You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@iotdb.apache.org by GitBox <gi...@apache.org> on 2021/07/01 07:39:38 UTC
[GitHub] [iotdb] containerAnalyzer opened a new issue #3481: One NPE in LogicalChecker.java
containerAnalyzer opened a new issue #3481:
URL: https://github.com/apache/iotdb/issues/3481
Hello,
Our static analyzer found a following potential NPE. We have checked the feasibility of this execution trace. It is necessary to defend this vulnerability to improve the code quality.
1. Function add executes and pathsCache contains null value
https://github.com/apache/iotdb/blob/8b1ee93c51932d72cb7fd7c5268f40f7b3a74f25/server/src/main/java/org/apache/iotdb/db/qp/logical/crud/SelectOperator.java#L107
2. Program reaches the return point, and returns pathsCache, which contains null value
https://github.com/apache/iotdb/blob/8b1ee93c51932d72cb7fd7c5268f40f7b3a74f25/server/src/main/java/org/apache/iotdb/db/qp/logical/crud/SelectOperator.java#L111
3. Function next executes and stores the return value to path (path can be null)
https://github.com/apache/iotdb/blob/8b1ee93c51932d72cb7fd7c5268f40f7b3a74f25/server/src/main/java/org/apache/iotdb/db/qp/strategy/LogicalChecker.java#L96
4. path is passed as the this pointer to function getDevice (path can be null), which will leak to null pointer dereference
https://github.com/apache/iotdb/blob/8b1ee93c51932d72cb7fd7c5268f40f7b3a74f25/server/src/main/java/org/apache/iotdb/db/qp/strategy/LogicalChecker.java#L97
Commit: 8b1ee93c51932d72cb7fd7c5268f40f7b3a74f25
ContainerAnalyzer
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] HTHou closed issue #3481: One NPE in LogicalChecker.java
Posted by GitBox <gi...@apache.org>.
HTHou closed issue #3481:
URL: https://github.com/apache/iotdb/issues/3481
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] SteveYurongSu commented on issue #3481: One NPE in LogicalChecker.java
Posted by GitBox <gi...@apache.org>.
SteveYurongSu commented on issue #3481:
URL: https://github.com/apache/iotdb/issues/3481#issuecomment-873364490
I'd like to call this a code smell, because the NPE will not be triggered at any time.
The method `getDevice` is called in another method `checkAlignByDevice`, and the method `checkAlignByDevice` is called only if the system is executing a align-by-device query.
If a query is a align-by-device query, the branch you mentoned at 1 (`pathsCache.add(null); `) will not be accessed, so there will be no NPEs.
I wll fix the code smell.
Thanks for the discovery!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [iotdb] github-actions[bot] commented on issue #3481: One NPE in LogicalChecker.java
Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on issue #3481:
URL: https://github.com/apache/iotdb/issues/3481#issuecomment-872004879
Hi, this is your first issue in IoTDB project. Thanks for your report. Welcome to join the community!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@iotdb.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org