Coverity FORWARD_NULL - CID 12460 - src/match.cpp - in function: matchOpsToString(std::list<MatchOp *, std::allocator<MatchOp *>> &) - Dynamic cast to pointer "dynamic_cast <MatchExpOp *>(op)" can return NULL. Passing null pointer "dynamic_cast <MatchExpOp *>(op)->value" to function "std::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator +=(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const &)", which dereferences it.

Bug #1101507 reported by Product Strategy Coverity Bug Uploader
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Compiz
Triaged
Medium
Unassigned

Bug Description

This bug is exported from the Coverity Integration Manager on Canonical's servers. For information on how this is done please see this website: https://wiki.ubuntu.com/CanonicalProductStrategy/Coverity
CID: 12460
Checker: FORWARD_NULL
Category: dynamic_cast
CWE definition: http://cwe.mitre.org/data/definitions/476.html
File: /tmp/buildd/compiz-0.9.9~daily13.01.14/src/match.cpp
Function: matchOpsToString(std::list<MatchOp *, std::allocator<MatchOp *>> &)
Code snippet:
426
427 if (op->flags & MATCH_OP_NOT_MASK)
428 value += "!";
429
CID 12460 - FORWARD_NULL
Dynamic cast to pointer "dynamic_cast <MatchExpOp *>(op)" can return NULL.
Passing null pointer "dynamic_cast <MatchExpOp *>(op)->value" to function "std::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator +=(std::basic_string<char, std::char_traits<char>, std::allocator<char> > const &)", which dereferences it.
430 value += dynamic_cast <MatchExpOp *> (op)->value;
431 value += " ";
432 break;
433 default:
434 break;
435 }

Revision history for this message
Product Strategy Coverity Bug Uploader (coverity-uploader) wrote : compiz-0.9.9: /tmp/buildd/compiz-0.9.9~daily13.01.14/src/match.cpp

Source file with Coverity annotations.

Changed in compiz:
importance: Undecided → High
MC Return (mc-return)
summary: - Coverity FORWARD_NULL - CID 12460
+ Coverity FORWARD_NULL - CID 12460 - src/match.cpp - in function:
+ matchOpsToString(std::list<MatchOp *, std::allocator<MatchOp *>> &) -
+ Dynamic cast to pointer "dynamic_cast <MatchExpOp *>(op)" can return
+ NULL. Passing null pointer "dynamic_cast <MatchExpOp *>(op)->value" to
+ function "std::basic_string<char, std::char_traits<char>,
+ std::allocator<char> >::operator +=(std::basic_string<char,
+ std::char_traits<char>, std::allocator<char> > const &)", which
+ dereferences it.
Changed in compiz:
milestone: none → 0.9.10.0
MC Return (mc-return)
Changed in compiz:
milestone: 0.9.10.0 → 0.9.11.0
Stephen M. Webb (bregma)
no longer affects: compiz/0.9.9
Changed in compiz:
importance: High → Medium
milestone: 0.9.11.0 → 0.9.12.0
status: New → Triaged
Stephen M. Webb (bregma)
Changed in compiz:
milestone: 0.9.12.0 → 0.9.12.1
Stephen M. Webb (bregma)
Changed in compiz:
milestone: 0.9.12.1 → 0.9.12.2
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.