https://bugs.winehq.org/show_bug.cgi?id=37134
Bug ID: 37134 Summary: Clang Static Analyzer: Unreliable check Product: Wine Version: 1.7.22 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs@winehq.org Reporter: lukebenes@hotmail.com
Clang Static Analyzer identifies Unreliable check
File: dlls/advapi32/registry.c
Location: line 1209, column 13
Description: Array access (from variable 'str') results in a null pointer dereference
LSTATUS WINAPI RegSetValueExW(...., const BYTE *data, .... ) { ... if (data && ((ULONG_PTR)data >> 16) == 0) //Assuming pointer value is null return ERROR_NOACCESS;
if (count && is_string(type)) { LPCWSTR str = (LPCWSTR)data; //Clang: 'str' initialized to a null pointer value if (str[count / sizeof(WCHAR) - 1] && !str[count / sizeof(WCHAR)]) //Clang: Array access (from variable 'str') results in //a null pointer dereference count += sizeof(WCHAR); } ... }
If the null pointer data gets here, the program will go on executing until addressing the str variable.
Another similar issue:
File: dlls/comctl32/comctl32undoc.c
Location: line 964, column 12
Description: Array access (from variable 'lpDest') results in a null pointer dereference
https://bugs.winehq.org/show_bug.cgi?id=37134
--- Comment #1 from Austin English austinenglish@gmail.com --- This is your friendly reminder that there has been no bug activity for over a year. Is this still an issue in current (1.7.51 or newer) wine?
https://bugs.winehq.org/show_bug.cgi?id=37134
super_man@post.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |super_man@post.com
--- Comment #2 from super_man@post.com --- dlls/advapi32/registry.c
The code seems unchanged 1.7.52
https://bugs.winehq.org/show_bug.cgi?id=37134
Kirill K. Smirnov kirill.k.smirnov@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |kirill.k.smirnov@gmail.com
--- Comment #3 from Kirill K. Smirnov kirill.k.smirnov@gmail.com --- The bug in dlls/advapi32/registry.c has been fixed here:
commit ff0ee8f8a8faf35d148f00e4de2671feee051be7 Author: Hans Leidekker hans@codeweavers.com Date: Mon Jan 5 13:18:50 2015 +0100
advapi32: Return an error from RegSetValueExW if passed a NULL data pointer and non-zero size.
The similar bug in dlls/comctl32/comctl32undoc.c still present.