Ticket #10371: report-152326.html

File report-152326.html, 19.9 KB (added by mt, 11 years ago)

Report by Clang Static Analyzer

Line 
1<!doctype html>
2<html>
3<head>
4<title>/home/haiku/haiku/haiku/src/kits/network/libnetapi/DataRequest.cpp</title>
5<style type="text/css">
6 body { color:#000000; background-color:#ffffff }
7 body { font-family:Helvetica, sans-serif; font-size:10pt }
8 h1 { font-size:14pt }
9 .code { border-collapse:collapse; width:100%; }
10 .code { font-family: "Monospace", monospace; font-size:10pt }
11 .code { line-height: 1.2em }
12 .comment { color: green; font-style: oblique }
13 .keyword { color: blue }
14 .string_literal { color: red }
15 .directive { color: darkmagenta }
16 .expansion { display: none; }
17 .macro:hover .expansion { display: block; border: 2px solid #FF0000; padding: 2px; background-color:#FFF0F0; font-weight: normal; -webkit-border-radius:5px; -webkit-box-shadow:1px 1px 7px #000; position: absolute; top: -1em; left:10em; z-index: 1 }
18 .macro { color: darkmagenta; background-color:LemonChiffon; position: relative }
19 .num { width:2.5em; padding-right:2ex; background-color:#eeeeee }
20 .num { text-align:right; font-size:8pt }
21 .num { color:#444444 }
22 .line { padding-left: 1ex; border-left: 3px solid #ccc }
23 .line { white-space: pre }
24 .msg { -webkit-box-shadow:1px 1px 7px #000 }
25 .msg { -webkit-border-radius:5px }
26 .msg { font-family:Helvetica, sans-serif; font-size:8pt }
27 .msg { float:left }
28 .msg { padding:0.25em 1ex 0.25em 1ex }
29 .msg { margin-top:10px; margin-bottom:10px }
30 .msg { font-weight:bold }
31 .msg { max-width:60em; word-wrap: break-word; white-space: pre-wrap }
32 .msgT { padding:0x; spacing:0x }
33 .msgEvent { background-color:#fff8b4; color:#000000 }
34 .msgControl { background-color:#bbbbbb; color:#000000 }
35 .mrange { background-color:#dfddf3 }
36 .mrange { border-bottom:1px solid #6F9DBE }
37 .PathIndex { font-weight: bold; padding:0px 5px; margin-right:5px; }
38 .PathIndex { -webkit-border-radius:8px }
39 .PathIndexEvent { background-color:#bfba87 }
40 .PathIndexControl { background-color:#8c8c8c }
41 .PathNav a { text-decoration:none; font-size: larger }
42 .CodeInsertionHint { font-weight: bold; background-color: #10dd10 }
43 .CodeRemovalHint { background-color:#de1010 }
44 .CodeRemovalHint { border-bottom:1px solid #6F9DBE }
45 table.simpletable {
46 padding: 5px;
47 font-size:12pt;
48 margin:20px;
49 border-collapse: collapse; border-spacing: 0px;
50 }
51 td.rowname {
52 text-align:right; font-weight:bold; color:#444444;
53 padding-right:2ex; }
54</style>
55</head>
56<body>
57<!-- BUGDESC Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete' -->
58
59<!-- BUGTYPE Bad deallocator -->
60
61<!-- BUGCATEGORY Memory Error -->
62
63<!-- BUGFILE /home/haiku/haiku/haiku/src/kits/network/libnetapi/DataRequest.cpp -->
64
65<!-- BUGLINE 103 -->
66
67<!-- BUGCOLUMN 3 -->
68
69<!-- BUGPATHLENGTH 14 -->
70
71<!-- BUGMETAEND -->
72<!-- REPORTHEADER -->
73<h3>Bug Summary</h3>
74<table class="simpletable">
75<tr><td class="rowname">File:</td><td>src/kits/network/libnetapi/DataRequest.cpp</td></tr>
76<tr><td class="rowname">Location:</td><td><a href="#EndPath">line 103, column 3</a></td></tr>
77<tr><td class="rowname">Description:</td><td>Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'</td></tr>
78</table>
79<!-- REPORTSUMMARYEXTRA -->
80<h3>Annotated Source Code</h3>
81<table class="code">
82<tr><td class="num" id="LN1">1</td><td class="line"><span class='comment'>/*</span></td></tr>
83<tr><td class="num" id="LN2">2</td><td class="line"> <span class='comment'>* Copyright 2013 Haiku, Inc. All rights reserved.</span></td></tr>
84<tr><td class="num" id="LN3">3</td><td class="line"> <span class='comment'>* Distributed under the terms of the MIT License.</span></td></tr>
85<tr><td class="num" id="LN4">4</td><td class="line"> <span class='comment'>*</span></td></tr>
86<tr><td class="num" id="LN5">5</td><td class="line"> <span class='comment'>* Authors:</span></td></tr>
