New Defects reported by Coverity Scan for LibreOffice

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.

10 new defect(s) introduced to LibreOffice found with Coverity Scan.
5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 10 of 10 defect(s)


** CID 1497939:  Integer handling issues  (DIVIDE_BY_ZERO)
/tools/source/generic/fract.cxx: 186 in <unnamed>::checked_multiply_by(boost::rational<int> &, const boost::rational<int> &)()


________________________________________________________________________________________________________
*** CID 1497939:  Integer handling issues  (DIVIDE_BY_ZERO)
/tools/source/generic/fract.cxx: 186 in <unnamed>::checked_multiply_by(boost::rational<int> &, const boost::rational<int> &)()
180     
181             // Avoid overflow and preserve normalization
182             sal_Int32 gcd1 = std::gcd(i.numerator(), den);
183             sal_Int32 gcd2 = std::gcd(num, i.denominator());
184     
185             bool fail = false;
>>>     CID 1497939:  Integer handling issues  (DIVIDE_BY_ZERO)
>>>     In expression "i->numerator() / gcd1", division by expression "gcd1" which may be zero has undefined behavior.
186             fail |= o3tl::checked_multiply(i.numerator() / gcd1, num / gcd2, num);
187             fail |= o3tl::checked_multiply(i.denominator() / gcd2, den / gcd1, den);
188     
189             if (!fail)
190                 i.assign(num, den);
191     

** CID 1497938:  Uninitialized members  (UNINIT_CTOR)
/vcl/source/gdi/print3.cxx: 208 in vcl::ImplPrinterControllerData::ImplPrinterControllerData()()


________________________________________________________________________________________________________
*** CID 1497938:  Uninitialized members  (UNINIT_CTOR)
/vcl/source/gdi/print3.cxx: 208 in vcl::ImplPrinterControllerData::ImplPrinterControllerData()()
202             mbPapersizeFromUser( false ),
203             mbOrientationFromUser( false ),
204             mbPrinterModified( false ),
205             meJobState( css::view::PrintableState_JOB_STARTED ),
206             mnDefaultPaperBin( -1 ),
207             mnFixedPaperBin( -1 )
>>>     CID 1497938:  Uninitialized members  (UNINIT_CTOR)
>>>     Non-static class member "meUserOrientation" is not initialized in this constructor nor in any functions that it calls.
208         {}
209     
210         ~ImplPrinterControllerData()
211         {
212             if (mxProgress)
213             {

** CID 1497937:  Integer handling issues  (DIVIDE_BY_ZERO)
/tools/source/generic/fract.cxx: 186 in <unnamed>::checked_multiply_by(boost::rational<int> &, const boost::rational<int> &)()


________________________________________________________________________________________________________
*** CID 1497937:  Integer handling issues  (DIVIDE_BY_ZERO)
/tools/source/generic/fract.cxx: 186 in <unnamed>::checked_multiply_by(boost::rational<int> &, const boost::rational<int> &)()
180     
181             // Avoid overflow and preserve normalization
182             sal_Int32 gcd1 = std::gcd(i.numerator(), den);
183             sal_Int32 gcd2 = std::gcd(num, i.denominator());
184     
185             bool fail = false;
>>>     CID 1497937:  Integer handling issues  (DIVIDE_BY_ZERO)
>>>     In expression "num / gcd2", division by expression "gcd2" which may be zero has undefined behavior.
186             fail |= o3tl::checked_multiply(i.numerator() / gcd1, num / gcd2, num);
187             fail |= o3tl::checked_multiply(i.denominator() / gcd2, den / gcd1, den);
188     
189             if (!fail)
190                 i.assign(num, den);
191     

** CID 1497936:  API usage errors  (SWAPPED_ARGUMENTS)


________________________________________________________________________________________________________
*** CID 1497936:  API usage errors  (SWAPPED_ARGUMENTS)
/vcl/source/gdi/print3.cxx: 236 in vcl::ImplPrinterControllerData::getRealPaperSize(const Size &, bool) const()
230             if(mbOrientationFromUser)
231             {
232                 if ( (meUserOrientation == Orientation::Portrait && size.Width() > size.Height()) ||
233                      (meUserOrientation == Orientation::Landscape && size.Width() < size.Height()) )
234                 {
235                     // coverity[swapped-arguments : FALSE] - this is in the correct order
>>>     CID 1497936:  API usage errors  (SWAPPED_ARGUMENTS)
>>>     The positions of arguments in the constructor for "Size" do not match the ordering of the parameters:
* "size.Height()" is passed to "nWidth".
* "size.Width()" is passed to "nHeight".
236                     size = Size( size.Height(), size.Width() );
237                 }
238             }
239             return size;
240         }
241         PrinterController::PageSize modifyJobSetup( const css::uno::Sequence< css::beans::PropertyValue >& i_rProps );

