Home
Examples of errors detected by the V595 diagnostic

Examples of errors detected by the V595 diagnostic

V595. The pointer was utilized before it was verified against nullptr.

Doom 3

V595 The 'node' pointer was utilized before it was verified against nullptr. Check lines: 1421, 1424. DoomDLL brushbsp.cpp 1421


void idBrushBSP::FloodThroughPortals_r(idBrushBSPNode *node, ...)
{
  ...
  if ( node->occupied ) {
    common->Error(
      "FloodThroughPortals_r: node already occupied\n" );
  }
  if ( !node ) {
    common->Error(
      "FloodThroughPortals_r: NULL node\n" );
  }
  ...
}

This is what should have been written here: if ( node && node->occupied ) {

LAME

V595 The 'mp->tail' pointer was utilized before it was verified against nullptr. Check lines: 136, 139. mpglib interface.c 136


static int read_buf_byte(PMPSTR mp)
{
  ...
  pos = mp->tail->pos;
  while(pos >= mp->tail->size) {
    remove_buf(mp);
    if(!mp->tail) {
      fprintf(stderr,
        "Fatal error! tried to read past mp buffer\n");
      exit(1);
    }
    pos = mp->tail->pos;
  }
  ...
}

LAME

V595 The 'buf' pointer was utilized before it was verified against nullptr. Check lines: 226, 227. mpglib interface.c 226


static int
check_vbr_header(PMPSTR mp,int bytes)
{
  ...
  buf  = buf->next;
  pos = buf->pos;
  if(!buf) return -1; /* fatal error */
  ...
}

Identical errors can be found in some other places:

V595 The 'buf' pointer was utilized before it was verified against nullptr. Check lines: 285, 286. mpglib interface.c 285

Pixie

V595 The 'dest' pointer was utilized before it was verified against nullptr. Check lines: 86, 88. sdrc expression.cpp 86


inline void getContainer(FILE *out,int type,
          CVariable *&dest,CExpression *src)
{
  ...
  fprintf(out,"%s %s %s\n",
    opcode,nDest->codeName(),dest->codeName());

  if (dest != NULL) {
    sdr->releaseRegister(dest);
  }
  ...
}

Paranoia library

V595 The 'v' pointer was utilized before it was verified against nullptr. Check lines: 532, 535. daoParanoia paranoia.c 532


static long i_stage2_each(root_block *root, v_fragment *v,
  void(*callback)(long,int))
{
  cdrom_paranoia *p=v->p;
  long dynoverlap=p->dynoverlap/2*2;

  if(!v || !v->one)return(0);
  ...
}

Wolfenstein 3D

V595 The 'slot' pointer was utilized before it was verified against nullptr. Check lines: 477, 484. renderer ftglyph.c 477


FT_Error FT_Get_Glyph( FT_GlyphSlot slot,
  FT_Glyph *aglyph )
{
  FT_Library library = slot->library;
  FT_Error error;
  FT_Glyph glyph;

  const FT_Glyph_Class*  clazz = 0;

  if ( !slot ) {
    return FT_Err_Invalid_Slot_Handle;
  }
  ...
}

Pthreads-w32

V595 The 'assoc' pointer was utilized before it was verified against nullptr. Check lines: 88, 90. pthread80 pthread_key_delete.c 88


int
pthread_key_delete (pthread_key_t key)
{
  ...
  while ((assoc = (ThreadKeyAssoc *) key->threads) != NULL)
  {
     ptw32_thread_t * thread = assoc->thread;
     if (assoc == NULL)
     {
       /* Finished */
       break;
     }
     ...
  }
  ...
}

Mozilla Firefox

V595 The '* jitp' pointer was utilized before it was verified against nullptr. Check lines: 547, 549. compiler.cpp 547


