antirez / antirez/rax

Potential null pointer dereferences after calling raxStackPop()

Open
#34 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
1.3k
Forks
177
PR merge metrics
No merged PRs in 30d

Description

This is just one example that I'm not sure I fixed correctly (and that's why it's not a PR yet).

```patch
diff --git a/rax.c b/rax.c
index 7dcf045..9a8fcda 100644
--- a/rax.c
+++ b/rax.c
@@ -1056,7 +1056,7 @@ int raxRemove(rax *rax, unsigned char *s, size_t len, void **old) {
h = raxStackPop(&ts);
/* If this node has more then one child, or actually holds
* a key, stop here. */
- if (h->iskey || (!h->iscompr && h->size != 1)) break;
+ if (h != NULL && (h->iskey || (!h->iscompr && h->size != 1))) break;
}
if (child) {
debugf("Unlinking child %p from parent %p\n",
```

Other occurrences appear in:
```
10. rax.c:1468: error: NULL_DEREFERENCE
pointer `it->node` last assigned on line 1461 could be null and is dereferenced at line 1468, column 21.

11. rax.c:1608: error: NULL_DEREFERENCE
pointer `it->node` last assigned on line 1517 could be null and is dereferenced at line 1608, column 26.

12. rax.c:1665: error: NULL_DEREFERENCE
pointer `it->node` last assigned on line 1517 could be null and is dereferenced at line 1665, column 17.

13. rax.c:1755: error: NULL_DEREFERENCE
pointer `n` last assigned on line 1754 could be null and is dereferenced at line 1755, column 25.
```

These may well be false positives found by [infer](https://fbinfer.com/) or simply a rare edge case. If it's the latter, we should address it somehow.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.