Bug Summary

File:jdk/src/java.desktop/share/native/libsplashscreen/splashscreen_gif.c
Warning:line 283, column 32
Access to field 'Colors' results in a dereference of a null pointer (loaded from variable 'colorMap')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name splashscreen_gif.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -fno-delete-null-pointer-checks -mframe-pointer=all -relaxed-aliasing -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib/llvm-10/lib/clang/10.0.0 -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/modules_include/java.base/linux -I /home/daniel/Projects/java/jdk/src/java.base/share/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/libjava -I /home/daniel/Projects/java/jdk/src/hotspot/share/include -I /home/daniel/Projects/java/jdk/src/hotspot/os/posix/include -D LIBC=gnu -D _GNU_SOURCE -D _REENTRANT -D _LARGEFILE64_SOURCE -D LINUX -D DEBUG -D _LITTLE_ENDIAN -D ARCH="amd64" -D amd64 -D _LP64=1 -D SPLASHSCREEN -D PNG_NO_MMX_CODE -D PNG_ARM_NEON_OPT=0 -D PNG_ARM_NEON_IMPLEMENTATION=0 -D WITH_X11 -I /home/daniel/Projects/java/jdk/src/java.desktop/unix/native/libsplashscreen -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen -I /home/daniel/Projects/java/jdk/src/java.desktop/unix/native/common/awt/systemscale -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libjavajpeg -I /home/daniel/Projects/java/jdk/build/linux-x86_64-server-fastdebug/support/headers/java.desktop -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen/giflib -I /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen/libpng -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/include -I /home/daniel/Projects/java/jdk/src/java.base/share/native/include -I /home/daniel/Projects/java/jdk/src/java.base/linux/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/unix/native/libjava -I /home/daniel/Projects/java/jdk/src/java.base/share/native/libjava -D _FORTIFY_SOURCE=2 -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-10/lib/clang/10.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wno-unused -Wno-sign-compare -Wno-type-limits -Wno-unused-result -Wno-maybe-uninitialized -Wno-shift-negative-value -Wno-implicit-fallthrough -Wno-unused-function -std=c99 -fdebug-compilation-dir /home/daniel/Projects/java/jdk/make -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -stack-protector 1 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -o /home/daniel/Projects/java/scan/2021-12-21-193737-8510-1 -x c /home/daniel/Projects/java/jdk/src/java.desktop/share/native/libsplashscreen/splashscreen_gif.c
1/*
2 * Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26#include "splashscreen_impl.h"
27#include "splashscreen_gfx.h"
28
29#include <gif_lib.h>
30
31#include "sizecalc.h"
32
33#define GIF_TRANSPARENT0x01 0x01
34#define GIF_USER_INPUT0x02 0x02
35#define GIF_DISPOSE_MASK0x07 0x07
36#define GIF_DISPOSE_SHIFT2 2
37
38#define GIF_NOT_TRANSPARENT-1 -1
39
40#define GIF_DISPOSE_NONE0 0 // No disposal specified. The decoder is
41 // not required to take any action.
42#define GIF_DISPOSE_LEAVE1 1 // Do not dispose. The graphic is to be left
43 // in place.
44#define GIF_DISPOSE_BACKGND2 2 // Restore to background color. The area used by the
45 // graphic must be restored to the background color.
46
47#define GIF_DISPOSE_RESTORE3 3 // Restore to previous. The decoder is required to
48 // restore the area overwritten by the graphic with
49 // what was there prior to rendering the graphic.
50
51static const char szNetscape20ext[11] = "NETSCAPE2.0";
52
53#define NSEXT_LOOP0x01 0x01 // Loop Count field code
54
55// convert libungif samples to our ones
56#define MAKE_QUAD_GIF(c,a)((((unsigned)(a))<<24)&0xFF000000)| ((((c).Red)<<
16)&0x00FF0000)| ((((c).Green)<<8)&0x0000FF00)|
((((c).Blue)<<0)&0x000000FF) MAKE_QUAD((c).Red, (c).Green, (c).Blue, (unsigned)(a))((((unsigned)(a))<<24)&0xFF000000)| ((((c).Red)<<
16)&0x00FF0000)| ((((c).Green)<<8)&0x0000FF00)|
((((c).Blue)<<0)&0x000000FF)
57
58/* stdio FILE* and memory input functions for libungif */
59int
60SplashStreamGifInputFunc(GifFileType * gif, GifByteType * buf, int n)
61{
62 SplashStream* io = (SplashStream*)gif->UserData;
63 int rc = io->read(io, buf, n);
64 return rc;
65}
66
67/* These macro help to ensure that we only take part of frame that fits into
68 logical screen. */
69
70/* Ensure that p belongs to [pmin, pmax) interval. Returns fixed point (if fix is needed) */
71#define FIX_POINT(p, pmin, pmax)( ((p) < (pmin)) ? (pmin) : (((p) > (pmax)) ? (pmax) : (
p))) ( ((p) < (pmin)) ? (pmin) : (((p) > (pmax)) ? (pmax) : (p)))
72/* Ensures that line starting at point p does not exceed boundary pmax.