CompileStatus
mjit::Compiler::performCompilation(JITScript **jitp)
{
  ...
  JaegerSpew(JSpew_Scripts,
    "successfully compiled (code \"%p\") (size \"%u\")\n",
    (*jitp)->code.m_code.executableAddress(),
      unsigned((*jitp)->code.m_size));

  if (!*jitp)
      return Compile_Abort;
  ...
}

Mozilla Firefox

V595 The 'mShellLink' pointer was utilized before it was verified against nullptr. Check lines: 183, 187. nslocalfilewin.cpp 183


nsresult
ShortcutResolver::Init()
{
    CoInitialize(NULL);  // FIX: we should probably move
                         // somewhere higher up during startup

    HRESULT hres;
    hres = CoCreateInstance(CLSID_ShellLink,
                            NULL,
                            CLSCTX_INPROC_SERVER,
                            IID_IShellLinkW,
                            (void**)&(mShellLink));
    if (SUCCEEDED(hres))
    {
        // Get a pointer to the IPersistFile interface.
        hres = mShellLink->QueryInterface(
          IID_IPersistFile, (void**)&mPersistFile);
    }

    if (mPersistFile == nsnull || mShellLink == nsnull)
        return NS_ERROR_FAILURE;

    return NS_OK;
}

Mozilla Firefox

V595 The 'mShell' pointer was utilized before it was verified against nullptr. Check lines: 1107, 1109. nsselection.cpp 1107


nsresult
nsFrameSelection::MoveCaret(....)
{
  ...
  mShell->FlushPendingNotifications(Flush_Layout);

  if (!mShell) {
    return NS_OK;
  }
  ...
}

Quake-III-Arena

V595 The 'item' pointer was utilized before it was verified against nullptr. Check lines: 3865, 3869. cgame ui_shared.c 3865


void Item_Paint(itemDef_t *item) {
  vec4_t red;
  menuDef_t *parent = (menuDef_t*)item->parent;
  red[0] = red[3] = 1;
  red[1] = red[2] = 0;

  if (item == NULL) {
    return;
  }
  ...
}

Quake-III-Arena

V595 The 'node' pointer was utilized before it was verified against nullptr. Check lines: 769, 770. bspc portals.c 769


void FloodPortals_r (node_t *node, int dist)
{
  ...
  if (node->occupied)
    Error("FloodPortals_r: node already occupied\n");
  if (!node)
  {
    Error("FloodPortals_r: NULL node\n");
  }
  ...
}

Trinity Core

V595 The 'player' pointer was utilized before it was verified against nullptr. Check lines: 310, 312. scripts achievement_scripts.cpp 310


bool OnCheck(Player* player, Unit* /*target*/)
{
  bool checkArea =
    player->GetAreaId() == AREA_ARGENT_TOURNAMENT_FIELDS ||
    player->GetAreaId() == AREA_RING_OF_ASPIRANTS ||
    player->GetAreaId() == AREA_RING_OF_ARGENT_VALIANTS ||
    player->GetAreaId() == AREA_RING_OF_ALLIANCE_VALIANTS ||
    player->GetAreaId() == AREA_RING_OF_HORDE_VALIANTS ||
    player->GetAreaId() == AREA_RING_OF_CHAMPIONS;

  return player && checkArea && player->duel
    && player->duel->isMounted;
}

Trinity Core

V595 The 'player' pointer was utilized before it was verified against nullptr. Check lines: 224, 225. scripts hyjal.cpp 224


CreatureAI* GetAI(Creature* creature) const
{
  ...
  Item* item = player->StoreNewItem(
    dest, ITEM_TEAR_OF_GODDESS, true);
  if (item && player)
    player->SendNewItem(item, 1, true, false, true);
  ...
}

ADAPTIVE Communication Environment (ACE)

V595 The 'this->reactor()' pointer was utilized before it was verified against nullptr. Check lines: 1139, 1145. Gateway acceptor.cpp 1139


