Use static analyzer to find potential memory bugs

[micro128390]

When writing C we must ensure we code safely, especially with memory functions, i.e. we don't use-after-free or double-free or null-dereference...

Tools to help discover these issues exist, e.g. splint, cppcheck, infer...

Here is a run of infer against your codebase:

$ infer run -- make
Capturing in make/cc mode...
Found 9 source files to analyze in /dir/viw/infer-out
Starting analysis...

legend:
  "F" analyzing a file
  "." analyzing a procedure

FFFFFFFF...............................F..............................................................................

Found 14 issues

src/buffer.c:40: error: NULL_DEREFERENCE
  pointer `ec` last assigned on line 36 could be null and is dereferenced at line 40, column 3
  38.     echar_t *prev = NULL;
  39.
  40. >   ec->c = c;
  41.     ec->prev = NULL;
  42.     ec->next = NULL;

src/buffer.c:113: error: NULL_DEREFERENCE
  pointer `buf` last assigned on line 111 could be null and is dereferenced at line 113, column 3
  111.     buffer_t *buf = malloc(sizeof(buffer_t));
  112.
  113. >   buf->num_rows = 0;
  114.     buf->head = NULL;
  115.     buf->last = NULL;

<...SNIP...>


Summary of the reports

  NULL_DEREFERENCE: 14

(Most issues detected by infer here are due to not checking if malloc failed, but there is one where a fopen is not checked either.)

I suggest you employ some static analyzers to help you check your code as part of your regular development process (and before accepting PRs). Good luck!

Links:

• https://github.com/mre/awesome-static-analysis
• https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#C.2C_C.2B.2B
• https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml
• https://www.owasp.org/index.php/Source_Code_Analysis_Tools
• https://www.securecoding.cert.org/confluence/display/seccode/SEI+CERT+Coding+Standards
• https://stackoverflow.com/questions/2248995/is-there-a-need-to-check-for-null-after-allocating-memory-when-kernel-uses-over

[lpan]

Thank you so much! I will try to add it to this project in the near future 👍