/usr/src/gnu/usr.bin/binutils-2.17/ld/ldctor.c

Bug Summary

File:	src/gnu/usr.bin/binutils-2.17/ld/ldctor.c
Warning:	line 296, column 8 Access to field 'xvec' results in a dereference of a null pointer (loaded from field 'owner')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ldctor.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/binutils-2.17/obj/ld -resource-dir /usr/local/lib/clang/13.0.0 -D HAVE_CONFIG_H -I . -I /usr/src/gnu/usr.bin/binutils-2.17/ld -I . -D _GNU_SOURCE -I . -I /usr/src/gnu/usr.bin/binutils-2.17/ld -I ../bfd -I /usr/src/gnu/usr.bin/binutils-2.17/ld/../bfd -I /usr/src/gnu/usr.bin/binutils-2.17/ld/../include -I /usr/src/gnu/usr.bin/binutils-2.17/ld/../intl -I ../intl -D PIE_DEFAULT=1 -D LOCALEDIR="/usr/share/locale" -D PIE_DEFAULT=1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-null-pointer-arithmetic -fdebug-compilation-dir=/usr/src/gnu/usr.bin/binutils-2.17/obj/ld -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/gnu/usr.bin/binutils-2.17/ld/ldctor.c

1/* ldctor.c -- constructor support routines
 Copyright 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
 2002, 2003, 2004 Free Software Foundation, Inc.
 By Steve Chamberlain <sac@cygnus.com>

6This file is part of GLD, the Gnu Linker.

8GLD is free software; you can redistribute it and/or modify
9it under the terms of the GNU General Public License as published by
10the Free Software Foundation; either version 2, or (at your option)
11any later version.

13GLD is distributed in the hope that it will be useful,
14but WITHOUT ANY WARRANTY; without even the implied warranty of
15MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16GNU General Public License for more details.

18You should have received a copy of the GNU General Public License
19along with GLD; see the file COPYING.  If not, write to the Free
20Software Foundation, 51 Franklin Street - Fifth Floor, Boston, MA
2102110-1301, USA.  */

23#include "bfd.h"
24#include "sysdep.h"
25#include "bfdlink.h"
26#include "safe-ctype.h"

28#include "ld.h"
29#include "ldexp.h"
30#include "ldlang.h"
31#include "ldmisc.h"
32#include <ldgram.h>
33#include "ldmain.h"
34#include "ldctor.h"

36/* The list of statements needed to handle constructors.  These are
 invoked by the command CONSTRUCTORS in the linker script.  */
38lang_statement_list_type constructor_list;

40/* Whether the constructors should be sorted.  Note that this is
 global for the entire link; we assume that there is only a single
 CONSTRUCTORS command in the linker script.  */
43bfd_boolean constructors_sorted;

45/* The sets we have seen.  */
46struct set_info *sets;

48/* Add an entry to a set.  H is the entry in the linker hash table.
 RELOC is the relocation to use for an entry in the set.  SECTION
 and VALUE are the value to add.  This is called during the first
 phase of the link, when we are still gathering symbols together.
 We just record the information now.  The ldctor_build_sets
 function will construct the sets.  */

55void
56ldctor_add_set_entry (struct bfd_link_hash_entry *h,
      bfd_reloc_code_real_type reloc,
      const char *name,
      asection *section,
      bfd_vma value)
61{
struct set_info *p;
struct set_element *e;
struct set_element **epp;

for (p = sets; p != NULL((void *)0); p = p->next)
  if (p->h == h)
    break;

if (p == NULL((void *)0))
  {
    p = xmalloc (sizeof (struct set_info));
    p->next = sets;
    sets = p;
    p->h = h;
    p->reloc = reloc;
    p->count = 0;
    p->elements = NULL((void *)0);
  }
else
  {
    if (p->reloc != reloc)
{
 einfo (_("%P%X: Different relocs used in set %s\n")("%P%X: Different relocs used in set %s\n"),
 h->root.string);
 return;
}

