summaryrefslogtreecommitdiffstats
path: root/libxslt/check_valuePopNullDeref.v1.cocci
blob: df8d3797e61db0cc2d56d6deed974a06cecc1b8e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
// See: https://mail.gnome.org/archives/xslt/2013-December/msg00008.html
// Fix possible NULL deref for valuePop retval
// jpokorny redhat com

@incl@
@@

#include <libxml/xpathInternals.h>

@voidfn depends on incl exists@
expression E;
identifier fn, f, item;
statement S1, S2;
@@
void fn (...) {
<...
E = valuePop(...);
+ if (E == NULL) return;
... when != if (E == NULL) S1 else S2
(
E->item;
|
E->item
)
...>
}

// for cases the function is non-void (which implicitly supposes
// a pointer as a return value rather than anything else);
// not found helpful in libxslt case presently anyway
//@nonvoidfn depends on incl exists@
//expression E;
//identifier fn != voidfn.fn, f, item;
//statement S1, S2;
//@@
//fn (...) {
//<...
//E = valuePop(...);
//+ if (E == NULL) return NULL;
//... when != if (E == NULL) S1 else S2
//(
//E->item;
//|
//E->item
//)
//...>
//}