Bug Summary

File:src/lib/libm/src/e_j1f.c
Warning:line 331, column 6
Array access (from variable 'p') results in an undefined pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name e_j1f.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libm/obj -resource-dir /usr/local/lib/clang/13.0.0 -include namespace.h -I /usr/src/lib/libm/arch/amd64 -I /usr/src/lib/libm/src -I /usr/src/lib/libm/src/ld80 -I /usr/src/lib/libm/hidden -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libm/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libm/src/e_j1f.c
1/* e_j1f.c -- float version of e_j1.c.
2 * Conversion to float by Ian Lance Taylor, Cygnus Support, ian@cygnus.com.
3 */
4
5/*
6 * ====================================================
7 * Copyright (C) 1993 by Sun Microsystems, Inc. All rights reserved.
8 *
9 * Developed at SunPro, a Sun Microsystems, Inc. business.
10 * Permission to use, copy, modify, and distribute this
11 * software is freely granted, provided that this notice
12 * is preserved.
13 * ====================================================
14 */
15
16#include "math.h"
17#include "math_private.h"
18
19static float ponef(float), qonef(float);
20
21static const float
22huge = 1e30,
23one = 1.0,
24invsqrtpi= 5.6418961287e-01, /* 0x3f106ebb */
25tpi = 6.3661974669e-01, /* 0x3f22f983 */
26 /* R0/S0 on [0,2] */
27r00 = -6.2500000000e-02, /* 0xbd800000 */
28r01 = 1.4070566976e-03, /* 0x3ab86cfd */
29r02 = -1.5995563444e-05, /* 0xb7862e36 */
30r03 = 4.9672799207e-08, /* 0x335557d2 */
31s01 = 1.9153760746e-02, /* 0x3c9ce859 */
32s02 = 1.8594678841e-04, /* 0x3942fab6 */
33s03 = 1.1771846857e-06, /* 0x359dffc2 */
34s04 = 5.0463624390e-09, /* 0x31ad6446 */
35s05 = 1.2354227016e-11; /* 0x2d59567e */
36
37static const float zero = 0.0;
38
39float
40j1f(float x)
41{
42 float z, s,c,ss,cc,r,u,v,y;
43 int32_t hx,ix;
44
45 GET_FLOAT_WORD(hx,x)do { ieee_float_shape_type gf_u; gf_u.value = (x); (hx) = gf_u
.word; } while (0);
46 ix = hx&0x7fffffff;
47 if(ix>=0x7f800000) return one/x;
48 y = fabsf(x);
49 if(ix >= 0x40000000) { /* |x| >= 2.0 */
50 s = sinf(y);
51 c = cosf(y);
52 ss = -s-c;
53 cc = s-c;
54 if(ix<0x7f000000) { /* make sure y+y not overflow */
55 z = cosf(y+y);
56 if ((s*c)>zero) cc = z/ss;
57 else ss = z/cc;
58 }
59 /*
60 * j1(x) = 1/sqrt(pi) * (P(1,x)*cc - Q(1,x)*ss) / sqrt(x)
61 * y1(x) = 1/sqrt(pi) * (P(1,x)*ss + Q(1,x)*cc) / sqrt(x)
62 */
63 if(ix>0x80000000U) z = (invsqrtpi*cc)/sqrtf(y);
64 else {
65 u = ponef(y); v = qonef(y);
66 z = invsqrtpi*(u*cc-v*ss)/sqrtf(y);
67 }
68 if(hx<0) return -z;
69 else return z;
70 }
71 if(ix<0x32000000) { /* |x|<2**-27 */
72 if(huge+x>one) return (float)0.5*x;/* inexact if x!=0 necessary */
73 }
74 z = x*x;
75 r = z*(r00+z*(r01+z*(r02+z*r03)));
