RegularExpression::compileSingle null pointer

["Stoddard, Nate (GE Healthcare)" <Na...@med.ge.com>]

Hello,

Our static analysis tool found an opportunity to dereference a null
pointer in the function RegularExpression::compileSingle(...).  This is
in the file xercesc/util/regx/RegularExpression.hpp.  The switch
statement sets an Op object pointer into the variable "ret" based on the
Token enumeration value; however, not all of the enumerations are
handled.  If the default path is taken, the ret variable is left to
NULL.  After the switch statement this NULL object will be dereferenced.


This is a private function, and a quick code search of 2.x only found
this function called when the Token was equal to T_EMPTY in the cpp
file.  Are there other calling paths I'm not seeing?  Is the 3.x code
using this function more?  I don't think the error case can be reached
in the 2.x code, but I wanted to get input from developers more
knowledgeable in the code base.


A code snippet with the compileSingle function...
  inline Op* RegularExpression::compileSingle(const Token* const token,
                                              Op* const next,
                                              const Token::tokType
tkType) {

      Op* ret = 0;

      switch (tkType) {
      case Token::T_DOT:
          ret = fOpFactory.createDotOp();
          break;
      case Token::T_CHAR:
          ret = fOpFactory.createCharOp(token->getChar());
          break;
      case Token::T_ANCHOR:
          ret = fOpFactory.createAnchorOp(token->getChar());
          break;
      case Token::T_RANGE:
      case Token::T_NRANGE:
          ret = fOpFactory.createRangeOp(token);
          break;
      case Token::T_EMPTY:
          ret = next;
          break;
      case Token::T_STRING:
          ret = fOpFactory.createStringOp(token->getString());
          break;
      case Token::T_BACKREFERENCE:
          ret =
fOpFactory.createBackReferenceOp(token->getReferenceNo());
          break;
      default:
          break;
      }

      if (tkType != Token::T_EMPTY)
          ret->setNextOp(next);

      return ret;
  }

-Nate


---------------------------------------------------------------------
To unsubscribe, e-mail: c-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: c-dev-help@xerces.apache.org

Re: RegularExpression::compileSingle null pointer

[Alberto Massari <am...@datadirect.com>]

Hi Nate,
by looking at the code for 3.x, the compileSingle is called only when 
the token type is one of 8 values, the same values listed in the switch 
inside the function. So you can be assured that the "default" branch 
will never be taken during execution.
Anyway I am merging the two functions to avoid future misalignments.

Alberto

Stoddard, Nate (GE Healthcare) wrote:
> Hello,
>
> Our static analysis tool found an opportunity to dereference a null
> pointer in the function RegularExpression::compileSingle(...).  This is
> in the file xercesc/util/regx/RegularExpression.hpp.  The switch
> statement sets an Op object pointer into the variable "ret" based on the
> Token enumeration value; however, not all of the enumerations are
> handled.  If the default path is taken, the ret variable is left to
> NULL.  After the switch statement this NULL object will be dereferenced.
>
>
> This is a private function, and a quick code search of 2.x only found
> this function called when the Token was equal to T_EMPTY in the cpp
> file.  Are there other calling paths I'm not seeing?  Is the 3.x code
> using this function more?  I don't think the error case can be reached
> in the 2.x code, but I wanted to get input from developers more
> knowledgeable in the code base.
>
>
> A code snippet with the compileSingle function...
>   inline Op* RegularExpression::compileSingle(const Token* const token,
>                                               Op* const next,
>                                               const Token::tokType
> tkType) {
>
>       Op* ret = 0;
>
>       switch (tkType) {
>       case Token::T_DOT:
>           ret = fOpFactory.createDotOp();
>           break;
>       case Token::T_CHAR:
>           ret = fOpFactory.createCharOp(token->getChar());
>           break;
>       case Token::T_ANCHOR:
>           ret = fOpFactory.createAnchorOp(token->getChar());
>           break;
>       case Token::T_RANGE:
>       case Token::T_NRANGE:
>           ret = fOpFactory.createRangeOp(token);
>           break;
>       case Token::T_EMPTY:
>           ret = next;
>           break;
>       case Token::T_STRING:
>           ret = fOpFactory.createStringOp(token->getString());
>           break;
>       case Token::T_BACKREFERENCE:
>           ret =
> fOpFactory.createBackReferenceOp(token->getReferenceNo());
>           break;
>       default:
>           break;
>       }
>
>       if (tkType != Token::T_EMPTY)
>           ret->setNextOp(next);
>
>       return ret;
>   }
>
> -Nate
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: c-dev-unsubscribe@xerces.apache.org
> For additional commands, e-mail: c-dev-help@xerces.apache.org
>
>
>   


---------------------------------------------------------------------
To unsubscribe, e-mail: c-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: c-dev-help@xerces.apache.org