87<tr><td class="num" id="LN6">6</td><td class="line"> <span class='comment'>* Adrien Destugues, pulkomandy@pulkomandy.tk</span></td></tr>
88<tr><td class="num" id="LN7">7</td><td class="line"> <span class='comment'>*/</span></td></tr>
89<tr><td class="num" id="LN8">8</td><td class="line"> </td></tr>
90<tr><td class="num" id="LN9">9</td><td class="line"> </td></tr>
91<tr><td class="num" id="LN10">10</td><td class="line"><span class='directive'>#include "DataRequest.h"</span></td></tr>
92<tr><td class="num" id="LN11">11</td><td class="line"> </td></tr>
93<tr><td class="num" id="LN12">12</td><td class="line"><span class='directive'>#include &lt;HttpAuthentication.h&gt;</span></td></tr>
94<tr><td class="num" id="LN13">13</td><td class="line"><span class='directive'>#include &lt;mail_encoding.h&gt;</span></td></tr>
95<tr><td class="num" id="LN14">14</td><td class="line"><span class='directive'>#include &lt;stdio.h&gt;</span></td></tr>
96<tr><td class="num" id="LN15">15</td><td class="line"> </td></tr>
97<tr><td class="num" id="LN16">16</td><td class="line"> </td></tr>
98<tr><td class="num" id="LN17">17</td><td class="line">BDataRequest::BDataRequest(<span class='keyword'>const</span> BUrl&amp; url, BUrlProtocolListener* listener,</td></tr>
99<tr><td class="num" id="LN18">18</td><td class="line"> BUrlContext* context)</td></tr>
100<tr><td class="num" id="LN19">19</td><td class="line"> : BUrlRequest(url, listener, context, <span class='string_literal'>"data URL parser"</span>, <span class='string_literal'>"data"</span>),</td></tr>
101<tr><td class="num" id="LN20">20</td><td class="line"> fResult()</td></tr>
102<tr><td class="num" id="LN21">21</td><td class="line">{</td></tr>
103<tr><td class="num" id="LN22">22</td><td class="line"> fResult.SetContentType(<span class='string_literal'>"text/plain"</span>);</td></tr>
104<tr><td class="num" id="LN23">23</td><td class="line">}</td></tr>
105<tr><td class="num" id="LN24">24</td><td class="line"> </td></tr>
106<tr><td class="num" id="LN25">25</td><td class="line"> </td></tr>
107<tr><td class="num" id="LN26">26</td><td class="line"><span class='keyword'>const</span> BUrlResult&amp;</td></tr>
108<tr><td class="num" id="LN27">27</td><td class="line">BDataRequest::Result() <span class='keyword'>const</span></td></tr>
109<tr><td class="num" id="LN28">28</td><td class="line">{</td></tr>
110<tr><td class="num" id="LN29">29</td><td class="line"> <span class='keyword'>return</span> fResult;</td></tr>
111<tr><td class="num" id="LN30">30</td><td class="line">}</td></tr>
112<tr><td class="num" id="LN31">31</td><td class="line"> </td></tr>
113<tr><td class="num" id="LN32">32</td><td class="line"> </td></tr>
114<tr><td class="num" id="LN33">33</td><td class="line">status_t</td></tr>
115<tr><td class="num" id="LN34">34</td><td class="line">BDataRequest::_ProtocolLoop()</td></tr>
116<tr><td class="num" id="LN35">35</td><td class="line">{</td></tr>
117<tr><td class="num" id="LN36">36</td><td class="line"> BString mimeType;</td></tr>
118<tr><td class="num" id="LN37">37</td><td class="line"> BString charset;</td></tr>
119<tr><td class="num" id="LN38">38</td><td class="line"> <span class='keyword'>const</span> <span class='keyword'>char</span>* payload;</td></tr>
120<tr><td class="num" id="LN39">39</td><td class="line"> size_t length;</td></tr>
121<tr><td class="num" id="LN40">40</td><td class="line"> <span class='keyword'>bool</span> isBase64 = <span class='keyword'>false</span>;</td></tr>
122<tr><td class="num" id="LN41">41</td><td class="line"> </td></tr>
123<tr><td class="num" id="LN42">42</td><td class="line"> fUrl.UrlDecode(<span class='keyword'>true</span>);</td></tr>
124<tr><td class="num" id="LN43">43</td><td class="line"> BString data = fUrl.Path();</td></tr>
125<tr><td class="num" id="LN44">44</td><td class="line"> <span class='keyword'>int</span> separatorPosition = data.FindFirst(',');</td></tr>
126<tr><td class="num" id="LN45">45</td><td class="line"> </td></tr>
