You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2013/07/14 09:46:22 UTC
[Bug 55263] New: Using uninitialized variable: a potential bug
discovered by static analysis tool
https://issues.apache.org/bugzilla/show_bug.cgi?id=55263
Bug ID: 55263
Summary: Using uninitialized variable: a potential bug
discovered by static analysis tool
Product: Apache httpd-2
Version: 2.4.4
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_dav
Assignee: bugs@httpd.apache.org
Reporter: shq-king@163.com
Hi, I`m developing a static analysis tool at university.
Recently I applied my tool to httpd-2.4.4 and found a potential uninitialized
variable bug.
I have manually checked this bug several times. As I`m not familiar with the
source code of httpd, this bug may be one false positive. Sorry for the
trouble. I`m still looking forward to your replies!
File Name: /module/dav/main/mod_dav.c
Function Name: dav_method_lock()
Buggy Code:
3089 if ((err = dav_validate_request(r, resource, depth, NULL,
&multi_response,
(resource_state == DAV_RESOURCE_NULL
? DAV_VALIDATE_PARENT
: DAV_VALIDATE_RESOURCE)
| (new_lock_request ? lock->scope : 0)
| DAV_VALIDATE_ADD_LD,
lockdb)) != OK)
Description:
The variable "lock" is initialized at line 3070 by the function
"dav_lock_parse_lockinfo()", under the check "doc != NULL" at line 3069.
However, if this check fails, i.e. doc == NULL, "lock" is uninitialized
afterwards. So,it is very dangerous when reading "lock->scope" in 3089.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 55263] Using uninitialized variable: a potential bug discovered
by static analysis tool
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55263
Christophe JAILLET <ch...@wanadoo.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #1 from Christophe JAILLET <ch...@wanadoo.fr> ---
Hi,
first of all, thanks for your report. Static analyzers can be great tools to
spot corner cases bugs.
The use of 'lock->scope' is guarded by 'new_lock_request' which is set only if
'dav_lock_parse_lockinfo' succeeded.
(new_lock_request ? lock->scope : 0)
I've checked quickly the code and, regarding the use of lock, it looks good to
me.
I'm closing as invalid.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org