73 Returns fixed length (if fix is needed) */
74#define FIX_LENGTH(p, len, pmax)( ((p) + (len)) > (pmax) ? ((pmax) - (p)) : (len)) ( ((p) + (len)) > (pmax) ? ((pmax) - (p)) : (len))
75
76int
77SplashDecodeGif(Splash * splash, GifFileType * gif)
78{
79 int stride;
80 int bufferSize;
81 byte_t *pBitmapBits, *pOldBitmapBits;
82 int i, j;
83 int imageIndex;
84 int cx, cy, cw, ch; /* clamped coordinates */
85 const int interlacedOffset[] = { 0, 4, 2, 1, 0 }; /* The way Interlaced image should. */
86 const int interlacedJumps[] = { 8, 8, 4, 2, 1 }; /* be read - offsets and jumps... */
87
88 if (DGifSlurp(gif) == GIF_ERROR0) {
1
Value assigned to field 'SColorMap'
→
2
←
Assuming the condition is false
→
3
←
Taking false branch
→
89 return 0;
90 }
91
92 SplashCleanup(splash);
93
94 if (!SAFE_TO_ALLOC(gif->SWidth, splash->imageFormat.depthBytes)(((gif->SWidth) > 0) && ((splash->imageFormat
.depthBytes) > 0) && ((0xffffffffu / ((unsigned int
)(gif->SWidth))) > (unsigned int)(splash->imageFormat
.depthBytes)))) {
4
←
Assuming field 'SWidth' is > 0
→
5
←
Assuming field 'depthBytes' is > 0
→
6
←
Assuming the condition is true
→
7
←
Taking false branch
→
95 return 0;
96 }
97 stride = gif->SWidth * splash->imageFormat.depthBytes;
98 if (splash->byteAlignment > 1)
8
←
Assuming field 'byteAlignment' is <= 1
→
9
←
Taking false branch
→
99 stride =
100 (stride + splash->byteAlignment - 1) & ~(splash->byteAlignment - 1);
101
102 if (!SAFE_TO_ALLOC(gif->SHeight, stride)(((gif->SHeight) > 0) && ((stride) > 0) &&
((0xffffffffu / ((unsigned int)(gif->SHeight))) > (unsigned
int)(stride)))) {
10
←
Assuming field 'SHeight' is > 0
→
11
←
Assuming 'stride' is > 0
→
12
←
Assuming the condition is true
→
13
←
Taking false branch
→
103 return 0;
104 }
105
106 if (!SAFE_TO_ALLOC(gif->ImageCount, sizeof(SplashImage*))(((gif->ImageCount) > 0) && ((sizeof(SplashImage
*)) > 0) && ((0xffffffffu / ((unsigned int)(gif->
ImageCount))) > (unsigned int)(sizeof(SplashImage*))))) {
14
←
Assuming field 'ImageCount' is > 0
→
15
←
Assuming the condition is true
→
16
←
Taking false branch
→
107 return 0;
108 }
109 bufferSize = stride * gif->SHeight;
110 pBitmapBits = (byte_t *) malloc(bufferSize);
111 if (!pBitmapBits) {
17
←
Assuming 'pBitmapBits' is non-null
→
18
←
Taking false branch
→
112 return 0;
113 }
114 pOldBitmapBits = (byte_t *) malloc(bufferSize);
115 if (!pOldBitmapBits) {
19
←
Assuming 'pOldBitmapBits' is non-null
