(/home/sate/Testcases/c/cve/wireshark-1.2.0/tools/lemon/lemon.c) |
| |
| 3130 | | | PRIVATE FILE *tplt_open(struct lemon *lemp) |
| 3131 | | | { |
| 3132 | | | static char templatename[] = "lempar.c"; |
| 3133 | | | char* buf; |
| 3134 | | | FILE *in; |
| 3135 | | | char *tpltname = NULL; |
| 3136 | | | char *cp; |
| 3137 | | | |
| 3138 | | | if (lemp->templatename) { |
Event 1:
Taking false branch. lemp->templatename evaluates to false.
hide
|
|
| 3139 | | | tpltname = strdup(lemp->templatename); |
| 3140 | | | } |
| 3141 | | | else { |
| 3142 | | | cp = strrchr(lemp->filename,'.'); |
| 3143 | | | buf = malloc(1000); |
| 3144 | | | if( cp ){ |
Event 2:
Taking false branch. cp evaluates to false.
hide
|
|
| 3145 | | | sprintf(buf,"%.*s.lt",(int)(cp - lemp->filename),lemp->filename); |
| 3146 | | | }else{ |
| 3147 | | | sprintf(buf,"%s.lt",lemp->filename); |
| 3148 | | | } |
| 3149 | | | if( access(buf,004)==0 ){ |
Event 3:
Taking false branch. access(buf, 4) == 0 evaluates to false.
hide
|
|
| 3150 | | | tpltname = buf; |
| 3151 | | | }else if( access(templatename,004)==0 ){ |
Event 4:
Taking true branch. access(templatename, 4) == 0 evaluates to true.
hide
|
|
| 3152 | | | tpltname = templatename; |
Event 5:
tpltname is set to templatename.
hide
|
|
| 3153 | | | }else{ |
| 3154 | | | tpltname = pathsearch(lemp->argv0,templatename,0); |
| 3155 | | | free(buf); |
| 3156 | | | } |
| 3157 | | | } |
| 3158 | | | if( tpltname==0 ){ |
Event 6:
Skipping " if". tpltname == 0 evaluates to false.
hide
|
|
| 3159 | | | fprintf(stderr,"Can't find the parser driver template file \"%s\".\n", |
| 3160 | | | templatename); |
| 3161 | | | lemp->errorcnt++; |
| 3162 | | | free(tpltname); |
| 3163 | | | return 0; |
| 3164 | | | } |
| 3165 | | | in = fopen(tpltname,"rb"); |
| 3166 | | | free(tpltname); |
Event 7:
tpltname, which evaluates to templatename, is passed to free(). See related event 5.
hide
Free Non-Heap Variable
free() is called on tpltname, which is not heap allocated. - tpltname evaluates to templatename.
- tpltname points to static memory.
The issue can occur if the highlighted code executes. See related event 7. Show: All events | Only primary events |
|
| |