Suspicious code in revision 867140
bartoschek at gmx.de
Fri Oct 3 15:27:53 BST 2008
here are the reports for revision 864329 that had no feedback:
If the condition in line 225 is true for the first iteration then the shift
amount is i - 1 == -1 in line 226. This is invalid.
A signal handler that calls for example waitpid has to save errno before and
restore it afterwards.
Line 604 indicates that mVerticalLinesDistance can be 0. If this is the case
and the execution reaches this line, then a devision by 0 is the result.
- kdebase/workspace/ksysguard/gui/WorkSheet.cc:548, 551
If the condition in line 538 is false then newDisplay is NULL here.
There is no need to confuse the reader and use the bitwise-or here.
If line 270 is false and line 278 is false but line 298 is true, then butly
is NULL here.
Consider including <cmath> to see all overloads of abs().
If cmd == NULL in line 2259 then this line crashes.
The following items are for revision 867140:
It seems as if i and columns are not changed in the loop. An endless loop is
Line 234 indicates that declarator can be NULL. A crash follows here
high.red is quint16 and therefore always >= 0.
- kdesupport/qimageblitz/blitz/scale.cpp:165, 192, 223
If dh (dw, d) is 0 then a division by 0 is performed.
If buffer != "REV" and buffer != "NOREV" then revCheck is still true and
rev is uninitialized here. A final else for the if in line 86 is missing.
Is it really necessary to evaluate both sides of the |?
- kdelibs/kimgio/xcf.cpp:1211, 1476
If the switch in line 1157 (1421) does not find a case copy is not
and an invalid function pointer. Is it possible to crash the application with
invalid xcf files?
The local variable global is never changed.
d->wordCount is always > 1 here. Why? In line 216 savedActive and d->active
equal. To get to line 229 they have to be unequal due to line 228. But they
only change in lines 220 till 226. This lines however are only evaluated if
d->wordCount >= 10. Therefore (d->wordCount > 1) is always true.
A break might be missing
Add a todo comment about the false to not forget it. The loop 3598 is only
executed once. Same for 1983
Can mimeTypeFactory or serviceFactory or servicetypeFactory be still NULL
the loop in line 490?
m_loop points to a deallocated object here. It would be clearer to set it to
The result of the dynamic_casts is not used.
Add a todo comment about the 0 to not forget it.
Add a todo comment about the 0 to not forget it. Does this mean that
chains are always valid in khtml?
r_ofs and outsideEnd are used but never assigned.
Line 887 indicates that m_hBar can be false. If line 893 is true, then a
If line 1411 is false then docLoader is NULL here.
The allowed code range [DOM::RangeException::_EXCEPTION_OFFSET,
DOM::RangeException::_EXCEPTION_MAX} is wider than table rangeExceptionNames.
Line 284 indicates that hostExtender->d->applet might be NULL here.
More information about the kde-core-devel