Bug Summary

File:jdk/src/java.desktop/share/native/libmlib_image/mlib_ImageConv_32nw.c
Warning:line 637, column 54
Array access (from variable 'sp') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name mlib_ImageConv_32nw.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib/llvm-10/lib/clang/10.0.0 -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base/linux -I /home/daniel/Projects/java/jdk/src/java.base/share/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/libjava -I /home/daniel/Projects/java/jdk/src/hotspot/share/include -I /home/daniel/Projects/java/jdk/src/hotspot/os/posix/include -D LIBC=gnu -D _GNU_SOURCE -D _REENTRANT -D _LARGEFILE64_SOURCE -D LINUX -D DEBUG -D _LITTLE_ENDIAN -D ARCH="amd64" -D amd64 -D _LP64=1 -D __USE_J2D_NAMES -D __MEDIALIB_OLD_NAMES -D MLIB_NO_LIBSUNMATH -D MLIB_OS64BIT -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libmlib_image -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/common/awt/medialib -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/headers/java.desktop -D _FORTIFY_SOURCE=2 -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-10/lib/clang/10.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -Wno-unused -Wno-unused-function -std=c99 -fdebug-compilation-dir /home/daniel/Projects/java/jdk/make -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -stack-protector 1 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -o /home/daniel/Projects/java/scan/2021-12-21-193737-8510-1 -x c /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libmlib_image/mlib_ImageConv_32nw.c
1/*
2 * Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26
27/*
28 * FUNCTION
29 * Internal functions for mlib_ImageConv* on S32 type and
30 * MLIB_EDGE_DST_NO_WRITE mask
31 *
32 */
33
34#include "mlib_image.h"
35#include "mlib_ImageConv.h"
36
37/***************************************************************/
38#define CACHE_SIZE(64*1024) (64*1024)
39
40/***************************************************************/
41#define CONV_FUNC(KERN)mlib_convKERNnw_s32 mlib_conv##KERN##nw_s32
42
43/***************************************************************/
44#ifndef MLIB_USE_FTOI_CLAMPING
45
46#define CLAMP_S32(dst, src)if (src > (mlib_d64)2147483647) src = (mlib_d64)2147483647
; if (src < (mlib_d64)(-2147483647 -1)) src = (mlib_d64)(-
2147483647 -1); dst = (mlib_s32)src \
47 if (src > (mlib_d64)MLIB_S32_MAX2147483647) src = (mlib_d64)MLIB_S32_MAX2147483647; \
48 if (src < (mlib_d64)MLIB_S32_MIN(-2147483647 -1)) src = (mlib_d64)MLIB_S32_MIN(-2147483647 -1); \
49 dst = (mlib_s32)src
50
51#else
52
53#define CLAMP_S32(dst, src)if (src > (mlib_d64)2147483647) src = (mlib_d64)2147483647
; if (src < (mlib_d64)(-2147483647 -1)) src = (mlib_d64)(-
2147483647 -1); dst = (mlib_s32)src dst = (mlib_s32)(src)
54
55#endif /* MLIB_USE_FTOI_CLAMPING */
56
57/***************************************************************/
58#define GET_SRC_DST_PARAMETERS(type)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type)
; mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); type