76 s = one+z*(s01+z*(s02+z*(s03+z*(s04+z*s05))));
77 r *= x;
78 return(x*(float)0.5+r/s);
79}
80DEF_NONSTD(j1f)__asm__(".weak " "j1f" " ; " "j1f" " = " "_libm_j1f");
81
82static const float U0[5] = {
83 -1.9605709612e-01, /* 0xbe48c331 */
84 5.0443872809e-02, /* 0x3d4e9e3c */
85 -1.9125689287e-03, /* 0xbafaaf2a */
86 2.3525259166e-05, /* 0x37c5581c */
87 -9.1909917899e-08, /* 0xb3c56003 */
88};
89static const float V0[5] = {
90 1.9916731864e-02, /* 0x3ca3286a */
91 2.0255257550e-04, /* 0x3954644b */
92 1.3560879779e-06, /* 0x35b602d4 */
93 6.2274145840e-09, /* 0x31d5f8eb */
94 1.6655924903e-11, /* 0x2d9281cf */
95};
96
97float
98y1f(float x)
99{
100 float z, s,c,ss,cc,u,v;
101 int32_t hx,ix;
102
103 GET_FLOAT_WORD(hx,x)do { ieee_float_shape_type gf_u; gf_u.value = (x); (hx) = gf_u
.word; } while (0);
1
Loop condition is false. Exiting loop
→
104 ix = 0x7fffffff&hx;
105 /* if Y1(NaN) is NaN, Y1(-inf) is NaN, Y1(inf) is 0 */
106 if(ix>=0x7f800000) return one/(x+x*x);
2
←
Assuming 'ix' is < 2139095040
→
3
←
Taking false branch
→
107 if(ix==0) return -one/zero;
4
←
Assuming 'ix' is not equal to 0
→
5
←
Taking false branch
→
108 if(hx<0) return zero/zero;
6
←
Assuming 'hx' is >= 0
→
7
←
Taking false branch
→
109 if(ix >= 0x40000000) { /* |x| >= 2.0 */
8
←
Assuming 'ix' is >= 1073741824
→
9
←
Taking true branch
→
110 s = sinf(x);
111 c = cosf(x);
112 ss = -s-c;
113 cc = s-c;
114 if(ix<0x7f000000) { /* make sure x+x not overflow */
10
←
Assuming 'ix' is < 2130706432
→
11
←
Taking true branch
→
115 z = cosf(x+x);
116 if ((s*c)>zero) cc = z/ss;
12
←
Assuming the condition is false
→
13
←
Taking false branch
→
117 else ss = z/cc;
118 }
119 /* y1(x) = sqrt(2/(pi*x))*(p1(x)*sin(x0)+q1(x)*cos(x0))
120 * where x0 = x-3pi/4
121 * Better formula:
122 * cos(x0) = cos(x)cos(3pi/4)+sin(x)sin(3pi/4)
123 * = 1/sqrt(2) * (sin(x) - cos(x))
124 * sin(x0) = sin(x)cos(3pi/4)-cos(x)sin(3pi/4)
125 * = -1/sqrt(2) * (cos(x) + sin(x))
126 * To avoid cancellation, use
127 * sin(x) +- cos(x) = -cos(2x)/(sin(x) -+ cos(x))
128 * to compute the worse one.
129 */
130 if(ix>0x48000000) z = (invsqrtpi*ss)/sqrtf(x);
14
←
Assuming 'ix' is <= 1207959552
→
15
←
Taking false branch
→
131 else {
132 u = ponef(x); v = qonef(x);
16
←
Calling 'qonef'
→
133 z = invsqrtpi*(u*ss+v*cc)/sqrtf(x);
134 }
135 return z;
136 }
137 if(ix<=0x24800000) { /* x < 2**-54 */
138 return(-tpi/x);
139 }
140 z = x*x;
141 u = U0[0]+z*(U0[1]+z*(U0[2]+z*(U0[3]+z*U0[4])));
142 v = one+z*(V0[0]+z*(V0[1]+z*(V0[2]+z*(V0[3]+z*V0[4]))));
143 return(x*(u/v) + tpi*(j1f(x)*logf(x)-one/x));
144}
145DEF_NONSTD(y1f)__asm__(".weak " "y1f" " ; " "y1f" " = " "_libm_y1f");
146
147/* For x >= 8, the asymptotic expansions of pone is
148 * 1 + 15/128 s^2 - 4725/2^15 s^4 - ..., where s = 1/x.