** CID 1497935:  Integer handling issues  (DIVIDE_BY_ZERO)
/include/o3tl/unit_conversion.hxx: 138 in o3tl::detail::prepareMDArray<(int)20>(const o3tl::detail::m_and_d (&)[T1])()


________________________________________________________________________________________________________
*** CID 1497935:  Integer handling issues  (DIVIDE_BY_ZERO)
/include/o3tl/unit_conversion.hxx: 138 in o3tl::detail::prepareMDArray<(int)20>(const o3tl::detail::m_and_d (&)[T1])()
132             for (int j = 0; j < i; ++j)
133             {
134                 assert(mdBase[i].m < SAL_MAX_INT64 / mdBase[j].d);
135                 assert(mdBase[i].d < SAL_MAX_INT64 / mdBase[j].m);
136                 const sal_Int64 m = mdBase[i].m * mdBase[j].d, d = mdBase[i].d * mdBase[j].m;
137                 const sal_Int64 g = std::gcd(m, d);
>>>     CID 1497935:  Integer handling issues  (DIVIDE_BY_ZERO)
>>>     In expression "m / g", division by expression "g" which may be zero has undefined behavior.
138                 a[i][j] = m / g;
139                 a[j][i] = d / g;
140             }
141         }
142         return a;
143     }

** CID 1497934:  Integer handling issues  (DIVIDE_BY_ZERO)
/include/o3tl/unit_conversion.hxx: 116 in o3tl::detail::m_and_d::m_and_d(long, long)()


________________________________________________________________________________________________________
*** CID 1497934:  Integer handling issues  (DIVIDE_BY_ZERO)
/include/o3tl/unit_conversion.hxx: 116 in o3tl::detail::m_and_d::m_and_d(long, long)()
110     // Packs integral multiplier and divisor for conversion from one unit to another
111     struct m_and_d
112     {
113         sal_Int64 m; // multiplier
114         sal_Int64 d; // divisor
115         constexpr m_and_d(sal_Int64 _m, sal_Int64 _d)
>>>     CID 1497934:  Integer handling issues  (DIVIDE_BY_ZERO)
>>>     In expression "_m / std::gcd(_m, _d)", division by expression "std::gcd(_m, _d)" which may be zero has undefined behavior.
116             : m(_m / std::gcd(_m, _d)) // make sure to use smallest quotients here because
117             , d(_d / std::gcd(_m, _d)) // they will be multiplied when building final table
118         {
119             assert(_m > 0 && _d > 0);
120         }
121     };

** CID 1497933:  Integer handling issues  (NO_EFFECT)
/workdir/YaccTarget/connectivity/source/parse/sqlbison.cxx: 10238 in connectivity::OSQLParser::TokenIDToStr(unsigned int, const connectivity::IParseContext *)()


________________________________________________________________________________________________________
*** CID 1497933:  Integer handling issues  (NO_EFFECT)
/workdir/YaccTarget/connectivity/source/parse/sqlbison.cxx: 10238 in connectivity::OSQLParser::TokenIDToStr(unsigned int, const connectivity::IParseContext *)()
10232     		if ( eKeyCode != IParseContext::InternationalKeyCode::None )
10233     		    aStr = pContext->getIntlKeywordAscii(eKeyCode);
10234     	}
10235     
10236     	if (aStr.isEmpty())
10237     	{
>>>     CID 1497933:  Integer handling issues  (NO_EFFECT)
>>>     This greater-than-or-equal-to-zero comparison of an unsigned value is always true. "0U <= nTokenID".
10238     		aStr = yytname[YYTRANSLATE(nTokenID)];
10239     		if(aStr.startsWith("SQL_TOKEN_"))
10240     			aStr = aStr.copy(10);
10241     		switch( nTokenID )
10242     		{
10243     			case SQL_TOKEN_OJ:

** CID 1497932:  Null pointer dereferences  (FORWARD_NULL)


________________________________________________________________________________________________________
*** CID 1497932:  Null pointer dereferences  (FORWARD_NULL)
/sw/source/core/layout/paintfrm.cxx: 6580 in SwFrame::PaintSwFrameBackground(const SwRect &, const SwPageFrame *, const SwBorderAttrs &, bool, bool, bool) const()
6574                                 if( !aRegion[i].HasArea() )
6575                                   continue;
6576                             }
6577                         //  add 6th parameter to indicate, if background transparency have to be considered
6578                         //     Set missing 5th parameter to the default value GRFNUM_NO
6579                         //         - see declaration in /core/inc/frmtool.hxx.
>>>     CID 1497932:  Null pointer dereferences  (FORWARD_NULL)
>>>     Passing null pointer "pOut" to "DrawGraphic", which dereferences it.
6580                             ::DrawGraphic(
6581                                     pItem,
6582                                     *pOut,
6583                                     aOrigBackRect,
6584                                     aRegion[i],
6585                                     GRFNUM_NO,

** CID 1458078:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)
/workdir/YaccTarget/idlc/source/parser.cxx: 1698 in yysyntax_error(long *, char **, short *, int)()


________________________________________________________________________________________________________
*** CID 1458078:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)
/workdir/YaccTarget/idlc/source/parser.cxx: 1698 in yysyntax_error(long *, char **, short *, int)()
1692       }
1693     
1694       if (*yymsg_alloc < yysize)
1695         {
1696           *yymsg_alloc = 2 * yysize;
1697           if (! (yysize <= *yymsg_alloc
>>>     CID 1458078:  Integer handling issues  (CONSTANT_EXPRESSION_RESULT)
>>>     "*yymsg_alloc <= 9223372036854775807L /* static_cast<long>((9223372036854775807L < static_cast<unsigned long>(-1)) ? 9223372036854775807L : static_cast<unsigned long>(-1)) */" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&".
1698                  && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
1699             *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
1700           return 1;
1701         }
1702     
1703       /* Avoid sprintf, as that infringes on the user's name space.

** CID 1458075:    (CONSTANT_EXPRESSION_RESULT)
/workdir/YaccTarget/idlc/source/parser.cxx: 1688 in yysyntax_error(long *, char **, short *, int)()
/workdir/YaccTarget/idlc/source/parser.cxx: 1659 in yysyntax_error(long *, char **, short *, int)()


________________________________________________________________________________________________________
*** CID 1458075:    (CONSTANT_EXPRESSION_RESULT)
/workdir/YaccTarget/idlc/source/parser.cxx: 1688 in yysyntax_error(long *, char **, short *, int)()
1682         }
1683     
1684       {
1685         /* Don't count the "%s"s in the final size, but reserve room for
1686            the terminator.  */
1687         YYPTRDIFF_T yysize1 = yysize + (yystrlen (yyformat) - 2 * yycount) + 1;
>>>     CID 1458075:    (CONSTANT_EXPRESSION_RESULT)
>>>     "yysize1 <= 9223372036854775807L /* static_cast<long>((9223372036854775807L < static_cast<unsigned long>(-1)) ? 9223372036854775807L : static_cast<unsigned long>(-1)) */" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&".
1688         if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
1689           yysize = yysize1;
1690         else
1691           return 2;
1692       }
1693     
/workdir/YaccTarget/idlc/source/parser.cxx: 1659 in yysyntax_error(long *, char **, short *, int)()
1653                         break;
1654                       }
1655                     yyarg[yycount++] = yytname[yyx];
1656                     {
1657                       YYPTRDIFF_T yysize1
1658                         = yysize + yytnamerr (YY_NULLPTR, yytname[yyx]);
>>>     CID 1458075:    (CONSTANT_EXPRESSION_RESULT)
>>>     "yysize1 <= 9223372036854775807L /* static_cast<long>((9223372036854775807L < static_cast<unsigned long>(-1)) ? 9223372036854775807L : static_cast<unsigned long>(-1)) */" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&".
1659                       if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
1660                         yysize = yysize1;
1661                       else
1662                         return 2;
1663                     }
1664                   }


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50ypSs1kiFPuCn2xFdlMIFBirii0zZ9j2-2F9F2XPBcBm2BNgi9duPy3v-2FzgFDd2LJ-2BDKI-3D8JBB_OTq2XUZbbipYjyLSo6GRo-2FpVxQ9OzkDINu9UTS-2FQhSdO0F0jQniitrGlNxDIzPJiX3XfnuEg9gWCN6o4B4DRi-2B1sDNXKyznWHiYtrICRlztWuszacelNpdmKRIqpNawK7lJQZuZzkta67u635pafhPF1SWiFQ3It-2Bfe9V2iw7Y-2F2ADQZwJ1kBGFNg7kn7toniDdAKM7EoJSS5IEWkC1VPa3JZRgdZjnNhVn0L1FtE30-3D




[Index of Archives]     [LARTC]     [Bugtraq]     [Yosemite Forum]     [Photo]

  Powered by Linux