    /* Don't permit a set to be constructed from different object
       file formats.  The same reloc may have different results.  We
       actually could sometimes handle this, but the case is
       unlikely to ever arise.  Sometimes constructor symbols are in
       unusual sections, such as the absolute section--this appears
       to be the case in Linux a.out--and in such cases we just
       assume everything is OK.  */
    if (p->elements != NULL((void *)0)
 && section->owner != NULL((void *)0)
 && p->elements->section->owner != NULL((void *)0)
 && strcmp (bfd_get_target (section->owner)((section->owner)->xvec->name),
     bfd_get_target (p->elements->section->owner)((p->elements->section->owner)->xvec->name)) != 0)
{
 einfo (_("%P%X: Different object file formats composing set %s\n")("%P%X: Different object file formats composing set %s\n"),
 h->root.string);
 return;
}
  }

e = xmalloc (sizeof (struct set_element));
e->next = NULL((void *)0);
e->name = name;
e->section = section;
e->value = value;

for (epp = &p->elements; *epp != NULL((void *)0); epp = &(*epp)->next)
  ;
*epp = e;

++p->count;
119}

121/* Get the priority of a g++ global constructor or destructor from the
 symbol name.  */

124static int
125ctor_prio (const char *name)
126{
/* The name will look something like _GLOBAL_$I$65535$test02__Fv.
   There might be extra leading underscores, and the $ characters
   might be something else.  The I might be a D.  */

while (*name == '_')
  ++name;

if (strncmp (name, "GLOBAL_", sizeof "GLOBAL_" - 1) != 0)
  return -1;

name += sizeof "GLOBAL_" - 1;

if (name[0] != name[2])
  return -1;
if (name[1] != 'I' && name[1] != 'D')
  return -1;
if (! ISDIGIT (name[3])(_sch_istable[(name[3]) & 0xff] & (unsigned short)(_sch_isdigit
)))
  return -1;

return atoi (name + 3);
147}

149/* This function is used to sort constructor elements by priority.  It
 is called via qsort.  */

152static int
153ctor_cmp (const void *p1, const void *p2)
154{
const struct set_element * const *pe1 = p1;
const struct set_element * const *pe2 = p2;
const char *n1;
const char *n2;
int prio1;
int prio2;

n1 = (*pe1)->name;
if (n1 == NULL((void *)0))
  n1 = "";
n2 = (*pe2)->name;
if (n2 == NULL((void *)0))
  n2 = "";

/* We need to sort in reverse order by priority.  When two
   constructors have the same priority, we should maintain their
   current relative position.  */

prio1 = ctor_prio (n1);
prio2 = ctor_prio (n2);

/* We sort in reverse order because that is what g++ expects.  */
if (prio1 < prio2)
  return 1;
else if (prio1 > prio2)
  return -1;

/* Force a stable sort.  */

if (pe1 < pe2)
  return -1;
else if (pe1 > pe2)
  return 1;
else
  return 0;
190}

192/* This function is called after the first phase of the link and
 before the second phase.  At this point all set information has
 been gathered.  We now put the statements to build the sets
 themselves into constructor_list.  */

197void
198ldctor_build_sets (void)
199{
static bfd_boolean called;
lang_statement_list_type *old;
bfd_boolean header_printed;
struct set_info *p;

/* The emulation code may call us directly, but we only want to do
   this once.  */
if (called0.1
'called' is 0
)
1
Taking false branch→
  return;
called = TRUE1;

if (constructors_sorted)
2
←
Assuming 'constructors_sorted' is 0→
3
←
Taking false branch→
  {
    for (p = sets; p != NULL((void *)0); p = p->next)
{
 int c, i;
 struct set_element *e;
 struct set_element **array;

 if (p->elements == NULL((void *)0))
   continue;

 c = 0;
 for (e = p->elements; e != NULL((void *)0); e = e->next)
   ++c;

 array = xmalloc (c * sizeof *array);

 i = 0;
 for (e = p->elements; e != NULL((void *)0); e = e->next)
   {
     array[i] = e;
     ++i;
   }

 qsort (array, c, sizeof *array, ctor_cmp);

 e = array[0];
 p->elements = e;
 for (i = 0; i < c - 1; i++)
   array[i]->next = array[i + 1];
 array[i]->next = NULL((void *)0);

 free (array);
}
  }

old = stat_ptr;
stat_ptr = &constructor_list;

lang_list_init (stat_ptr);

header_printed = FALSE0;
for (p = sets; p != NULL((void *)0); p = p->next)
4
←
Assuming 'p' is not equal to NULL→
5
←
Loop condition is true.  Entering loop body→
  {
    struct set_element *e;
    reloc_howto_type *howto;
    int reloc_size, size;