149 * We approximate pone by
150 * pone(x) = 1 + (R/S)
151 * where R = pr0 + pr1*s^2 + pr2*s^4 + ... + pr5*s^10
152 * S = 1 + ps0*s^2 + ... + ps4*s^10
153 * and
154 * | pone(x)-1-R/S | <= 2 ** ( -60.06)
155 */
156
157static const float pr8[6] = { /* for x in [inf, 8]=1/[0,0.125] */
158 0.0000000000e+00, /* 0x00000000 */
159 1.1718750000e-01, /* 0x3df00000 */
160 1.3239480972e+01, /* 0x4153d4ea */
161 4.1205184937e+02, /* 0x43ce06a3 */
162 3.8747453613e+03, /* 0x45722bed */
163 7.9144794922e+03, /* 0x45f753d6 */
164};
165static const float ps8[5] = {
166 1.1420736694e+02, /* 0x42e46a2c */
167 3.6509309082e+03, /* 0x45642ee5 */
168 3.6956207031e+04, /* 0x47105c35 */
169 9.7602796875e+04, /* 0x47bea166 */
170 3.0804271484e+04, /* 0x46f0a88b */
171};
172
173static const float pr5[6] = { /* for x in [8,4.5454]=1/[0.125,0.22001] */
174 1.3199052094e-11, /* 0x2d68333f */
175 1.1718749255e-01, /* 0x3defffff */
176 6.8027510643e+00, /* 0x40d9b023 */
177 1.0830818176e+02, /* 0x42d89dca */
178 5.1763616943e+02, /* 0x440168b7 */
179 5.2871520996e+02, /* 0x44042dc6 */
180};
181static const float ps5[5] = {
182 5.9280597687e+01, /* 0x426d1f55 */
183 9.9140142822e+02, /* 0x4477d9b1 */
184 5.3532670898e+03, /* 0x45a74a23 */
185 7.8446904297e+03, /* 0x45f52586 */
186 1.5040468750e+03, /* 0x44bc0180 */
187};
188
189static const float pr3[6] = {
190 3.0250391081e-09, /* 0x314fe10d */
191 1.1718686670e-01, /* 0x3defffab */
192 3.9329774380e+00, /* 0x407bb5e7 */
193 3.5119403839e+01, /* 0x420c7a45 */
194 9.1055007935e+01, /* 0x42b61c2a */
195 4.8559066772e+01, /* 0x42423c7c */
196};
197static const float ps3[5] = {
198 3.4791309357e+01, /* 0x420b2a4d */
199 3.3676245117e+02, /* 0x43a86198 */
200 1.0468714600e+03, /* 0x4482dbe3 */
201 8.9081134033e+02, /* 0x445eb3ed */
202 1.0378793335e+02, /* 0x42cf936c */
203};
204
205static const float pr2[6] = {/* for x in [2.8570,2]=1/[0.3499,0.5] */
206 1.0771083225e-07, /* 0x33e74ea8 */
207 1.1717621982e-01, /* 0x3deffa16 */
208 2.3685150146e+00, /* 0x401795c0 */
209 1.2242610931e+01, /* 0x4143e1bc */
210 1.7693971634e+01, /* 0x418d8d41 */
211 5.0735230446e+00, /* 0x40a25a4d */
212};
213static const float ps2[5] = {
214 2.1436485291e+01, /* 0x41ab7dec */
215 1.2529022980e+02, /* 0x42fa9499 */
216 2.3227647400e+02, /* 0x436846c7 */
217 1.1767937469e+02, /* 0x42eb5bd7 */
218 8.3646392822e+00, /* 0x4105d590 */
219};
220
221static float
222ponef(float x)
223{
224 const float *p,*q;
225 float z,r,s;
226 int32_t ix;
227 GET_FLOAT_WORD(ix,x)do { ieee_float_shape_type gf_u; gf_u.value = (x); (ix) = gf_u
.word; } while (0);
228 ix &= 0x7fffffff;
229 if(ix>=0x41000000) {p = pr8; q= ps8;}
230 else if(ix>=0x40f71c58){p = pr5; q= ps5;}
231 else if(ix>=0x4036db68){p = pr3; q= ps3;}
232 else if(ix>=0x40000000){p = pr2; q= ps2;}
233 z = one/(x*x);
234 r = p[0]+z*(p[1]+z*(p[2]+z*(p[3]+z*(p[4]+z*p[5]))));
235 s = one+z*(q[0]+z*(q[1]+z*(q[2]+z*(q[3]+z*q[4]))));
236 return one+ r/s;
237}
238
239
240/* For x >= 8, the asymptotic expansions of qone is
241 * 3/8 s - 105/1024 s^3 - ..., where s = 1/x.