* adr_src = mlib_ImageGetData(src); type* adr_dst = mlib_ImageGetData
(dst); mlib_s32 chan1 = mlib_ImageGetChannels(src) \
59 mlib_s32 hgt = mlib_ImageGetHeight(src); \
60 mlib_s32 wid = mlib_ImageGetWidth(src); \
61 mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type); \
62 mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); \
63 type* adr_src = mlib_ImageGetData(src); \
64 type* adr_dst = mlib_ImageGetData(dst); \
65 mlib_s32 chan1 = mlib_ImageGetChannels(src)
66/* mlib_s32 chan2 = chan1 + chan1 */
67
68/***************************************************************/
69#define DEF_VARS(type)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type)
; mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); type
* adr_src = mlib_ImageGetData(src); type* adr_dst = mlib_ImageGetData
(dst); mlib_s32 chan1 = mlib_ImageGetChannels(src); type *sl,
*sp, *sl1, *dl, *dp; mlib_d64 *pbuff = buff, *buff0, *buff1,
*buff2, *buffT; mlib_s32 i, j, c; mlib_d64 scalef, d0, d1 \
70 GET_SRC_DST_PARAMETERS(type)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type)
; mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); type
* adr_src = mlib_ImageGetData(src); type* adr_dst = mlib_ImageGetData
(dst); mlib_s32 chan1 = mlib_ImageGetChannels(src); \
71 type *sl, *sp, *sl1, *dl, *dp; \
72 mlib_d64 *pbuff = buff, *buff0, *buff1, *buff2, *buffT; \
73 mlib_s32 i, j, c; \
74 mlib_d64 scalef, d0, d1
75
76/***************************************************************/
77#define DEF_VARS_MxN(type)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type)
; mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); type
* adr_src = mlib_ImageGetData(src); type* adr_dst = mlib_ImageGetData
(dst); mlib_s32 chan1 = mlib_ImageGetChannels(src); type *sl,
*sp = ((void*)0), *dl, *dp = ((void*)0); mlib_d64 *pbuff = buff
; mlib_s32 i, j, c \
78 GET_SRC_DST_PARAMETERS(type)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(type)
; mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(type); type
* adr_src = mlib_ImageGetData(src); type* adr_dst = mlib_ImageGetData
(dst); mlib_s32 chan1 = mlib_ImageGetChannels(src); \
79 type *sl, *sp = NULL((void*)0), *dl, *dp = NULL((void*)0); \
80 mlib_d64 *pbuff = buff; \
81 mlib_s32 i, j, c
82
83/***************************************************************/
84#define FTYPEmlib_d64 mlib_d64
85#define DTYPEmlib_s32 mlib_s32
86
87#define BUFF_SIZE1500 1600
88
89static mlib_status mlib_ImageConv1xN(mlib_image *dst,
90 const mlib_image *src,
91 const mlib_d64 *k,
92 mlib_s32 n,
93 mlib_s32 dn,
94 mlib_s32 cmask)
95{
96 FTYPEmlib_d64 buff[BUFF_SIZE1500];
97 mlib_s32 off, kh;
98 const FTYPEmlib_d64 *pk;
99 FTYPEmlib_d64 k0, k1, k2, k3, d0, d1;
100 FTYPEmlib_d64 p0, p1, p2, p3, p4;
101 DTYPEmlib_s32 *sl_c, *dl_c, *sl0;
102 mlib_s32 l, hsize, max_hsize;
103 DEF_VARS_MxN(DTYPE)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(mlib_s32
); mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(mlib_s32)
; mlib_s32* adr_src = mlib_ImageGetData(src); mlib_s32* adr_dst