→
20
←
Taking false branch
→
116 free(pBitmapBits);
117 return 0;
118 }
119 memset(pBitmapBits, 0, bufferSize);
120
121 splash->width = gif->SWidth;
122 splash->height = gif->SHeight;
123 splash->frameCount = gif->ImageCount;
124 splash->frames = (SplashImage *)
125 SAFE_SIZE_ARRAY_ALLOC(malloc, sizeof(SplashImage), gif->ImageCount)(((((sizeof(SplashImage))) >= 0 && (unsigned long long
)((sizeof(SplashImage))) <= (18446744073709551615UL)) &&
(((gif->ImageCount)) >= 0 && (unsigned long long
)((gif->ImageCount)) <= (18446744073709551615UL)) &&
(((sizeof(SplashImage))) == 0 || ((gif->ImageCount)) == 0
|| (size_t)((gif->ImageCount)) <= ((18446744073709551615UL
) / (size_t)((sizeof(SplashImage)))))) ? ((malloc)((sizeof(SplashImage
)) * (gif->ImageCount))) : ((void*)0));
21
←
'?' condition is true
→
126 if (!splash->frames) {
22
←
Assuming field 'frames' is non-null
→
23
←
Taking false branch
→
127 free(pBitmapBits);
128 free(pOldBitmapBits);
129 return 0;
130 }
131 memset(splash->frames, 0, sizeof(SplashImage) * gif->ImageCount);
132 splash->loopCount = 1;
133
134 for (imageIndex = 0; imageIndex
23.1
'imageIndex' is < field 'ImageCount'
 < gif->ImageCount; imageIndex++) {
24
←
Loop condition is true. Entering loop body
→
135 SavedImage *image = &(gif->SavedImages[imageIndex]);
136 GifImageDesc *desc = &(image->ImageDesc);
137 ColorMapObject *colorMap =
27
←
'colorMap' initialized here
→
138 desc->ColorMap ? desc->ColorMap : gif->SColorMap;
25
←
Assuming field 'ColorMap' is null
→
26
←
'?' condition is false
→
139
140 int transparentColor = -1;
141 int frameDelay = 100;
142 int disposeMethod = GIF_DISPOSE_RESTORE3;
143 int colorCount = 0;
144 rgbquad_t colorMapBuf[SPLASH_COLOR_MAP_SIZE0x100];
145
146 cx = FIX_POINT(desc->Left, 0, gif->SWidth)( ((desc->Left) < (0)) ? (0) : (((desc->Left) > (
gif->SWidth)) ? (gif->SWidth) : (desc->Left)));
28
←
Assuming field 'Left' is >= 0
→
29
←
'?' condition is false
→
30
←
Assuming field 'Left' is <= field 'SWidth'
→
31
←
'?' condition is false
→
147 cy = FIX_POINT(desc->Top, 0, gif->SHeight)( ((desc->Top) < (0)) ? (0) : (((desc->Top) > (gif
->SHeight)) ? (gif->SHeight) : (desc->Top)));
32
←
Assuming field 'Top' is >= 0
→
33
←
'?' condition is false
→
34
←
Assuming field 'Top' is <= field 'SHeight'
→
35
←
'?' condition is false
→
148 cw = FIX_LENGTH(desc->Left, desc->Width, gif->SWidth)( ((desc->Left) + (desc->Width)) > (gif->SWidth) ?