127<tr><td class="num" id="LN46">46</td><td class="line"> <span class='keyword'>if</span> (fListener != <span class='macro'>NULL<span class='expansion'>__null</span></span>)</td></tr>
128<tr><td class="num"></td><td class="line"><div id="Path1" class="msg msgControl" style="margin-left:9ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">1</div></td><td>Taking false branch</td><td><div class="PathNav"><a href="#Path2" title="Next event (2)">&#x2192;</a></div></td></tr></table></div></td></tr>
129<tr><td class="num" id="LN47">47</td><td class="line"> fListener-&gt;ConnectionOpened(<span class='keyword'>this</span>);</td></tr>
130<tr><td class="num" id="LN48">48</td><td class="line"> </td></tr>
131<tr><td class="num" id="LN49">49</td><td class="line"> <span class='keyword'>if</span> (<span class="mrange">separatorPosition &gt;= 0</span>) {</td></tr>
132<tr><td class="num"></td><td class="line"><div id="Path2" class="msg msgEvent" style="margin-left:13ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexEvent">2</div></td><td><div class="PathNav"><a href="#Path1" title="Previous event (1)">&#x2190;</a></div></td></td><td>Assuming 'separatorPosition' is &gt;= 0</td><td><div class="PathNav"><a href="#Path3" title="Next event (3)">&#x2192;</a></div></td></tr></table></div></td></tr>
133<tr><td class="num"></td><td class="line"><div id="Path3" class="msg msgControl" style="margin-left:9ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">3</div></td><td><div class="PathNav"><a href="#Path2" title="Previous event (2)">&#x2190;</a></div></td></td><td>Taking true branch</td><td><div class="PathNav"><a href="#Path4" title="Next event (4)">&#x2192;</a></div></td></tr></table></div></td></tr>
134<tr><td class="num" id="LN50">50</td><td class="line"> BString meta = data;</td></tr>
135<tr><td class="num" id="LN51">51</td><td class="line"> meta.Truncate(separatorPosition);</td></tr>
136<tr><td class="num" id="LN52">52</td><td class="line"> data.Remove(0, separatorPosition + 1);</td></tr>
137<tr><td class="num" id="LN53">53</td><td class="line"> </td></tr>
138<tr><td class="num" id="LN54">54</td><td class="line"> <span class='keyword'>int</span> pos = 0;</td></tr>
139<tr><td class="num" id="LN55">55</td><td class="line"> <span class='keyword'>while</span>(meta.Length() &gt; 0)</td></tr>
140<tr><td class="num"></td><td class="line"><div id="Path4" class="msg msgControl" style="margin-left:17ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">4</div></td><td><div class="PathNav"><a href="#Path3" title="Previous event (3)">&#x2190;</a></div></td></td><td>Loop condition is true. Entering loop body</td><td><div class="PathNav"><a href="#Path5" title="Next event (5)">&#x2192;</a></div></td></tr></table></div></td></tr>
141<tr><td class="num"></td><td class="line"><div id="Path8" class="msg msgControl" style="margin-left:17ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">8</div></td><td><div class="PathNav"><a href="#Path7" title="Previous event (7)">&#x2190;</a></div></td></td><td>Loop condition is false. Execution continues on line 78</td><td><div class="PathNav"><a href="#Path9" title="Next event (9)">&#x2192;</a></div></td></tr></table></div></td></tr>
142<tr><td class="num" id="LN56">56</td><td class="line"> {</td></tr>
143<tr><td class="num" id="LN57">57</td><td class="line"> <span class='comment'>// Extract next parameter</span></td></tr>
144<tr><td class="num" id="LN58">58</td><td class="line"> pos = meta.FindFirst(';', pos);</td></tr>
145<tr><td class="num" id="LN59">59</td><td class="line"> </td></tr>
146<tr><td class="num" id="LN60">60</td><td class="line"> BString parameter = meta;</td></tr>
147<tr><td class="num" id="LN61">61</td><td class="line"> <span class='keyword'>if</span>(<span class="mrange">pos &gt;= 0</span>) {</td></tr>