= mlib_ImageGetData(dst); mlib_s32 chan1 = mlib_ImageGetChannels
(src); mlib_s32 *sl, *sp = ((void*)0), *dl, *dp = ((void*)0);
mlib_d64 *pbuff = buff; mlib_s32 i, j, c;
104
105 hgt -= (n - 1);
106 adr_dst += dn*dll;
107
108 max_hsize = (CACHE_SIZE(64*1024)/sizeof(DTYPEmlib_s32))/sll;
109
110 if (!max_hsize) max_hsize = 1;
111
112 if (max_hsize > BUFF_SIZE1500) {
113 pbuff = mlib_malloc(sizeof(FTYPEmlib_d64)*max_hsize);
114 }
115
116 sl_c = adr_src;
117 dl_c = adr_dst;
118
119 for (l = 0; l < hgt; l += hsize) {
120 hsize = hgt - l;
121
122 if (hsize > max_hsize) hsize = max_hsize;
123
124 for (c = 0; c < chan1; c++) {
125 if (!(cmask & (1 << (chan1 - 1 - c)))) continue;
126
127 sl = sl_c + c;
128 dl = dl_c + c;
129
130 for (j = 0; j < hsize; j++) pbuff[j] = 0.0;
131
132 for (i = 0; i < wid; i++) {
133 sl0 = sl;
134
135 for (off = 0; off < (n - 4); off += 4) {
136 pk = k + off;
137 sp = sl0;
138
139 k0 = pk[0]; k1 = pk[1]; k2 = pk[2]; k3 = pk[3];
140 p2 = sp[0]; p3 = sp[sll]; p4 = sp[2*sll];
141 sp += 3*sll;
142
143 for (j = 0; j < hsize; j += 2) {
144 p0 = p2; p1 = p3; p2 = p4;
145 p3 = sp[0];
146 p4 = sp[sll];
147
148 pbuff[j ] += p0*k0 + p1*k1 + p2*k2 + p3*k3;
149 pbuff[j + 1] += p1*k0 + p2*k1 + p3*k2 + p4*k3;
150
151 sp += 2*sll;
152 }
153
154 sl0 += 4*sll;
155 }
156
157 pk = k + off;
158 sp = sl0;
159
160 k0 = pk[0]; k1 = pk[1]; k2 = pk[2]; k3 = pk[3];
161 p2 = sp[0]; p3 = sp[sll]; p4 = sp[2*sll];
162
163 dp = dl;
164 kh = n - off;
165
166 if (kh == 4) {
167 sp += 3*sll;
168
169 for (j = 0; j <= (hsize - 2); j += 2) {
170 p0 = p2; p1 = p3; p2 = p4;
171 p3 = sp[0];
172 p4 = sp[sll];
173
174 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + pbuff[j];
175 d1 = p1*k0 + p2*k1 + p3*k2 + p4*k3 + pbuff[j + 1];
176 CLAMP_S32(dp[0 ], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0 ] = (mlib_s32)d0;
177 CLAMP_S32(dp[dll], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[dll] = (mlib_s32)d1;
178
179 pbuff[j] = 0;
180 pbuff[j + 1] = 0;
181
182 sp += 2*sll;
183 dp += 2*dll;
184 }
185
186 if (j < hsize) {
187 p0 = p2; p1 = p3; p2 = p4;
188 p3 = sp[0];
189
190 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + pbuff[j];
191 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
192
193 pbuff[j] = 0;
194 }
195
196 } else if (kh == 3) {
197 sp += 2*sll;
198
199 for (j = 0; j <= (hsize - 2); j += 2) {
200 p0 = p2; p1 = p3;
201 p2 = sp[0];
202 p3 = sp[sll];
203
204 d0 = p0*k0 + p1*k1 + p2*k2 + pbuff[j];
205 d1 = p1*k0 + p2*k1 + p3*k2 + pbuff[j + 1];
206 CLAMP_S32(dp[0 ], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0 ] = (mlib_s32)d0;
207 CLAMP_S32(dp[dll], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[dll] = (mlib_s32)d1;
208
209 pbuff[j] = 0;
210 pbuff[j + 1] = 0;
211
212 sp += 2*sll;
213 dp += 2*dll;
214 }
215
216 if (j < hsize) {
217 p0 = p2; p1 = p3;
218 p2 = sp[0];
219
220 d0 = p0*k0 + p1*k1 + p2*k2 + pbuff[j];
221 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
222
223 pbuff[j] = 0;
224 }
225
226 } else if (kh == 2) {
227 sp += sll;
228
229 for (j = 0; j <= (hsize - 2); j += 2) {
230 p0 = p2;
231 p1 = sp[0];
232 p2 = sp[sll];
233
234 d0 = p0*k0 + p1*k1 + pbuff[j];
235 d1 = p1*k0 + p2*k1 + pbuff[j + 1];
236 CLAMP_S32(dp[0 ], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0 ] = (mlib_s32)d0;
237 CLAMP_S32(dp[dll], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[dll] = (mlib_s32)d1;
238
239 pbuff[j] = 0;
240 pbuff[j + 1] = 0;
241
242 sp += 2*sll;
243 dp += 2*dll;
244 }
245
246 if (j < hsize) {
247 p0 = p2;
248 p1 = sp[0];
249
250 d0 = p0*k0 + p1*k1 + pbuff[j];
251 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
252
253 pbuff[j] = 0;
254 }
255
256 } else /* if (kh == 1) */ {
257 for (j = 0; j < hsize; j++) {
258 p0 = sp[0];
259
260 d0 = p0*k0 + pbuff[j];
261 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
262
263 pbuff[j] = 0;
264
265 sp += sll;
266 dp += dll;
267 }
268 }
269
270 sl += chan1;
271 dl += chan1;
272 }
273 }
274
275 sl_c += max_hsize*sll;
276 dl_c += max_hsize*dll;
277 }
278
279 if (pbuff != buff) mlib_free(pbuff);
280
281 return MLIB_SUCCESS;
282}
283
284/***************************************************************/
285#define MAX_KER7 7
286
287#define MAX_N15 15
288
289#undef BUFF_SIZE1500
290#define BUFF_SIZE1500 1500
291
292mlib_status CONV_FUNC(MxN)mlib_convMxNnw_s32(mlib_image *dst,
293 const mlib_image *src,
294 const mlib_s32 *kernel,
295 mlib_s32 m,
296 mlib_s32 n,
297 mlib_s32 dm,
298 mlib_s32 dn,
299 mlib_s32 scale,
300 mlib_s32 cmask)
301{
302 mlib_d64 buff[BUFF_SIZE1500], *buffs_arr[2*(MAX_N15 + 1)];
303 mlib_d64 **buffs = buffs_arr, *buffd;
304 mlib_d64 akernel[256], *k = akernel, fscale = 1.0;
305 mlib_s32 l, off, kw, bsize, buff_ind, mn;
306 mlib_d64 d0, d1;
307 mlib_d64 k0, k1, k2, k3, k4, k5, k6;
308 mlib_d64 p0, p1, p2, p3, p4, p5, p6, p7;
309 DEF_VARS_MxN(mlib_s32)mlib_s32 hgt = mlib_ImageGetHeight(src); mlib_s32 wid = mlib_ImageGetWidth
(src); mlib_s32 sll = mlib_ImageGetStride(src) / sizeof(mlib_s32
); mlib_s32 dll = mlib_ImageGetStride(dst) / sizeof(mlib_s32)
; mlib_s32* adr_src = mlib_ImageGetData(src); mlib_s32* adr_dst
= mlib_ImageGetData(dst); mlib_s32 chan1 = mlib_ImageGetChannels
(src); mlib_s32 *sl, *sp = ((void*)0), *dl, *dp = ((void*)0);
mlib_d64 *pbuff = buff; mlib_s32 i, j, c;
1
'sp' initialized to a null pointer value
→
310 mlib_s32 chan2 = chan1 + chan1;
311
312 mlib_status status = MLIB_SUCCESS;
313
314 if (scale > 30) {
2
←
Assuming 'scale' is <= 30
→
3
←
Taking false branch
→
315 fscale *= 1.0/(1 << 30);
316 scale -= 30;
317 }
318
319 fscale /= (1 << scale);
320
321 mn = m*n;
322
323 if (mn > 256) {
4
←
Assuming 'mn' is <= 256
→
5
←
Taking false branch
→
324 k = mlib_malloc(mn*sizeof(mlib_d64));
325
326 if (k == NULL((void*)0)) return MLIB_FAILURE;
327 }
328
329 for (i = 0; i < mn; i++) {
6
←
Assuming 'i' is >= 'mn'
→
7
←
Loop condition is false. Execution continues on line 333
→
330 k[i] = kernel[i]*fscale;
331 }
332
333 if (m == 1) {
8
←
Assuming 'm' is not equal to 1
→
9
←
Taking false branch
→
334 status = mlib_ImageConv1xN(dst, src, k, n, dn, cmask);
335 FREE_AND_RETURN_STATUSif (pbuff != buff) mlib_free(pbuff); if (k != akernel) mlib_free