((gif->SWidth) - (desc->Left)) : (desc->Width));
36
←
Assuming the condition is false
→
37
←
'?' condition is false
→
149 ch = FIX_LENGTH(desc->Top, desc->Height, gif->SHeight)( ((desc->Top) + (desc->Height)) > (gif->SHeight)
? ((gif->SHeight) - (desc->Top)) : (desc->Height));
38
←
Assuming the condition is false
→
39
←
'?' condition is false
→
150
151 if (colorMap) {
40
←
Assuming 'colorMap' is null
→
41
←
Taking false branch
→
152 if (colorMap->ColorCount <= SPLASH_COLOR_MAP_SIZE0x100) {
153 colorCount = colorMap->ColorCount;
154 } else {
155 colorCount = SPLASH_COLOR_MAP_SIZE0x100;
156 }
157 }
158
159 /* the code below is loosely based around gif extension processing from win32 libungif sample */
160
161 for (i = 0; i < image->ExtensionBlockCount; i++) {
42
←
Assuming 'i' is < field 'ExtensionBlockCount'
→
43
←
Loop condition is true. Entering loop body
→
50
←
Assuming 'i' is >= field 'ExtensionBlockCount'
→
51
←
Loop condition is false. Execution continues on line 206
→
162 byte_t *pExtension = (byte_t *) image->ExtensionBlocks[i].Bytes;
163 unsigned size = image->ExtensionBlocks[i].ByteCount;
164
165 switch (image->ExtensionBlocks[i].Function) {
44
←
Control jumps to 'case 249:' at line 166
→
166 case GRAPHICS_EXT_FUNC_CODE0xf9:
167 {
168 int flag = pExtension[0];
169
170 frameDelay = (((int)pExtension[2]) << 8) | pExtension[1];
171 if (frameDelay < 10)
45
←
Assuming 'frameDelay' is >= 10
→
46
←
Taking false branch
→
172 frameDelay = 10;
173 if (flag & GIF_TRANSPARENT0x01) {
47
←
Assuming the condition is false
→
48
←
Taking false branch
→
174 transparentColor = pExtension[3];
175 } else {
176 transparentColor = GIF_NOT_TRANSPARENT-1;
177 }
178 disposeMethod =
179 (flag >> GIF_DISPOSE_SHIFT2) & GIF_DISPOSE_MASK0x07;
180 break;
49
←
 Execution continues on line 161
→
181 }
182 case APPLICATION_EXT_FUNC_CODE0xff:
183 {
184 if (size == sizeof(szNetscape20ext)
185 && memcmp(pExtension, szNetscape20ext, size) == 0) {
186 int iSubCode;
187
188 if (++i >= image->ExtensionBlockCount)
189 break;
190 pExtension = (byte_t *) image->ExtensionBlocks[i].Bytes;
191 if (image->ExtensionBlocks[i].ByteCount != 3)
192 break;
193 iSubCode = pExtension[0] & 0x07;
194 if (iSubCode == NSEXT_LOOP0x01) {
195 splash->loopCount =
196 (pExtension[1] | (((int)pExtension[2]) << 8)) - 1;
197 }
198 }
199 break;
200 }
201 default:
202 break;
203 }
204 }
205
206 if (colorMap
51.1
'colorMap' is null
) {
52
←
Taking false branch
→
207 for (i = 0; i < colorCount; i++) {
208 colorMapBuf[i] = MAKE_QUAD_GIF(colorMap->Colors[i], 0xff)((((unsigned)(0xff))<<24)&0xFF000000)| ((((colorMap
->Colors[i]).Red)<<16)&0x00FF0000)| ((((colorMap
->Colors[i]).Green)<<8)&0x0000FF00)| ((((colorMap
->Colors[i]).Blue)<<0)&0x000000FF);
209 }
210 }
211 {
212
213 byte_t *pSrc = image->RasterBits;
214 ImageFormat srcFormat;
215 ImageRect srcRect, dstRect;
216 int pass = 4, npass = 5;
217
218#if GIFLIB_MAJOR5 < 5
219 /* Interlaced gif support is broken in giflib < 5
220 so we need to work around this */
221 if (desc->Interlace) {
222 pass = 0;
223 npass = 4;
224 }
225#endif
226
227 srcFormat.colorMap = colorMapBuf;
228 srcFormat.depthBytes = 1;
229 srcFormat.byteOrder = BYTE_ORDER_NATIVE;
230 srcFormat.transparentColor = transparentColor;
231 srcFormat.fixedBits = QUAD_ALPHA_MASK0xFF000000; // fixed 100% alpha
232 srcFormat.premultiplied = 0;
233
234 for (; pass < npass; ++pass) {
53
←
Loop condition is true. Entering loop body
→
56
←
Loop condition is false. Execution continues on line 259
→
235 int jump = interlacedJumps[pass];
236 int ofs = interlacedOffset[pass];
237 /* Number of source lines for current pass */