ACE_Reactor *
ACE_Event_Handler::reactor (void) const
{
  ACE_TRACE ("ACE_Event_Handler::reactor");
  return this->reactor_;
}

template <class SVC_HANDLER, ACE_PEER_ACCEPTOR_1> int
ACE_Oneshot_Acceptor<SVC_HANDLER, ACE_PEER_ACCEPTOR_2>::
  handle_input (ACE_HANDLE)
{
  ...
  bool const reset_new_handle =
    this->reactor ()->uses_event_associations ();

  if (this->reactor ())
  ...
}

ADAPTIVE Communication Environment (ACE)

V595 The 'mb' pointer was utilized before it was verified against nullptr. Check lines: 455, 463. JAWS3 reactive_io.cpp 455


JAWS_IO_Reactive_Transmit::handle_output_source
  (ACE_HANDLE handle)
{
  ACE_Message_Block *mb = this->source_buf_;
  ...
  if (mb->length () > 0)
    result = this->handle_output_mb (handle, mb);
  if (result < 0) {
    ...
  } else if (mb == 0 && this->source_ == ACE_INVALID_HANDLE)
    this->source_buf_ = 0;
  ...
}

wxWidgets

V595 The 'm_art' pointer was utilized before it was verified against nullptr. Check lines: 2659, 2664. aui auibar.cpp 2659


void wxAuiToolBar::OnRightDown(wxMouseEvent& evt)
{
  ...
  if (m_overflowSizerItem)
  {
    int dropdown_size =
      m_art->GetElementSize(wxAUI_TBART_OVERFLOW_SIZE);
    if (dropdown_size > 0 &&
      evt.m_x > cli_rect.width - dropdown_size &&
      evt.m_y >= 0 &&
      evt.m_y < cli_rect.height &&
      m_art)
    {
       return;
    }
  }
  ...
}

Identical errors can be found in some other places:

V595 The 'm_art' pointer was utilized before it was verified against nullptr. Check lines: 2726, 2731. aui auibar.cpp 2726

WinMerge

V595 The 'm_pOwner' pointer was utilized before it was verified against nullptr. Check lines: 1033, 1035. Merge ccrystaleditview.cpp 1033


BOOL CEditDropTargetImpl::
OnDrop (CWnd * pWnd, COleDataObject * pDataObject,
        DROPEFFECT dropEffect, CPoint point)
{
  bool bDataSupported = false;

  m_pOwner->HideDropIndicator ();

  if ((!m_pOwner) ||
      (!(m_pOwner->QueryEditable ())) ||
      (m_pOwner->GetDisableDragAndDrop ()))
  ...
}

WinMerge

V595 The 'rent' pointer was utilized before it was verified against nullptr. Check lines: 608, 611. Merge dirscan.cpp 608


static DIFFITEM *AddToList(const String &sLeftDir,
 const String &sRightDir,
 const DirItem * lent, const DirItem * rent,
 UINT code, DiffFuncStruct *myStruct, DIFFITEM *parent)
{
  ...
  if (lent)
  {
    ...
  }
  else
  {
    di->left.filename = rent->filename;
  }

  if (rent)
  {
  ...
}

Clang

V595 The 'BBLoop' pointer was utilized before it was verified against nullptr. Check lines: 142, 160. LLVMAnalysis profileestimatorpass.cpp 142


void ProfileEstimatorPass::recurseBasicBlock(BasicBlock *BB) {
  ...
  Loop* BBLoop = LI->getLoopFor(BB);
  ...
  if (BBisHeader && BBLoop->contains(*bbi)) {
    ...
  }
  ...
  if (BBLoop) {
    BBLoop->getExitEdges(ExitEdges);
  }
  ...
}

Clang

V595 The 'StrippedPtr' pointer was utilized before it was verified against nullptr. Check lines: 918, 920. LLVMInstCombine instructioncombining.cpp 918