(k); return status;
336 }
337
338 bsize = (n + 2)*wid;
339
340 if ((bsize > BUFF_SIZE1500) || (n > MAX_N15)) {
10
←
Assuming 'bsize' is <= BUFF_SIZE
→
11
←
Assuming 'n' is <= MAX_N
→
12
←
Taking false branch
→
341 pbuff = mlib_malloc(sizeof(mlib_d64)*bsize + sizeof(mlib_d64*)*2*(n + 1));
342
343 if (pbuff == NULL((void*)0)) {
344 status = MLIB_FAILURE;
345 FREE_AND_RETURN_STATUSif (pbuff != buff) mlib_free(pbuff); if (k != akernel) mlib_free
(k); return status;
346 }
347 buffs = (mlib_d64**)(pbuff + bsize);
348 }
349
350 for (l = 0; l < (n + 1); l++) buffs[l] = pbuff + l*wid;
13
←
Assuming the condition is false
→
14
←
Loop condition is false. Execution continues on line 351
→
351 for (l = 0; l < (n + 1); l++) buffs[l + (n + 1)] = buffs[l];
15
←
Loop condition is false. Execution continues on line 352
→
352 buffd = buffs[n] + wid;
353
354 wid -= (m - 1);
355 hgt -= (n - 1);
356 adr_dst += dn*dll + dm*chan1;
357
358 for (c = 0; c < chan1; c++) {
16
←
Assuming 'c' is < 'chan1'
→
17
←
Loop condition is true. Entering loop body
→
359 if (!(cmask & (1 << (chan1 - 1 - c)))) continue;
18
←
Assuming the condition is false
→
19
←
Taking false branch
→
360
361 sl = adr_src + c;
362 dl = adr_dst + c;
363
364 for (l = 0; l
19.1
'l' is >= 'n'
 < n; l++) {
20
←
Loop condition is false. Execution continues on line 374
→
365 mlib_d64 *buff = buffs[l];
366
367 for (i = 0; i < wid + (m - 1); i++) {
368 buff[i] = (mlib_d64)sl[i*chan1];
369 }
370
371 sl += sll;
372 }
373
374 buff_ind = 0;
375
376 for (i = 0; i < wid; i++) buffd[i] = 0.0;
21
←
Assuming 'i' is >= 'wid'
→
22
←
Loop condition is false. Execution continues on line 378
→
377
378 for (j = 0; j < hgt; j++) {
23
←
Assuming 'j' is < 'hgt'
→
24
←
Loop condition is true. Entering loop body
→
379 mlib_d64 **buffc = buffs + buff_ind;
380 mlib_d64 *buffn = buffc[n];
381 mlib_d64 *pk = k;
382
383 for (l = 0; l
24.1
'l' is >= 'n'
 < n; l++) {
25
←
Loop condition is false. Execution continues on line 619
→
384 mlib_d64 *buff_l = buffc[l];
385
386 for (off = 0; off < m;) {
387 mlib_d64 *buff = buff_l + off;
388
389 kw = m - off;
390
391 if (kw > 2*MAX_KER7) kw = MAX_KER7; else
392 if (kw > MAX_KER7) kw = kw/2;
393 off += kw;
394
395 sp = sl;
396 dp = dl;
397
398 p2 = buff[0]; p3 = buff[1]; p4 = buff[2];
399 p5 = buff[3]; p6 = buff[4]; p7 = buff[5];
400
401 k0 = pk[0]; k1 = pk[1]; k2 = pk[2]; k3 = pk[3];
402 k4 = pk[4]; k5 = pk[5]; k6 = pk[6];
403 pk += kw;
404
405 if (kw == 7) {
406
407 if (l < (n - 1) || off < m) {
408 for (i = 0; i <= (wid - 2); i += 2) {
409 p0 = p2; p1 = p3; p2 = p4; p3 = p5; p4 = p6; p5 = p7;
410
411 p6 = buff[i + 6]; p7 = buff[i + 7];
412
413 buffd[i ] += p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4 + p5*k5 + p6*k6;
414 buffd[i + 1] += p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4 + p6*k5 + p7*k6;
415 }
416
417 } else {
418 for (i = 0; i <= (wid - 2); i += 2) {
419 p0 = p2; p1 = p3; p2 = p4; p3 = p5; p4 = p6; p5 = p7;
420
421 p6 = buff[i + 6]; p7 = buff[i + 7];
422
423 buffn[i ] = (mlib_d64)sp[0];
