Coverity FORWARD_NULL - CID 12457 - src/match.cpp - in function: matchEvalOps(std::list<MatchOp *, std::allocator<MatchOp *>> &, const CompWindow *) - Dynamic cast to pointer "dynamic_cast <MatchExpOp *>(op)" can return NULL. Assigning: "exp" = "dynamic_cast <MatchExpOp *>(op)". Passing null pointer "exp->e" to function "boost::shared_ptr<CompMatch::Expression>::get() const", which dereferences it.

Bug #1101584 reported by Product Strategy Coverity Bug Uploader on 2013-01-18
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Compiz
High
Unassigned
0.9.9
High
Unassigned

Bug Description

This bug is exported from the Coverity Integration Manager on Canonical's servers. For information on how this is done please see this website: https://wiki.ubuntu.com/CanonicalProductStrategy/Coverity
CID: 12457
Checker: FORWARD_NULL
Category: dynamic_cast
CWE definition: http://cwe.mitre.org/data/definitions/476.html
File: /tmp/buildd/compiz-0.9.9~daily13.01.14/src/match.cpp
Function: matchEvalOps(std::list<MatchOp *, std::allocator<MatchOp *>> &, const CompWindow *)
Code snippet:
490 value =
491 matchEvalOps (dynamic_cast <MatchGroupOp *> (op)->op, w);
492 break;
493 case MatchOp::TypeExp:
CID 12457 - FORWARD_NULL
Dynamic cast to pointer "dynamic_cast <MatchExpOp *>(op)" can return NULL.
Assigning: "exp" = "dynamic_cast <MatchExpOp *>(op)".
494 exp = dynamic_cast <MatchExpOp *> (op);
CID 12457 - FORWARD_NULL
Passing null pointer "exp->e" to function "boost::shared_ptr<CompMatch::Expression>::get() const", which dereferences it.
495 if (exp->e.get ())
496 value = exp->e->evaluate (w);
497 else
498 value = true;
499 break;

Source file with Coverity annotations.

Changed in compiz:
importance: Undecided → High
MC Return (mc-return) on 2013-07-06
summary: - Coverity FORWARD_NULL - CID 12457
+ Coverity FORWARD_NULL - CID 12457 - src/match.cpp - in function:
+ matchEvalOps(std::list<MatchOp *, std::allocator<MatchOp *>> &, const
+ CompWindow *) - Dynamic cast to pointer "dynamic_cast <MatchExpOp
+ *>(op)" can return NULL. Assigning: "exp" = "dynamic_cast <MatchExpOp
+ *>(op)". Passing null pointer "exp->e" to function
+ "boost::shared_ptr<CompMatch::Expression>::get() const", which
+ dereferences it.
Changed in compiz:
milestone: none → 0.9.10.0
MC Return (mc-return) on 2013-07-24
Changed in compiz:
milestone: 0.9.10.0 → 0.9.11.0
Stephen M. Webb (bregma) on 2014-11-18
Changed in compiz:
status: New → Confirmed
milestone: 0.9.11.0 → 0.9.12.1
Stephen M. Webb (bregma) on 2015-02-03
Changed in compiz:
milestone: 0.9.12.1 → 0.9.12.2
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers