by flex give the following alarm in yy_init_buffer() : Access to field 'yy_input_file' results in a dereference of a null pointer (loaded from variable 'b') >How-To-Repeat: Compile a file generated by flex with ccc-analyzer (from ports' clang ; it is not installed with the base system compiler). >Fix: This may be a false positive and clang may not analyze the code deeply enough to discover it, but checking variable 'b' and exiting with a managed fatal error instead of a core dump if it is null would avoid the problem with no functional side-effects, and would be even more useful if there is indeed a code path that could end with a null buffer. Patch attached with submission follows: Index: usr.bin/lex/flex.skl =================================================================== --- usr.bin/lex/flex.skl (revision 251159) +++ usr.bin/lex/flex.skl (working copy) @@ -1222,6 +1222,9 @@ %* { + if ( ! b ) + YY_FATAL_ERROR( "NULL buffer passed to yy_init_buffer()" ); + yy_flush_buffer( b ); b->yy_input_file = file; >Release-Note: >Audit-Trail: >Unformatted: