Bug Summary

File:src/TextToStr.c
Location:line 104, column 20
Description:Potential leak of memory pointed to by 'cp'

Annotated Source Code

1/*
2
3Copyright 1989, 1998 The Open Group
4
5Permission to use, copy, modify, distribute, and sell this software and its
6documentation for any purpose is hereby granted without fee, provided that
7the above copyright notice appear in all copies and that both that
8copyright notice and this permission notice appear in supporting
9documentation.
10
11The above copyright notice and this permission notice shall be included in
12all copies or substantial portions of the Software.
13
14THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
18AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
19CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20
21Except as contained in this notice, the name of The Open Group shall not be
22used in advertising or otherwise to promote the sale, use or other dealings
23in this Software without prior written authorization from The Open Group.
24
25*/
26
27
28#ifdef HAVE_CONFIG_H1
29#include <config.h>
30#endif
31#include <X11/Xlibint.h>
32#include <X11/Xatom.h>
33#include <X11/Xutil.h>
34
35
36/*
37 * XTextPropertyToStringList - set list and count to contain data stored in
38 * null-separated STRING property.
39 */
40
41Statusint XTextPropertyToStringList (
42 XTextProperty *tp,
43 char ***list_return,
44 int *count_return)
45{
46 char **list; /* return value */
47 int nelements; /* return value */
48 register char *cp; /* temp variable */
49 char *start; /* start of thing to copy */
50 int i, j; /* iterator variables */
51 int datalen = (int) tp->nitems; /* for convenience */
52
53 /*
54 * make sure we understand how to do it
55 */
56 if (tp->encoding != XA_STRING((Atom) 31) || tp->format != 8) return False0;
1
Taking false branch
57
58 if (datalen == 0) {
2
Assuming 'datalen' is not equal to 0
3
Taking false branch
59 *list_return = NULL((void*)0);
60 *count_return = 0;
61 return True1;
62 }
63
64 /*
65 * walk the list to figure out how many elements there are
66 */
67 nelements = 1; /* since null-separated */
68 for (cp = (char *) tp->value, i = datalen; i > 0; cp++, i--) {
4
Loop condition is true. Entering loop body
6
Assuming 'i' is <= 0
7
Loop condition is false. Execution continues on line 75
69 if (*cp == '\0') nelements++;
5
Taking false branch
70 }
71
72 /*
73 * allocate list and duplicate
74 */
75 list = Xmalloc (nelements * sizeof (char *))malloc(((nelements * sizeof (char *)) == 0 ? 1 : (nelements *
sizeof (char *))))
;
76 if (!list) return False0;
8
Assuming 'list' is non-null
9
Taking false branch
77
78 start = Xmalloc ((datalen + 1) * sizeof (char))malloc((((datalen + 1) * sizeof (char)) == 0 ? 1 : ((datalen +
1) * sizeof (char))))
; /* for <NUL> */
10
Within the expansion of the macro 'Xmalloc':
a
Memory is allocated
79 if (!start) {
11
Assuming 'start' is non-null
12
Taking false branch
80 Xfree (list)free((list));
81 return False0;
82 }
83
84 /*
85 * copy data
86 */
87 memcpy (start, (char *) tp->value, tp->nitems)__builtin___memcpy_chk (start, (char *) tp->value, tp->
nitems, __builtin_object_size (start, 0))
;
88 start[datalen] = '\0';
89
90 /*
91 * walk down list setting value
92 */
93 for (cp = start, i = datalen + 1, j = 0; i > 0; cp++, i--) {
13
Loop condition is false. Execution continues on line 104
94 if (*cp == '\0') {
95 list[j] = start;
96 start = (cp + 1);
97 j++;
98 }
99 }
100
101 /*
102 * append final null pointer and then return data
103 */
104 *list_return = list;
14
Potential leak of memory pointed to by 'cp'
105 *count_return = nelements;
106 return True1;
107}
108
109
110void XFreeStringList (char **list)
111{
112 if (list) {
113 if (list[0]) Xfree (list[0])free((list[0]));
114 Xfree (list)free((list));
115 list = NULL((void*)0);
116 }
117}
118