Bug Summary

File:stubs/atom.c
Location:line 94, column 13
Description:Array access (from variable 'hashTable') results in a null pointer dereference

Annotated Source Code

1/*
2
3 Copyright 1990, 1994, 1998 The Open Group
4
5 Permission to use, copy, modify, distribute, and sell this software and its
6 documentation for any purpose is hereby granted without fee, provided that
7 the above copyright notice appear in all copies and that both that
8 copyright notice and this permission notice appear in supporting
9 documentation.
10
11 The above copyright notice and this permission notice shall be included in
12 all copies or substantial portions of the Software.
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17 OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
18 AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
19 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20
21 Except as contained in this notice, the name of The Open Group shall not be
22 used in advertising or otherwise to promote the sale, use or other dealings
23 in this Software without prior written authorization from The Open Group.
24
25*/
26
27/*
28 * Author: Keith Packard, MIT X Consortium
29 */
30
31/* lame atom replacement routines for font applications */
32
33#ifdef HAVE_CONFIG_H1
34#include <config.h>
35#endif
36#include "libxfontint.h"
37#include <X11/fonts/fontmisc.h>
38
39typedef struct _AtomList {
40 char *name;
41 int len;
42 int hash;
43 Atom atom;
44} AtomListRec, *AtomListPtr;
45
46static AtomListPtr *hashTable;
47
48static int hashSize, hashUsed;
49static int hashMask;
50static int rehash;
51
52static AtomListPtr *reverseMap;
53static int reverseMapSize;
54static Atom lastAtom;
55
56static int
57Hash(const char *string, int len)
58{
59 int h;
60
61 h = 0;
62 while (len--)
63 h = (h << 3) ^ *string++;
64 if (h < 0)
65 return -h;
66 return h;
67}
68
69static int
70ResizeHashTable(void)
71{
72 int newHashSize;
73 int newHashMask;
74 AtomListPtr *newHashTable;
75 int i;
76 int h;
77 int newRehash;
78 int r;
79
80 if (hashSize == 0)
9
Assuming 'hashSize' is not equal to 0
10
Taking false branch
81 newHashSize = 1024;
82 else
83 newHashSize = hashSize * 2;
84 newHashTable = calloc(newHashSize, sizeof(AtomListPtr));
85 if (!newHashTable) {
11
Assuming 'newHashTable' is non-null
12
Taking false branch
86 fprintf(stderr__stderrp, "ResizeHashTable(): Error: Couldn't allocate"
87 " newHashTable (%ld)\n",
88 newHashSize * (unsigned long) sizeof(AtomListPtr));
89 return FALSE0;
90 }
91 newHashMask = newHashSize - 1;
92 newRehash = (newHashMask - 2);
93 for (i = 0; i < hashSize; i++) {
13
Assuming 'i' is < 'hashSize'
14
Loop condition is true. Entering loop body
94 if (hashTable[i]) {
15
Array access (from variable 'hashTable') results in a null pointer dereference
95 h = (hashTable[i]->hash) & newHashMask;
96 if (newHashTable[h]) {
97 r = hashTable[i]->hash % newRehash | 1;
98 do {
99 h += r;
100 if (h >= newHashSize)
101 h -= newHashSize;
102 } while (newHashTable[h]);
103 }
104 newHashTable[h] = hashTable[i];
105 }
106 }
107 free(hashTable);
108 hashTable = newHashTable;
109 hashSize = newHashSize;
110 hashMask = newHashMask;
111 rehash = newRehash;
112 return TRUE1;
113}
114
115static int
116ResizeReverseMap(void)
117{
118 AtomListPtr *newMap;
119 int newMapSize;
120
121 if (reverseMapSize == 0)
122 newMapSize = 1000;
123 else
124 newMapSize = reverseMapSize * 2;
125 newMap = realloc(reverseMap, newMapSize * sizeof(AtomListPtr));
126 if (newMap == NULL((void *)0)) {
127 fprintf(stderr__stderrp, "ResizeReverseMap(): Error: Couldn't reallocate"
128 " reverseMap (%ld)\n",
129 newMapSize * (unsigned long) sizeof(AtomListPtr));
130 return FALSE0;
131 }
132 reverseMap = newMap;
133 reverseMapSize = newMapSize;
134 return TRUE1;
135}
136
137static int
138NameEqual(const char *a, const char *b, int l)
139{
140 while (l--)
141 if (*a++ != *b++)
142 return FALSE0;
143 return TRUE1;
144}
145
146Atom
147__libxfont_internal__MakeAtom(const char *string, unsigned len, int makeit)
148{
149 AtomListPtr a;
150 int hash;
151 int h = 0;
152 int r;
153
154 hash = Hash(string, len);
155 if (hashTable) {
1
Assuming 'hashTable' is null
2
Taking false branch
156 h = hash & hashMask;
157 if (hashTable[h]) {
158 if (hashTable[h]->hash == hash && hashTable[h]->len == len &&
159 NameEqual(hashTable[h]->name, string, len)) {
160 return hashTable[h]->atom;
161 }
162 r = (hash % rehash) | 1;
163 for (;;) {
164 h += r;
165 if (h >= hashSize)
166 h -= hashSize;
167 if (!hashTable[h])
168 break;
169 if (hashTable[h]->hash == hash && hashTable[h]->len == len &&
170 NameEqual(hashTable[h]->name, string, len)) {
171 return hashTable[h]->atom;
172 }
173 }
174 }
175 }
176 if (!makeit)
3
Assuming 'makeit' is not equal to 0
4
Taking false branch
177 return None0L;
178 a = malloc(sizeof(AtomListRec) + len + 1);
179 if (a == NULL((void *)0)) {
5
Assuming 'a' is not equal to null
6
Taking false branch
180 fprintf(stderr__stderrp, "MakeAtom(): Error: Couldn't allocate AtomListRec"
181 " (%ld)\n", (unsigned long) sizeof(AtomListRec) + len + 1);
182 return None0L;
183 }
184 a->name = (char *) (a + 1);
185 a->len = len;
186 strncpy(a->name, string, len)__builtin___strncpy_chk (a->name, string, len, __builtin_object_size
(a->name, 2 > 1 ? 1 : 0))
;
187 a->name[len] = '\0';
188 a->atom = ++lastAtom;
189 a->hash = hash;
190 if (hashUsed >= hashSize / 2) {
7
Taking true branch
191 ResizeHashTable();
8
Calling 'ResizeHashTable'
192 h = hash & hashMask;
193 if (hashTable[h]) {
194 r = (hash % rehash) | 1;
195 do {
196 h += r;
197 if (h >= hashSize)
198 h -= hashSize;
199 } while (hashTable[h]);
200 }
201 }
202 hashTable[h] = a;
203 hashUsed++;
204 if (reverseMapSize <= a->atom) {
205 if (!ResizeReverseMap())
206 return None0L;
207 }
208 reverseMap[a->atom] = a;
209 return a->atom;
210}
211
212int
213__libxfont_internal__ValidAtom(Atom atom)
214{
215 return (atom != None0L) && (atom <= lastAtom);
216}
217
218const char *
219__libxfont_internal__NameForAtom(Atom atom)
220{
221 if (atom != None0L && atom <= lastAtom)
222 return reverseMap[atom]->name;
223 return NULL((void *)0);
224}