(/home/sate/Testcases/c/cve/wireshark-1.2.0/tools/lemon/lemon.c) |
| |
| 3620 | | | void ReportTable( |
| 3621 | | | struct lemon *lemp, |
| 3622 | | | int mhflag) |
| 3623 | | | { |
| 3624 | | | FILE *out, *in; |
| 3625 | | | char line[LINESIZE]; |
| 3626 | | | int lineno; |
| 3627 | | | struct state *stp; |
| 3628 | | | struct action *ap; |
| 3629 | | | struct rule *rp; |
| 3630 | | | struct acttab *pActtab; |
| 3631 | | | int i, j, n; |
| 3632 | | | const char *name; |
| 3633 | | | int mnTknOfst, mxTknOfst; |
| 3634 | | | int mnNtOfst, mxNtOfst; |
| 3635 | | | struct axset *ax; |
| 3636 | | | |
| 3637 | [+] | | in = tplt_open(lemp); |
 |
| 3638 | | | if( in==0 ) return; |
Event 6:
Skipping " if". in == 0 evaluates to false.
hide
|
|
| 3639 | [+] | | out = file_open(lemp,".c","wb"); |
 |
| 3640 | | | if( out==0 ){ |
Event 10:
Skipping " if". out == 0 evaluates to false.
hide
|
|
| 3641 | | | fclose(in); |
| 3642 | | | return; |
| 3643 | | | } |
| 3644 | | | lineno = 1; |
| 3645 | | | tplt_xfer(lemp->name,in,out,&lineno); |
| 3646 | | | |
| 3647 | | | |
| 3648 | | | tplt_print(out,lemp,lemp->include,&lineno); |
| 3649 | | | if( mhflag ){ |
Event 11:
Skipping " if". mhflag evaluates to false.
hide
|
|
| 3650 | | | char *name = file_makename_using_basename(lemp, ".h"); |
| 3651 | | | fprintf(out,"#include \"%s\"\n", name); lineno++; |
| 3652 | | | free(name); |
| 3653 | | | } |
| 3654 | | | tplt_xfer(lemp->name,in,out,&lineno); |
| 3655 | | | |
| 3656 | | | |
| 3657 | | | if( mhflag ){ |
Event 12:
Skipping " if". mhflag evaluates to false.
hide
|
|
| 3658 | | | const char *prefix; |
| 3659 | | | fprintf(out,"#if INTERFACE\n"); lineno++; |
| 3660 | | | if( lemp->tokenprefix ) prefix = lemp->tokenprefix; |
| 3661 | | | else prefix = ""; |
| 3662 | | | for(i=1; i<lemp->nterminal; i++){ |
| 3663 | | | fprintf(out,"#define %s%-30s %2d\n",prefix,lemp->symbols[i]->name,i); |
| 3664 | | | lineno++; |
| 3665 | | | } |
| 3666 | | | fprintf(out,"#endif\n"); lineno++; |
| 3667 | | | } |
| 3668 | | | tplt_xfer(lemp->name,in,out,&lineno); |
| 3669 | | | |
| 3670 | | | |
| 3671 | | | fprintf(out,"#define YYCODETYPE %s\n", |
| 3672 | | | minimum_signed_size_type(0, lemp->nsymbol+5)); lineno++; |
| 3673 | | | fprintf(out,"#define YYNOCODE %d\n",lemp->nsymbol+1); lineno++; |
| 3674 | | | fprintf(out,"#define YYACTIONTYPE %s\n", |
| 3675 | | | minimum_signed_size_type(0, lemp->nstate+lemp->nrule+5)); lineno++; |
| 3676 | | | if( lemp->wildcard ){ |
Event 13:
Taking true branch. lemp->wildcard evaluates to true.
hide
|
|
| 3677 | | | fprintf(out,"#define YYWILDCARD %d\n", |
| 3678 | | | lemp->wildcard->index); lineno++; |
| 3679 | | | } |
| 3680 | | | print_stack_union(out,lemp,&lineno,mhflag); |
| 3681 | | | fprintf(out, "#ifndef YYSTACKDEPTH\n"); lineno++; |
| 3682 | | | if( lemp->stacksize ){ |
Event 14:
Taking false branch. lemp->stacksize evaluates to false.
