Bug Summary

File:src/sys/arch/amd64/stand/efiboot/bootia32/../self_reloc.c
Warning:line 103, column 11
Access to field 'r_info' results in a dereference of a null pointer (loaded from variable 'rel')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple i386-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name self_reloc.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -target-cpu i586 -disable-red-zone -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/stand/efiboot/bootia32/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/efi/include/i386 -D EFIBOOT -D FWRANDOM -D NEEDS_HEAP_H -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/efi/include -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/boot -D SOFTRAID -D _STANDALONE -D MDRANDOM -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/efi/include/i386 -D EFIBOOT -D FWRANDOM -D NEEDS_HEAP_H -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/efi/include -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../../stand/boot -D SOFTRAID -D _STANDALONE -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../../../.. -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../../libsa -I . -I /usr/src/sys/arch/amd64/stand/efiboot/bootia32 -D SMALL -D SLOW -D NOBYFOUR -D __INTERNAL_LIBSA_CREAD -D HEAP_LIMIT=0xc00000 -D HIBERNATE -Oz -Wno-pointer-sign -std=gnu99 -fdebug-compilation-dir=/usr/src/sys/arch/amd64/stand/efiboot/bootia32/obj -ferror-limit 19 -fwrapv -fno-builtin -fwchar-type=short -fno-signed-wchar -fgnuc-version=4.2.1 -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/sys/arch/amd64/stand/efiboot/bootia32/../self_reloc.c
1/* $OpenBSD: self_reloc.c,v 1.2 2018/10/20 11:57:43 kettenis Exp $ */
2/*-
3 * Copyright (c) 2008-2010 Rui Paulo <rpaulo@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28#include <sys/param.h>
29#include <machine/reloc.h>
30
31#if defined(__aarch64__) || defined(__amd64__)
32#define ELFSIZE32 64
33#define ElfW_RelElf32_Rel Elf64_Rela
34#define ElfW_DynElf32_Dyn Elf64_Dyn
35#define ELFW_R_TYPEELF32_R_TYPE ELF64_R_TYPE
36#define ELF_RELA
37#elif defined(__arm__) || defined(__i386__1)
38#define ELFSIZE32 32
39#define ElfW_RelElf32_Rel Elf32_Rel
40#define ElfW_DynElf32_Dyn Elf32_Dyn
41#define ELFW_R_TYPEELF32_R_TYPE ELF32_R_TYPE
42#else
43#error architecture not supported
44#endif
45
46#include <sys/exec_elf.h>
47
48#if defined(__aarch64__)
49#define RELOC_TYPE_NONE0 R_AARCH64_NONE
50#define RELOC_TYPE_RELATIVE8 R_AARCH64_RELATIVE
51#elif defined(__amd64__)
52#define RELOC_TYPE_NONE0 R_X86_64_NONE0
53#define RELOC_TYPE_RELATIVE8 R_X86_64_RELATIVE8
54#elif defined(__arm__)
55#define RELOC_TYPE_NONE0 R_ARM_NONE
56#define RELOC_TYPE_RELATIVE8 R_ARM_RELATIVE
57#elif defined(__i386__1)
58#define RELOC_TYPE_NONE0 R_386_NONE0
59#define RELOC_TYPE_RELATIVE8 R_386_RELATIVE8
60#endif
61
62/*
63 * A simple elf relocator.
64 */
65void
66self_reloc(Elf_AddrElf32_Addr baseaddr, ElfW_DynElf32_Dyn *dynamic)
67{
68 Elf_WordElf32_Word relsz, relent;
69 Elf_AddrElf32_Addr *newaddr;
70 ElfW_RelElf32_Rel *rel = NULL((void *)0);
1
'rel' initialized to a null pointer value
→
71 ElfW_DynElf32_Dyn *dynp;
72
73 /*
74 * Find the relocation address, its size and the relocation entry.
75 */
76 relsz = 0;
77 relent = 0;
78 for (dynp = dynamic; dynp->d_tag != DT_NULL0; dynp++) {
2
←
Assuming field 'd_tag' is not equal to DT_NULL
→
3
←
Loop condition is true. Entering loop body
→
6
←
Assuming field 'd_tag' is equal to DT_NULL
→
7
←
Loop condition is false. Execution continues on line 102
→
79 switch (dynp->d_tag) {
4
←
Control jumps to 'case 8:' at line 85
→
80 case DT_REL17:
81 case DT_RELA7:
82 rel = (ElfW_RelElf32_Rel *)(dynp->d_un.d_ptr + baseaddr);
83 break;
84 case DT_RELSZ18:
85 case DT_RELASZ8:
86 relsz = dynp->d_un.d_val;
87 break;
5
←
 Execution continues on line 78
→
88 case DT_RELENT19:
89 case DT_RELAENT9:
90 relent = dynp->d_un.d_val;
91 break;
92 default:
93 break;
94 }
95 }
96
97 /*
98 * Perform the actual relocation. We rely on the object having been
99 * linked at 0, so that the difference between the load and link
100 * address is the same as the load address.
101 */
102 for (; relsz > 0; relsz -= relent) {
8
←
Assuming 'relsz' is > 0
→
9
←
Loop condition is true. Entering loop body
→
103 switch (ELFW_R_TYPE(rel->r_info)((unsigned char) (rel->r_info))) {
10
←
Access to field 'r_info' results in a dereference of a null pointer (loaded from variable 'rel')
104 case RELOC_TYPE_NONE0:
105 /* No relocation needs be performed. */
106 break;
107
108 case RELOC_TYPE_RELATIVE8:
109 newaddr = (Elf_AddrElf32_Addr *)(rel->r_offset + baseaddr);
110#ifdef ELF_RELA
111 /* Addend relative to the base address. */
112 *newaddr = baseaddr + rel->r_addend;
113#else
114 /* Address relative to the base address. */
115 *newaddr += baseaddr;
116#endif
117 break;
118 default:
119 /* XXX: do we need other relocations ? */
120 break;
121 }
122 rel = (ElfW_RelElf32_Rel *) ((caddr_t) rel + relent);
123 }
124}