424 buffn[i + 1] = (mlib_d64)sp[chan1];
425
426 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4 + p5*k5 + p6*k6 + buffd[i ];
427 d1 = p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4 + p6*k5 + p7*k6 + buffd[i + 1];
428
429 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
430 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
431
432 buffd[i ] = 0.0;
433 buffd[i + 1] = 0.0;
434
435 sp += chan2;
436 dp += chan2;
437 }
438 }
439
440 } else if (kw == 6) {
441
442 if (l < (n - 1) || off < m) {
443 for (i = 0; i <= (wid - 2); i += 2) {
444 p0 = p2; p1 = p3; p2 = p4; p3 = p5; p4 = p6;
445
446 p5 = buff[i + 5]; p6 = buff[i + 6];
447
448 buffd[i ] += p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4 + p5*k5;
449 buffd[i + 1] += p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4 + p6*k5;
450 }
451
452 } else {
453 for (i = 0; i <= (wid - 2); i += 2) {
454 p0 = p2; p1 = p3; p2 = p4; p3 = p5; p4 = p6;
455
456 p5 = buff[i + 5]; p6 = buff[i + 6];
457
458 buffn[i ] = (mlib_d64)sp[0];
459 buffn[i + 1] = (mlib_d64)sp[chan1];
460
461 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4 + p5*k5 + buffd[i ];
462 d1 = p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4 + p6*k5 + buffd[i + 1];
463
464 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
465 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
466
467 buffd[i ] = 0.0;
468 buffd[i + 1] = 0.0;
469
470 sp += chan2;
471 dp += chan2;
472 }
473 }
474
475 } else if (kw == 5) {
476
477 if (l < (n - 1) || off < m) {
478 for (i = 0; i <= (wid - 2); i += 2) {
479 p0 = p2; p1 = p3; p2 = p4; p3 = p5;
480
481 p4 = buff[i + 4]; p5 = buff[i + 5];
482
483 buffd[i ] += p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4;
484 buffd[i + 1] += p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4;
485 }
486
487 } else {
488 for (i = 0; i <= (wid - 2); i += 2) {
489 p0 = p2; p1 = p3; p2 = p4; p3 = p5;
490
491 p4 = buff[i + 4]; p5 = buff[i + 5];
492
493 buffn[i ] = (mlib_d64)sp[0];
494 buffn[i + 1] = (mlib_d64)sp[chan1];
495
496 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + p4*k4 + buffd[i ];
497 d1 = p1*k0 + p2*k1 + p3*k2 + p4*k3 + p5*k4 + buffd[i + 1];
498
499 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
500 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
501
502 buffd[i ] = 0.0;
503 buffd[i + 1] = 0.0;
504
505 sp += chan2;
506 dp += chan2;
507 }
508 }
509
510 } else if (kw == 4) {
511
512 if (l < (n - 1) || off < m) {
513 for (i = 0; i <= (wid - 2); i += 2) {
514 p0 = p2; p1 = p3; p2 = p4;
515
516 p3 = buff[i + 3]; p4 = buff[i + 4];
517
518 buffd[i ] += p0*k0 + p1*k1 + p2*k2 + p3*k3;
519 buffd[i + 1] += p1*k0 + p2*k1 + p3*k2 + p4*k3;
520 }
521
522 } else {
523 for (i = 0; i <= (wid - 2); i += 2) {
524 p0 = p2; p1 = p3; p2 = p4;
525
526 p3 = buff[i + 3]; p4 = buff[i + 4];
527
528 buffn[i ] = (mlib_d64)sp[0];
529 buffn[i + 1] = (mlib_d64)sp[chan1];
530
531 d0 = p0*k0 + p1*k1 + p2*k2 + p3*k3 + buffd[i ];
532 d1 = p1*k0 + p2*k1 + p3*k2 + p4*k3 + buffd[i + 1];
533
534 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
