[HP aCC 6.15] potential null dererefence and out of bound access in iso2022.cpp

• Key: STDCXX-730
• Type: Sub-task
• Status: Resolved
• Resolution: Fixed
• Priority: Major
• Assignee: Martin Sebor
• Reporter: Martin Sebor
• Component/s: 22. Localization
• Affects Version/s: 4.2.0
• Fix Version/s: 4.2.1

Environment

$ uname -sr && aCC -V
HP-UX B.11.31
aCC: HP C/aC++ B3910B A.06.16 [Nov 26 2007]

Description

We're getting a bunch of warnings from this file,. a couple of them looking serious:

"$(TOPDIR)/src/iso2022.cpp", line 470: warning #4232-D: conversion from "mbstate_t *" to a more strictly aligned type "unsigned short *" may cause misaligned access
          _RWSTD_REINTERPRET_CAST (ISO_2022_STATE_INDEX_T*, &state);
          ^

"$(TOPDIR)/include/loc/_localedef.h", line 160: remark #4298-D: 64 bit migration: addition result could be truncated before cast to bigger sized type
          return (wtolower_off - wtoupper_off) / sizeof (__rw_upper_elm);
                               ^

"$(TOPDIR)/include/loc/_localedef.h", line 164: remark #4298-D: 64 bit migration: addition result could be truncated before cast to bigger sized type
          return (wmask_off - wtolower_off) / sizeof (__rw_lower_elm);
                            ^

"$(TOPDIR)/include/loc/_localedef.h", line 168: remark #4298-D: 64 bit migration: addition result could be truncated before cast to bigger sized type
          return charmap_off - codeset_off;
                             ^

"$(TOPDIR)/include/loc/_localedef.h", line 172: remark #4298-D: 64 bit migration: addition result could be truncated before cast to bigger sized type
          return wtoupper_off - charmap_off;
                              ^

"$(TOPDIR)/include/loc/_localedef.h", line 122: remark #4299-D: 64 bit migration: multiply result could be truncated before cast to bigger sized type
          return *(_RWSTD_ARRAY_ELM (wchar_t, wchar_off, off * 2));
                                                             ^

"$(TOPDIR)/include/loc/_localedef.h", line 128: remark #4298-D: 64 bit migration: addition result could be truncated before cast to bigger sized type
          return *(_RWSTD_ARRAY_ELM (wchar_t, wchar_off, off * 2 + 1));
                                                                 ^

"$(TOPDIR)/src/iso2022.cpp", line 764, procedure __rw::__rw_ksc5601_to_iso2022: warning #20200-D: Potential null pointer dereference through esc is detected (null definition:$(TOPDIR)/src/iso2022.cpp, line 677)

"$(TOPDIR)/src/iso2022.cpp", line 1541, procedure __rw::__rw_ucs4_to_interm: warning #20206-D: Out of bound access (In expression "&db_array[(long long)i]", array "db_array" [$(TOPDIR)/src/iso2022.cpp:1525] (type: struct _noname [6]) has element range [0 .. 5], reading element range [0 .. 11].)

"$(TOPDIR)/src/iso2022.cpp", line 1586, procedure __rw::__rw_ucs4_to_interm: warning #20206-D: Out of bound access (In expression "&db_array[(long long)i]", array "db_array" [$(TOPDIR)/src/iso2022.cpp:1525] (type: struct _noname [6]) has element range [0 .. 5], reading element range [0 .. 11].)

Comments

[Martin Sebor]

The warning's gone from nightly builds.

[Farid Zaripov]

Merged in 4.2.x branch thus: http://svn.apache.org/viewvc?view=rev&revision=648752