Instruction *InstCombiner::visitGetElementPtrInst(
                             GetElementPtrInst &GEP) {
  ...
  Value *StrippedPtr = PtrOp->stripPointerCasts();
  PointerType *StrippedPtrTy =
    dyn_cast<PointerType>(StrippedPtr->getType());

  if (!StrippedPtr)
    return 0;
  ...
}

Clang

V595 The 'OtherUse' pointer was utilized before it was verified against nullptr. Check lines: 2522, 2527. LLVMScalarOpts loopstrengthreduce.cpp 2522


void LSRInstance::ChainInstruction(....)
{
  ...
  Instruction *OtherUse = dyn_cast<Instruction>(*UseIter);
  if (SE.isSCEVable(OtherUse->getType())
      && !isa<SCEVUnknown>(SE.getSCEV(OtherUse))
      && IU.isIVUserOrOperand(OtherUse)) {
    continue;
  }
  if (OtherUse && OtherUse != UserInst)
    NearUsers.insert(OtherUse);
  ...
}

EchoVNC

V595 The 'table' pointer was utilized before it was verified against nullptr. Check lines: 47, 49. miniWinVNC tableinittctemplate.cpp 47


static void
rfbInitTrueColourSingleTableOUTVNC (char **table,
  rfbPixelFormat *in, rfbPixelFormat *out)
{
  ...
  if (*table) free(*table);
    *table = (char *)malloc(nEntries * sizeof(OUT_T));
  if (table == NULL) return;
    t = (OUT_T *)*table;
  ...
}

IPP Samples

V595 The 'driver' pointer was utilized before it was verified against nullptr. Check lines: 40, 46. video_renders drv.c 40


VIDEO_DRV_CREATE_BUFFERS_FUNC(umc_vdrv_CreateBuffers,
                              driver, min_b, max_b, bufs,
                              video_mem_type, video_mem_info)
{
  ...
  VideoDrvVideoMemInfo*   drv_vm  = &(driver->m_VideoMemInfo);
  ...
  if ((NULL == driver) || (NULL == bufs))
  {
    ERR_SET(VM_NULL_PTR, "null ptr");
  }
  ...
}

IPP Samples

V595 The 'encoderObj' pointer was utilized before it was verified against nullptr. Check lines: 296, 298. speech encgsmamr.c 296


GSMAMR_CODECFUN(  APIGSMAMR_Status, apiGSMAMREncode,
         (GSMAMREncoder_Obj* encoderObj,const Ipp16s* src,
          GSMAMR_Rate_t rate, Ipp8u* dst, Ipp32s *pVad ))
{
  ...
  Ipp16s *pNewSpeech = encoderObj->stEncState.pSpeechPtrNew;

  if (NULL==encoderObj || NULL==src || NULL ==dst )
    return APIGSMAMR_StsBadArgErr;
  ...
}

IPP Samples

V595 The 'm_pAVSCompressorParams' pointer was utilized before it was verified against nullptr. Check lines: 88, 91. avs_enc umc_avs_enc_fusion_core.cpp 88


Status AVSEncFusionCore::Init(Ipp32u numThreads,
                              BaseCodecParams *pParams)
{
  m_pAVSCompressorParams =
    DynamicCast<AVSVideoEncoderParams> (pParams);
  ...
  m_qp = m_pAVSCompressorParams->m_iConstQuant;

  // check error(s)
  if (NULL == m_pAVSCompressorParams)
    return UMC_ERR_NULL_PTR;
  ...
}

Blender

V595 The 'surface' pointer was utilized before it was verified against nullptr. Check lines: 1585, 1587. bf_blenkernel dynamicpaint.c 1585


static struct DerivedMesh *dynamicPaint_Modifier_apply(....)
{
  ...
  for (; surface; surface=surface->next) {
    PaintSurfaceData *sData = surface->data;
    if (surface &&
        surface->format !=
          MOD_DPAINT_SURFACE_F_IMAGESEQ &&
        sData)
    {
      ...
}

MAME

V595 The 'gfx' pointer was utilized before it was verified against nullptr. Check lines: 2457, 2483. stvvdp2.c 2457


static void stv_vdp2_drawgfxzoom(...,
  const gfx_element *gfx, ...)
{
  ...
  if (gfx->pen_usage &&
      transparency == STV_TRANSPARENCY_PEN)
  {
    ...
  }

  if( gfx )
  {
    ...
  }
  ...
}

Identical errors can be found in some other places:

V595 The 'gfx' pointer was utilized before it was verified against nullptr. Check lines: 2605, 2615. taito_f3.c 2605
V595 The 'gfx' pointer was utilized before it was verified against nullptr. Check lines: 812, 819. psikyosh.c 812
V595 The 'gfx' pointer was utilized before it was verified against nullptr. Check lines: 2756, 2766. taito_f3.c 2756
And 1 additional diagnostic messages.

