UNINIT in /inkbugs/inkscape/src/libvpsc/csolve_vpsc.cpp

[Vaughn Spurlin]

UNINIT in /inkbugs/inkscape/src/libvpsc/csolve_vpsc.cpp

In genYConstraints():
Reads an uninitialized pointer or its target (CWE-457).

   45int genYConstraints(int n, boxf* bb, Variable** vs, Constraint*** cs) {
Declaring variable "rs" without initializer.
   46 Rectangle* rs[n];
At conditional (1): "i < n" taking the false branch.
   47 for(int i=0;i<n;i++) {
   48 rs[i]=new Rectangle(bb[i].LL.x,bb[i].UR.x,bb[i].LL.y,bb[i].UR.y);
   49 }
Using uninitialized element of array "rs" when calling "vpsc::generateYConstraints(int, vpsc::Rectangle **, vpsc::Variable **, vpsc::Constraint **&)". [show details]
   50 int m = generateYConstraints(n,rs,vs,*cs);

[Vaughn Spurlin (vspurlin)]

fix suggestion 2010-07-25:
   45.1 assert(n > 0);

fix reason:
  insert a line to ensure that rs[n] is created with at least 1 element.
  looked for origin of n's value to ensure that it was >= 1.
  found a chain of assumptions that the value is good, without verification.
  current code is brittle, so add assert() for protection.

[Kris (kris-degussem)]

Committed in trunk revision 11658.