Skip to content

Fix #12951 nullptr dereference in CheckLeakAutoVar::checkScope() #6613

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrchr-github merged 5 commits into from
Jul 19, 2024
Merged

Fix #12951 nullptr dereference in CheckLeakAutoVar::checkScope() #6613

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
af5e6d3
Update sqlite3.c
chrchr-github Jul 19, 2024
e6dccc1
Update checkleakautovar.cpp
chrchr-github Jul 19, 2024
5164bef
Merge branch 'main' into chr_12951
chrchr-github Jul 19, 2024
3fc3781
Update sqlite3.cfg
chrchr-github Jul 19, 2024
9a50905
Update sqlite3.cfg
chrchr-github Jul 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions cfg/sqlite3.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1027,6 +1027,49 @@
<not-bool/>
</arg>
</function>
<!-- https://www.sqlite.org/capi3ref.html#sqlite3_open -->
<!-- int sqlite3_open16(const void *filename, /* Database filename (UTF-16) */
sqlite3 **ppDb /* OUT: SQLite db handle */); -->
<function name="sqlite3_open16">
<noreturn>false</noreturn>
<returnValue type="int"/>
<arg nr="1" direction="in">
<not-null/>
<not-uninit/>
<strz/>
</arg>
<arg nr="2" direction="out">
<not-null/>
<not-bool/>
</arg>
</function>
<!-- https://www.sqlite.org/capi3ref.html#sqlite3_open -->
<!-- int sqlite3_open_v2(const char *filename, /* Database filename (UTF-8) */
sqlite3 **ppDb, /* OUT: SQLite db handle */
int flags, /* Flags */
const char *zVfs /* Name of VFS module to use */); -->
<function name="sqlite3_open_v2">
<noreturn>false</noreturn>
<returnValue type="int"/>
<arg nr="1" direction="in">
<not-null/>
<not-uninit/>
<strz/>
</arg>
<arg nr="2" direction="out">
<not-null/>
<not-bool/>
</arg>
<arg nr="3" direction="in">
<not-uninit/>
<not-bool/>
</arg>
<arg nr="4" direction="in">
<not-null/>
<not-uninit/>
<strz/>
</arg>
</function>
<!-- https://www.sqlite.org/capi3ref.html#sqlite3_prepare -->
<!-- int sqlite3_prepare(sqlite3 *db, /* Database handle */
const char *zSql, /* SQL statement, UTF-8 encoded */
Expand Down
2 changes: 1 addition & 1 deletion lib/checkleakautovar.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -555,7 +555,7 @@ bool CheckLeakAutoVar::checkScope(const Token * const startToken,
if (info.second.status != VarInfo::ALLOC)
return false;
const Token* ret = getReturnValueFromOutparamAlloc(info.second.allocTok, *mSettings);
return ret && ret->varId() && ret->varId() == vartok->varId();
return ret && vartok && ret->varId() && ret->varId() == vartok->varId();
})) {
varInfo1.clear();
}
Expand Down
8 changes: 8 additions & 0 deletions test/cfg/sqlite3.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,14 @@ void resourceLeak_sqlite3_open()
// cppcheck-suppress resourceLeak
}

void resourceLeak_sqlite3_open_v2(const char* Filename, int Flags, int Timeout, const char* Vfs) { // #12951, don't crash
sqlite3* handle;
const int ret = sqlite3_open_v2(Filename, &handle, Flags, Vfs);
if (SQLITE_OK != ret) {}
if (Timeout > 0) {}
// cppcheck-suppress resourceLeak
}

void ignoredReturnValue(const char * buf)
{
// cppcheck-suppress leakReturnValNotUsed
Expand Down