MAME

V595 The 'software_list_ptr' pointer was utilized before it was verified against nullptr. Check lines: 1586, 1591. softlist.c 1586


static void find_software_item(....)
{
  char *software_list_ptr = NULL;
  ...
  *software_list_ptr =
    software_list_open( options, swlist_name, FALSE, NULL );
  if ( software_list_ptr )
  {
    *software_info_ptr =
      software_list_find( *software_list_ptr, swname, NULL );
  ...
}

Most likely this is what should be written here: if ( *software_list_ptr )

MongoDB

V595 The 'lc->cvec' pointer was utilized before it was verified against nullptr. Check lines: 447, 448. linenoise.cpp 447


static void freeCompletions(linenoiseCompletions *lc) {
  size_t i;
  for (i = 0; i < lc->len; i++)
    free(lc->cvec[i]);
  if (lc->cvec != NULL)
    free(lc->cvec);
}

MongoDB

V595 The 'm' pointer was utilized before it was verified against nullptr. Check lines: 402, 404. rs.cpp 402


void ReplSetImpl::setSelfTo(Member *m) {
  // already locked in initFromConfig
  _self = m;
  _id = m->id();
  _config = m->config();
  if( m ) _buildIndexes = m->config().buildIndexes;
  else _buildIndexes = true;
}

MongoDB

V595 The 'd' pointer was utilized before it was verified against nullptr. Check lines: 1446, 1447. dbcommands.cpp 1446


bool run(....)
{
  result.appendNumber( "fileSize" , d->fileSize() / scale );
  if( d )
    result.appendNumber( "nsSizeMB",
      (int) d->namespaceIndex.fileLength() / 1024 / 1024 );
}

ffdshow

V595 The 's' pointer was utilized before it was verified against nullptr. tsubreadermplayer.cpp 151


Tsubtitle* TsubtitleParserSami::parse(....)
{
  ....
  for (; *s != '>' && *s != '\0'; s++) {
    ;    /* skip remains of non-<P> TAG */
  }
  if (s == '\0') {
    break;
  }
  ....
}

This is an example of errors detected indirectly. The programmer actually wanted to check this: if (*s == '\0'). However, this error can be found in a different way through the V528 message.

Samba

V595 The 'ctx' pointer was utilized before it was verified against nullptr. Check lines: 67, 72. cm.c 67


static WERROR libnetapi_open_ipc_connection(
              struct libnetapi_ctx *ctx,
              const char *server_name,
              struct client_ipc_connection **pp)
{
  struct libnetapi_private_ctx *priv_ctx =
    (struct libnetapi_private_ctx *)ctx->private_data;
  struct user_auth_info *auth_info = NULL;
  struct cli_state *cli_ipc = NULL;
  struct client_ipc_connection *p;

  if (!ctx || !pp || !server_name) {
    return WERR_INVALID_PARAM;
  }
  ....
}

Newton Game Dynamics

V595 The 'child' pointer was utilized before it was verified against nullptr. Check lines: 78, 84. dgtree.cpp 78


void dgRedBackNode::RotateLeft(dgRedBackNode** const head)
{
  ....
  me->m_right = child->m_left;
  ....
  if (child != NULL) {
    child->m_parent = me->m_parent;
  }
  ....
}

Newton Game Dynamics

V595 The 'ptr' pointer was utilized before it was verified against nullptr. Check lines: 229, 230. dgtree.cpp 229


void dgRedBackNode::RemoveFixup (....)
{
  ....
  tmp = ptr->m_right;
  if (!ptr || !tmp) {
    return;
  ....
}