238 int numPassLines = (desc->Height + jump - ofs - 1) / jump;
239 /* Number of lines that fits to dest buffer */
240 int numLines = (ch + jump - ofs - 1) / jump;
241
242 initRect(&srcRect, 0, 0, desc->Width, numLines, 1,
243 desc->Width, pSrc, &srcFormat);
244
245 if (numLines > 0) {
54
←
Assuming 'numLines' is <= 0
→
55
←
Taking false branch
→
246 initRect(&dstRect, cx, cy + ofs, cw,
247 numLines , jump, stride, pBitmapBits, &splash->imageFormat);
248
249 pSrc += convertRect(&srcRect, &dstRect, CVT_ALPHATEST);
250 }
251 // skip extra source data
252 pSrc += (numPassLines - numLines) * srcRect.stride;
253 }
254 }
255
256 // now dispose of the previous frame correctly
257
258 splash->frames[imageIndex].bitmapBits =
259 (rgbquad_t *) malloc(bufferSize); // bufferSize is safe (checked above)
260 if (!splash->frames[imageIndex].bitmapBits) {
57
←
Assuming field 'bitmapBits' is non-null
→
58
←
Taking false branch
→
261 free(pBitmapBits);
262 free(pOldBitmapBits);
263 /* Assuming that callee will take care of splash frames we have already allocated */
264 return 0;
265 }
266 memcpy(splash->frames[imageIndex].bitmapBits, pBitmapBits, bufferSize);
267
268 SplashInitFrameShape(splash, imageIndex);
269
270 splash->frames[imageIndex].delay = frameDelay * 10; // 100ths of second to milliseconds
271 switch (disposeMethod) {
59
←
Control jumps to 'case 2:' at line 277
→
272 case GIF_DISPOSE_LEAVE1:
273 memcpy(pOldBitmapBits, pBitmapBits, bufferSize);
274 break;
275 case GIF_DISPOSE_NONE0:
276 break;
277 case GIF_DISPOSE_BACKGND2:
278 {
279 ImageRect dstRect;
280 rgbquad_t fillColor = 0; // 0 is transparent
281
282 if (transparentColor
59.1
'transparentColor' is < 0
 < 0) {
60
←
Taking true branch
→
283 fillColor= MAKE_QUAD_GIF(((((unsigned)(0xff))<<24)&0xFF000000)| ((((colorMap
->Colors[gif->SBackGroundColor]).Red)<<16)&0x00FF0000
)| ((((colorMap->Colors[gif->SBackGroundColor]).Green)<<
8)&0x0000FF00)| ((((colorMap->Colors[gif->SBackGroundColor
]).Blue)<<0)&0x000000FF)
61
←
Access to field 'Colors' results in a dereference of a null pointer (loaded from variable 'colorMap')
284 colorMap->Colors[gif->SBackGroundColor], 0xff)((((unsigned)(0xff))<<24)&0xFF000000)| ((((colorMap
->Colors[gif->SBackGroundColor]).Red)<<16)&0x00FF0000
)| ((((colorMap->Colors[gif->SBackGroundColor]).Green)<<
8)&0x0000FF00)| ((((colorMap->Colors[gif->SBackGroundColor
]).Blue)<<0)&0x000000FF);
285 }
286 initRect(&dstRect,
287 cx, cy, cw, ch,
288 1, stride,
289 pBitmapBits, &splash->imageFormat);
290 fillRect(fillColor, &dstRect);
291 }
292 break;
293 case GIF_DISPOSE_RESTORE3:
294 {
295 int lineSize = cw * splash->imageFormat.depthBytes;
296 if (lineSize > 0) {
297 int lineOffset = cx * splash->imageFormat.depthBytes;
298 int lineIndex = cy * stride + lineOffset;
299 for (j=0; j<ch; j++) {
300 memcpy(pBitmapBits + lineIndex, pOldBitmapBits + lineIndex,
301 lineSize);
302 lineIndex += stride;
303 }
304 }
305 }
306 break;
307 }
308 }
309
310 free(pBitmapBits);
311 free(pOldBitmapBits);
312
313#if GIFLIB_MAJOR5 > 5 || (GIFLIB_MAJOR5 == 5 && GIFLIB_MINOR2 >= 1)
314 if (DGifCloseFile(gif, NULL((void*)0)) == GIF_ERROR0) {
315 return 0;
316 }
317#else
318 DGifCloseFile(gif);
319#endif
320
321 return 1;
322}
323
324int
325SplashDecodeGifStream(Splash * splash, SplashStream * stream)
326{
327#if GIFLIB_MAJOR5 >= 5
328 GifFileType *gif = DGifOpen((void *) stream, SplashStreamGifInputFunc, NULL((void*)0));
329#else
330 GifFileType *gif = DGifOpen((void *) stream, SplashStreamGifInputFunc);
331#endif
332
333 if (!gif)
334 return 0;
335 return SplashDecodeGif(splash, gif);
336}