diff options
| author | Luc Van Oostenryck <luc.vanoostenryck@gmail.com> | 2020-10-16 21:56:14 +0200 |
|---|---|---|
| committer | Luc Van Oostenryck <luc.vanoostenryck@gmail.com> | 2020-10-16 22:40:39 +0200 |
| commit | 5111ba3b608513b1bb8db2c381abfad7340be242 (patch) | |
| tree | b44bff643113d79f24b3113ad992dad1994dd4e0 | |
| parent | 8e2d387944f09c835c3916caa0925fcbacddf243 (diff) | |
| download | sparse-5111ba3b608513b1bb8db2c381abfad7340be242.tar.gz | |
fix null pointer deref on return expression with invalid type
If the evaluation of the return expression failed a following test
can dereference the pointer holding the expression's type ...
which is null. Bad.
Fix this by adding the missing null pointer test.
Fixes: 3bc32d46494c404df7905fceaca9156830ff97f1
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
| -rw-r--r-- | evaluate.c | 2 | ||||
| -rw-r--r-- | validation/crash-undef-in-parens.c | 9 |
2 files changed, 10 insertions, 1 deletions
@@ -3611,7 +3611,7 @@ static struct symbol *evaluate_return_expression(struct statement *stmt) fntype = current_fn->ctype.base_type; rettype = fntype->ctype.base_type; if (!rettype || rettype == &void_ctype) { - if (expr && !is_void_type(expr->ctype)) + if (expr && expr->ctype && !is_void_type(expr->ctype)) expression_error(expr, "return expression in %s function", rettype?"void":"typeless"); if (expr && Wreturn_void) warning(stmt->pos, "returning void-valued expression"); diff --git a/validation/crash-undef-in-parens.c b/validation/crash-undef-in-parens.c new file mode 100644 index 00000000..5f05f88a --- /dev/null +++ b/validation/crash-undef-in-parens.c @@ -0,0 +1,9 @@ +void foo(void) { return (UNDEF_STUFF_IN_PARENS); } + +/* + * check-name: crash-undef-in-parens + * + * check-error-start +crash-undef-in-parens.c:1:26: error: undefined identifier 'UNDEF_STUFF_IN_PARENS' + * check-error-end + */ |