242 * We approximate pone by
243 * qone(x) = s*(0.375 + (R/S))
244 * where R = qr1*s^2 + qr2*s^4 + ... + qr5*s^10
245 * S = 1 + qs1*s^2 + ... + qs6*s^12
246 * and
247 * | qone(x)/s -0.375-R/S | <= 2 ** ( -61.13)
248 */
249
250static const float qr8[6] = { /* for x in [inf, 8]=1/[0,0.125] */
251 0.0000000000e+00, /* 0x00000000 */
252 -1.0253906250e-01, /* 0xbdd20000 */
253 -1.6271753311e+01, /* 0xc1822c8d */
254 -7.5960174561e+02, /* 0xc43de683 */
255 -1.1849806641e+04, /* 0xc639273a */
256 -4.8438511719e+04, /* 0xc73d3683 */
257};
258static const float qs8[6] = {
259 1.6139537048e+02, /* 0x43216537 */
260 7.8253862305e+03, /* 0x45f48b17 */
261 1.3387534375e+05, /* 0x4802bcd6 */
262 7.1965775000e+05, /* 0x492fb29c */
263 6.6660125000e+05, /* 0x4922be94 */
264 -2.9449025000e+05, /* 0xc88fcb48 */
265};
266
267static const float qr5[6] = { /* for x in [8,4.5454]=1/[0.125,0.22001] */
268 -2.0897993405e-11, /* 0xadb7d219 */
269 -1.0253904760e-01, /* 0xbdd1fffe */
270 -8.0564479828e+00, /* 0xc100e736 */
271 -1.8366960144e+02, /* 0xc337ab6b */
272 -1.3731937256e+03, /* 0xc4aba633 */
273 -2.6124443359e+03, /* 0xc523471c */
274};
275static const float qs5[6] = {
276 8.1276550293e+01, /* 0x42a28d98 */
277 1.9917987061e+03, /* 0x44f8f98f */
278 1.7468484375e+04, /* 0x468878f8 */
279 4.9851425781e+04, /* 0x4742bb6d */
280 2.7948074219e+04, /* 0x46da5826 */
281 -4.7191835938e+03, /* 0xc5937978 */
282};
283
284static const float qr3[6] = {
285 -5.0783124372e-09, /* 0xb1ae7d4f */
286 -1.0253783315e-01, /* 0xbdd1ff5b */
287 -4.6101160049e+00, /* 0xc0938612 */
288 -5.7847221375e+01, /* 0xc267638e */
289 -2.2824453735e+02, /* 0xc3643e9a */
290 -2.1921012878e+02, /* 0xc35b35cb */
291};
292static const float qs3[6] = {
293 4.7665153503e+01, /* 0x423ea91e */
294 6.7386511230e+02, /* 0x4428775e */
295 3.3801528320e+03, /* 0x45534272 */
296 5.5477290039e+03, /* 0x45ad5dd5 */
297 1.9031191406e+03, /* 0x44ede3d0 */
298 -1.3520118713e+02, /* 0xc3073381 */
299};
300
301static const float qr2[6] = {/* for x in [2.8570,2]=1/[0.3499,0.5] */
302 -1.7838172539e-07, /* 0xb43f8932 */
303 -1.0251704603e-01, /* 0xbdd1f475 */
304 -2.7522056103e+00, /* 0xc0302423 */
305 -1.9663616180e+01, /* 0xc19d4f16 */
306 -4.2325313568e+01, /* 0xc2294d1f */
307 -2.1371921539e+01, /* 0xc1aaf9b2 */
308};
309static const float qs2[6] = {
310 2.9533363342e+01, /* 0x41ec4454 */
311 2.5298155212e+02, /* 0x437cfb47 */
312 7.5750280762e+02, /* 0x443d602e */
313 7.3939318848e+02, /* 0x4438d92a */
314 1.5594900513e+02, /* 0x431bf2f2 */
315 -4.9594988823e+00, /* 0xc09eb437 */
316};
317
318static float
319qonef(float x)
320{
321 const float *p,*q;
17
←
'p' declared without an initial value
→
322 float s,r,z;
323 int32_t ix;
324 GET_FLOAT_WORD(ix,x)do { ieee_float_shape_type gf_u; gf_u.value = (x); (ix) = gf_u
.word; } while (0);
18
←
Loop condition is false. Exiting loop
→
325 ix &= 0x7fffffff;
326 if(ix>=0x40200000) {p = qr8; q= qs8;}
19
←
Assuming 'ix' is < 1075838976
→
20
←
Taking false branch
→
327 else if(ix
20.1
'ix' is < 1089936472
>=0x40f71c58){p = qr5; q= qs5;}
21
←
Taking false branch
→
328 else if(ix
21.1
'ix' is < 1077336936
>=0x4036db68){p = qr3; q= qs3;}
22
←
Taking false branch
→
329 else if(ix>=0x40000000){p = qr2; q= qs2;}
23
←
Assuming 'ix' is < 1073741824
→
24
←
Taking false branch
→
330 z = one/(x*x);
331 r = p[0]+z*(p[1]+z*(p[2]+z*(p[3]+z*(p[4]+z*p[5]))));
25
←
Array access (from variable 'p') results in an undefined pointer dereference
332 s = one+z*(q[0]+z*(q[1]+z*(q[2]+z*(q[3]+z*(q[4]+z*q[5])))));
333 return ((float).375 + r/s)/x;
334}