Identical errors can be found in some other places:

V595 The 'ptr' pointer was utilized before it was verified against nullptr. Check lines: 272, 273. dgtree.cpp 272
V595 The 'ptr' pointer was utilized before it was verified against nullptr. Check lines: 234, 238. dgtree.cpp 234
V595 The 'ptr' pointer was utilized before it was verified against nullptr. Check lines: 277, 281. dgtree.cpp 277

OpenSSL

V595 The 'buf' pointer was utilized before it was verified against nullptr. Check lines: 448, 461. obj_dat.c 448


int OBJ_obj2txt(char *buf, int buf_len,
  const ASN1_OBJECT *a, int no_name)
{
  ....
  if ((a == NULL) || (a->data == NULL)) {
    buf[0]='\0';
    return(0);
  }
  ....
  if (buf)
  ....
}

OpenCV

V595 The 'fs' pointer was utilized before it was verified against nullptr. Check lines: 617, 619. persistence.cpp 617


CV_IMPL CvStringHashNode*
cvGetHashedKey( CvFileStorage* fs, .... )
{
  ....
  CvStringHash* map = fs->str_hash;
  if( !fs )
    return 0;
  ....
}

OpenCV

V595 The 'pBN' pointer was utilized before it was verified against nullptr. Check lines: 432, 434. blobtrackingauto.cpp 432


void CvBlobTrackerAuto1::Process(IplImage* pImg, IplImage* pMask)
{
  ....
  CvBlob* pBN = NewBlobList.GetBlob(i);
  pBN->ID = m_NextBlobID;

  if(pBN &&
     pBN->w >= CV_BLOB_MINW &&
     pBN->h >= CV_BLOB_MINH)
  ....
}

OpenCV

V595 The 'ConDensation' pointer was utilized before it was verified against nullptr. Check lines: 114, 116. condens.cpp 114


CV_IMPL void
cvReleaseConDensation( CvConDensation ** ConDensation )
{
  ....
  CvConDensation *CD = *ConDensation;

  if( !ConDensation )
      CV_Error( CV_StsNullPtr, "" );
  ....
}

ReactOS

V595 The 'PolicyAccountDomainInfo' pointer was utilized before it was verified against nullptr. Check lines: 254, 257. sidcache.c 254


static BOOL
LookupSidInformation(....)
{
  ....
  DomainName = &PolicyAccountDomainInfo->DomainName;
  SidNameUse = (PolicyAccountDomainInfo != NULL ?
                SidTypeGroup : SidTypeUser);
  ....
}

Identical errors can be found in some other places:

V595 The 'oldRelations' pointer was utilized before it was verified against nullptr. Check lines: 216, 246. pnp.c 216
V595 The 'Op->Common.Value.Arg' pointer was utilized before it was verified against nullptr. Check lines: 531, 554. dswload.c 531
V595 The 'OutOp' pointer was utilized before it was verified against nullptr. Check lines: 325, 346. dswexec.c 325
And 209 additional diagnostic messages.

<< Return to list of all diagnostics

Static Code Analyzer for C/C++/C++11

Examples of errors detected by the V595 diagnostic

Doom 3

LAME

LAME

Pixie

Paranoia library

Wolfenstein 3D

Pthreads-w32

Mozilla Firefox

Mozilla Firefox

Mozilla Firefox

Quake-III-Arena

Quake-III-Arena

Trinity Core

Trinity Core

ADAPTIVE Communication Environment (ACE)

ADAPTIVE Communication Environment (ACE)

wxWidgets

WinMerge

WinMerge

Clang

Clang

Clang

EchoVNC

IPP Samples

IPP Samples

IPP Samples

Blender

MAME

MAME

MongoDB

MongoDB

MongoDB

ffdshow

Samba

Newton Game Dynamics

Newton Game Dynamics

OpenSSL

OpenCV

OpenCV

OpenCV

ReactOS