535 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
536
537 buffd[i ] = 0.0;
538 buffd[i + 1] = 0.0;
539
540 sp += chan2;
541 dp += chan2;
542 }
543 }
544
545 } else if (kw == 3) {
546
547 if (l < (n - 1) || off < m) {
548 for (i = 0; i <= (wid - 2); i += 2) {
549 p0 = p2; p1 = p3;
550
551 p2 = buff[i + 2]; p3 = buff[i + 3];
552
553 buffd[i ] += p0*k0 + p1*k1 + p2*k2;
554 buffd[i + 1] += p1*k0 + p2*k1 + p3*k2;
555 }
556
557 } else {
558 for (i = 0; i <= (wid - 2); i += 2) {
559 p0 = p2; p1 = p3;
560
561 p2 = buff[i + 2]; p3 = buff[i + 3];
562
563 buffn[i ] = (mlib_d64)sp[0];
564 buffn[i + 1] = (mlib_d64)sp[chan1];
565
566 d0 = p0*k0 + p1*k1 + p2*k2 + buffd[i ];
567 d1 = p1*k0 + p2*k1 + p3*k2 + buffd[i + 1];
568
569 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
570 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
571
572 buffd[i ] = 0.0;
573 buffd[i + 1] = 0.0;
574
575 sp += chan2;
576 dp += chan2;
577 }
578 }
579
580 } else { /* kw == 2 */
581
582 if (l < (n - 1) || off < m) {
583 for (i = 0; i <= (wid - 2); i += 2) {
584 p0 = p2;
585
586 p1 = buff[i + 1]; p2 = buff[i + 2];
587
588 buffd[i ] += p0*k0 + p1*k1;
589 buffd[i + 1] += p1*k0 + p2*k1;
590 }
591
592 } else {
593 for (i = 0; i <= (wid - 2); i += 2) {
594 p0 = p2;
595
596 p1 = buff[i + 1]; p2 = buff[i + 2];
597
598 buffn[i ] = (mlib_d64)sp[0];
599 buffn[i + 1] = (mlib_d64)sp[chan1];
600
601 d0 = p0*k0 + p1*k1 + buffd[i ];
602 d1 = p1*k0 + p2*k1 + buffd[i + 1];
603
604 CLAMP_S32(dp[0], d0)if (d0 > (mlib_d64)2147483647) d0 = (mlib_d64)2147483647; if
(d0 < (mlib_d64)(-2147483647 -1)) d0 = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)d0;
605 CLAMP_S32(dp[chan1], d1)if (d1 > (mlib_d64)2147483647) d1 = (mlib_d64)2147483647; if
(d1 < (mlib_d64)(-2147483647 -1)) d1 = (mlib_d64)(-2147483647
-1); dp[chan1] = (mlib_s32)d1;
606
607 buffd[i ] = 0.0;
608 buffd[i + 1] = 0.0;
609
610 sp += chan2;
611 dp += chan2;
612 }
613 }
614 }
615 }
616 }
617
618 /* last pixels */
619 for (; i
25.1
'i' is >= 'wid'
 < wid; i++) {
26
←
Loop condition is false. Execution continues on line 637
→
620 mlib_d64 *pk = k, s = 0;
621 mlib_s32 x;
622
623 for (l = 0; l < n; l++) {
624 mlib_d64 *buff = buffc[l] + i;
625
626 for (x = 0; x < m; x++) s += buff[x] * (*pk++);
627 }
628
629 CLAMP_S32(dp[0], s)if (s > (mlib_d64)2147483647) s = (mlib_d64)2147483647; if
(s < (mlib_d64)(-2147483647 -1)) s = (mlib_d64)(-2147483647
-1); dp[0] = (mlib_s32)s;
630
631 buffn[i] = (mlib_d64)sp[0];
632
633 sp += chan1;
634 dp += chan1;
635 }
636
637 for (l = 0; l < (m - 1); l++) buffn[wid + l] = sp[l*chan1];
27
←
Assuming the condition is true
→
28
←
Loop condition is true. Entering loop body
→
29
←
Array access (from variable 'sp') results in a null pointer dereference
638
639 /* next line */
640 sl += sll;
641 dl += dll;
642
643 buff_ind++;
644
645 if (buff_ind >= n + 1) buff_ind = 0;
646 }
647 }
648
649 FREE_AND_RETURN_STATUSif (pbuff != buff) mlib_free(pbuff); if (k != akernel) mlib_free
(k); return status;
650}
651
652/***************************************************************/