hide
|
|
| 3683 | | | fprintf(out,"#define YYSTACKDEPTH %s\n",lemp->stacksize); lineno++; |
| 3684 | | | }else{ |
| 3685 | | | fprintf(out,"#define YYSTACKDEPTH 100\n"); lineno++; |
| 3686 | | | } |
| 3687 | | | fprintf(out, "#endif\n"); lineno++; |
| 3688 | | | if( mhflag ){ |
Event 15:
Skipping " if". mhflag evaluates to false.
hide
|
|
| 3689 | | | fprintf(out,"#if INTERFACE\n"); lineno++; |
| 3690 | | | } |
| 3691 | | | name = lemp->name ? lemp->name : "Parse"; |
Event 16:
lemp->name evaluates to false.
hide
|
|
| 3692 | | | if( lemp->arg && lemp->arg[0] ){ |
| 3693 | | | int i; |
| 3694 | | | i = (int) strlen(lemp->arg); |
| 3695 | | | while( i>=1 && safe_isspace(lemp->arg[i-1]) ) i--; |
| 3696 | | | while( i>=1 && (safe_isalnum(lemp->arg[i-1]) || lemp->arg[i-1]=='_') ) i--; |
| 3697 | | | fprintf(out,"#define %sARG_SDECL %s;\n",name,lemp->arg); lineno++; |
| 3698 | | | fprintf(out,"#define %sARG_PDECL ,%s\n",name,lemp->arg); lineno++; |
| 3699 | | | fprintf(out,"#define %sARG_FETCH %s = yypParser->%s\n", |
| 3700 | | | name,lemp->arg,&lemp->arg[i]); lineno++; |
| 3701 | | | fprintf(out,"#define %sARG_STORE yypParser->%s = %s\n", |
| 3702 | | | name,&lemp->arg[i],&lemp->arg[i]); lineno++; |
| 3703 | | | }else{ |
| 3704 | | | fprintf(out,"#define %sARG_SDECL\n",name); lineno++; |
| 3705 | | | fprintf(out,"#define %sARG_PDECL\n",name); lineno++; |
| 3706 | | | fprintf(out,"#define %sARG_FETCH\n",name); lineno++; |
| 3707 | | | fprintf(out,"#define %sARG_STORE\n",name); lineno++; |
| 3708 | | | } |
| 3709 | | | if( mhflag ){ |
Event 18:
Skipping " if". mhflag evaluates to false.
hide
|
|
| 3710 | | | fprintf(out,"#endif\n"); lineno++; |
| 3711 | | | } |
| 3712 | | | fprintf(out,"#define YYNSTATE %d\n",lemp->nstate); lineno++; |
| 3713 | | | fprintf(out,"#define YYNRULE %d\n",lemp->nrule); lineno++; |
| 3714 | | | if( lemp->errsym->useCnt ){ |
Event 19:
Taking true branch. lemp->errsym->useCnt evaluates to true.
hide
|
|
| 3715 | | | fprintf(out,"#define YYERRORSYMBOL %d\n",lemp->errsym->index); lineno++; |
| 3716 | | | fprintf(out,"#define YYERRSYMDT yy%d\n",lemp->errsym->dtnum); lineno++; |
| 3717 | | | } |
| 3718 | | | if( lemp->has_fallback ){ |
Event 20:
Skipping " if". lemp->has_fallback evaluates to false.
hide
|
|
| 3719 | | | fprintf(out,"#define YYFALLBACK 1\n"); lineno++; |
| 3720 | | | } |
| 3721 | | | tplt_xfer(lemp->name,in,out,&lineno); |
| 3722 | | | |
| 3723 | | | |
| 3724 | | | |
| 3725 | | | |
| 3726 | | | |
| 3727 | | | |
| 3728 | | | |
| 3729 | | | |
| 3730 | | | |
| 3731 | | | |
| 3732 | | | |
| 3733 | | | |
| 3734 | | | |
| 3735 | | | |
| 3736 | | | ax = calloc(lemp->nstate*2, sizeof(ax[0])); |
Event 21:
2 * lemp->nstate is passed to calloc() as the first argument. - This multiplication may overflow and it is used as the allocation size later.
hide
Integer Overflow of Allocation Size
- If the multiplication at lemon.c:3736 overflows, then calloc() may allocate less space than expected; this might result in buffer overruns later.
- The allocation size is lemp->nstate * 2, which evaluates to 2 * lemp->nstate.
The issue can occur if the highlighted code executes. See related event 21. Show: All events | Only primary events |
|
| |