Re: clang static analyzer

Tomas Carnecky [off-list ref] writes:

xdiff-interface.c:xdiff_set_find_func() - When 'value' is a string with
no newline character in it, the loop at line 291 sets 'value' to NULL on
its first iteration and then passes 'value' to strchr() in the second
iteration.

Thanks, but I am confused with your analysis.

If value doesn't have '\n', then regs->nr is 1 when you go into the loop
at ll. 291-, because we counted the number of LF in the first loop in the
function.

The first iteration of the second loop sets ep to NULL, expression is set
to value, then we run regcomp on the expression.  Then at the end of the
loop we do set value to a bogus "(char*)1".  But incrementing i makes it
go over regs->nr and satisfy the termination condition of the loop; we
happily exit the loop before we use the now bogus "value".