    /* If the symbol is defined, we may have been invoked from
collect, and the sets may already have been built, so we do
not do anything.  */
    if (p->h->type == bfd_link_hash_defined
6
←
Assuming field 'type' is not equal to bfd_link_hash_defined→
8
←
Taking false branch→
 || p->h->type == bfd_link_hash_defweak)
7
←
Assuming field 'type' is not equal to bfd_link_hash_defweak→
continue;

    /* For each set we build:
  set:
    .long number_of_elements
    .long element0
    ...
    .long elementN
    .long 0
except that we use the right size instead of .long.  When
generating relocatable output, we generate relocs instead of
addresses.  */
    howto = bfd_reloc_type_lookup (output_bfd, p->reloc);
    if (howto == NULL((void *)0))
9
←
Assuming 'howto' is equal to NULL→
10
←
Taking true branch→
{
 if (link_info.relocatable)
11
←
Assuming field 'relocatable' is 0→
12
←
Taking false branch→
   {
     einfo (_("%P%X: %s does not support reloc %s for set %s\n")("%P%X: %s does not support reloc %s for set %s\n"),
     bfd_get_target (output_bfd)((output_bfd)->xvec->name),
     bfd_get_reloc_code_name (p->reloc),
     p->h->root.string);
     continue;
   }

 /* If this is not a relocatable link, all we need is the
    size, which we can get from the input BFD.  */
 if (p->elements->section->owner != NULL((void *)0))
13
←
Assuming field 'owner' is equal to NULL→
14
←
Taking false branch→
   howto = bfd_reloc_type_lookup (p->elements->section->owner,
			   p->reloc);
 if (howto14.1
'howto' is equal to NULL
 == NULL((void *)0))
15
←
Taking true branch→
   {
     einfo (_("%P%X: %s does not support reloc %s for set %s\n")("%P%X: %s does not support reloc %s for set %s\n"),
     bfd_get_target (p->elements->section->owner)((p->elements->section->owner)->xvec->name),
16
←
Access to field 'xvec' results in a dereference of a null pointer (loaded from field 'owner')
     bfd_get_reloc_code_name (p->reloc),
     p->h->root.string);
     continue;
   }
}

    reloc_size = bfd_get_reloc_size (howto);
    switch (reloc_size)
{
case 1: size = BYTE285; break;
case 2: size = SHORT284; break;
case 4: size = LONG283; break;
case 8:
 if (howto->complain_on_overflow == complain_overflow_signed)
   size = SQUAD282;
 else
   size = QUAD281;
 break;
default:
 einfo (_("%P%X: Unsupported size %d for set %s\n")("%P%X: Unsupported size %d for set %s\n"),
 bfd_get_reloc_size (howto), p->h->root.string);
 size = LONG283;
 break;
}

    lang_add_assignment (exp_assop ('=', ".",
		      exp_unop (ALIGN_K278,
				exp_intop (reloc_size))));
    lang_add_assignment (exp_assop ('=', p->h->root.string,
		      exp_nameop (NAME258, ".")));
    lang_add_data (size, exp_intop (p->count));

    for (e = p->elements; e != NULL((void *)0); e = e->next)
{
 if (config.map_file != NULL((void *)0))
   {
     int len;

     if (! header_printed)
{
  minfo (_("\nSet                 Symbol\n\n")("\nSet                 Symbol\n\n"));
  header_printed = TRUE1;
}

     minfo ("%s", p->h->root.string);
     len = strlen (p->h->root.string);

     if (len >= 19)
{
  print_nl ();
  len = 0;
}
     while (len < 20)
{
  print_space ();
  ++len;
}

     if (e->name != NULL((void *)0))
minfo ("%T\n", e->name);
     else
minfo ("%G\n", e->section->owner, e->section, e->value);
   }

 /* Need SEC_KEEP for --gc-sections.  */
 if (! bfd_is_abs_section (e->section)((e->section) == ((asection *) &bfd_abs_section)))
   e->section->flags |= SEC_KEEP0x400000;

 if (link_info.relocatable)
   lang_add_reloc (p->reloc, howto, e->section, e->name,
	    exp_intop (e->value));
 else
   lang_add_data (size, exp_relop (e->section, e->value));
}

    lang_add_data (size, exp_intop (0));
  }

stat_ptr = old;
376}