Skip to content

[Coverity 1666161] Dereference after null check in rtp/ac3.c

Either the check against null is unnecessary, or there may be a null pointer dereference.

In rtp_ac3_decode: Pointer is checked against null but then dereferenced anyway (CWE-476)

      5. Condition src->frags == NULL, taking true branch.
      6. var_compare_op: Comparing src->frags to null implies that src->frags might be null.
176    if (src->frags == NULL) {
      7. Condition frametype == 3, taking false branch.
177        if (frametype == 3) {
178            /* Missed start of current frame. Not much to do without header. */
179            assert(!sys->enhanced);
180            block_Release(block);
181            vlc_warning(log, "reassembly error: missing initial fragment");
182            return;
183        }
184
185        /* Initial fragment of a new frame */
      8. Condition framenum == 0, taking false branch.
186        if (framenum == 0) {
187            block_Release(block);
188            return;
189        }
190
191        src->missing = framenum;
192    }
193
      9. Condition src->missing > 0, taking true branch.
      10. Falling through to end of if statement.
194    assert(src->missing > 0);
195    src->missing--;
196    *src->frag_end = block;
197    src->frag_end = &block->p_next;
198
      11. Condition info->m, taking true branch.
199    if (info->m) {
      12. Condition src->missing != 0, taking true branch.
200        if (src->missing != 0) {
     
CID 1666161: (#2 of 2): Dereference after null check (FORWARD_NULL)
13. var_deref_op: Dereferencing null pointer src->frags.
201            src->frags->i_flags |= BLOCK_FLAG_CORRUPTED;
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information