148<tr><td class="num"></td><td class="line"><div id="Path5" class="msg msgEvent" style="margin-left:28ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexEvent">5</div></td><td><div class="PathNav"><a href="#Path4" title="Previous event (4)">&#x2190;</a></div></td></td><td>Assuming 'pos' is &lt; 0</td><td><div class="PathNav"><a href="#Path6" title="Next event (6)">&#x2192;</a></div></td></tr></table></div></td></tr>
149<tr><td class="num"></td><td class="line"><div id="Path6" class="msg msgControl" style="margin-left:25ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">6</div></td><td><div class="PathNav"><a href="#Path5" title="Previous event (5)">&#x2190;</a></div></td></td><td>Taking false branch</td><td><div class="PathNav"><a href="#Path7" title="Next event (7)">&#x2192;</a></div></td></tr></table></div></td></tr>
150<tr><td class="num" id="LN62">62</td><td class="line"> parameter.Truncate(pos);</td></tr>
151<tr><td class="num" id="LN63">63</td><td class="line"> meta.Remove(0, pos+1);</td></tr>
152<tr><td class="num" id="LN64">64</td><td class="line"> } <span class='keyword'>else</span></td></tr>
153<tr><td class="num" id="LN65">65</td><td class="line"> meta.Truncate(0);</td></tr>
154<tr><td class="num" id="LN66">66</td><td class="line"> </td></tr>
155<tr><td class="num" id="LN67">67</td><td class="line"> <span class='comment'>// Interpret the parameter</span></td></tr>
156<tr><td class="num" id="LN68">68</td><td class="line"> <span class='keyword'>if</span>(parameter == <span class='string_literal'>"base64"</span>) {</td></tr>
157<tr><td class="num"></td><td class="line"><div id="Path7" class="msg msgControl" style="margin-left:25ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">7</div></td><td><div class="PathNav"><a href="#Path6" title="Previous event (6)">&#x2190;</a></div></td></td><td>Taking true branch</td><td><div class="PathNav"><a href="#Path8" title="Next event (8)">&#x2192;</a></div></td></tr></table></div></td></tr>
158<tr><td class="num" id="LN69">69</td><td class="line"> isBase64 = <span class='keyword'>true</span>;</td></tr>
159<tr><td class="num" id="LN70">70</td><td class="line"> } <span class='keyword'>else</span> <span class='keyword'>if</span>(parameter.FindFirst(<span class='string_literal'>"charset="</span>) == 0) {</td></tr>
160<tr><td class="num" id="LN71">71</td><td class="line"> charset = parameter;</td></tr>
161<tr><td class="num" id="LN72">72</td><td class="line"> } <span class='keyword'>else</span> {</td></tr>
162<tr><td class="num" id="LN73">73</td><td class="line"> <span class='comment'>// Must be the MIME type</span></td></tr>
163<tr><td class="num" id="LN74">74</td><td class="line"> mimeType = parameter;</td></tr>
164<tr><td class="num" id="LN75">75</td><td class="line"> }</td></tr>
165<tr><td class="num" id="LN76">76</td><td class="line"> }</td></tr>
166<tr><td class="num" id="LN77">77</td><td class="line"> </td></tr>
167<tr><td class="num" id="LN78">78</td><td class="line"> <span class='keyword'>if</span> (charset.Length() &gt; 0)</td></tr>
168<tr><td class="num"></td><td class="line"><div id="Path9" class="msg msgControl" style="margin-left:17ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">9</div></td><td><div class="PathNav"><a href="#Path8" title="Previous event (8)">&#x2190;</a></div></td></td><td>Taking false branch</td><td><div class="PathNav"><a href="#Path10" title="Next event (10)">&#x2192;</a></div></td></tr></table></div></td></tr>
169<tr><td class="num" id="LN79">79</td><td class="line"> mimeType &lt;&lt; <span class='string_literal'>";"</span> &lt;&lt; charset;</td></tr>
170<tr><td class="num" id="LN80">80</td><td class="line"> fResult.SetContentType(mimeType);</td></tr>
171<tr><td class="num" id="LN81">81</td><td class="line"> }</td></tr>
172<tr><td class="num" id="LN82">82</td><td class="line"> </td></tr>
173<tr><td class="num" id="LN83">83</td><td class="line"> <span class='keyword'>if</span> (isBase64) {</td></tr>
174<tr><td class="num"></td><td class="line"><div id="Path10" class="msg msgControl" style="margin-left:9ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">10</div></td><td><div class="PathNav"><a href="#Path9" title="Previous event (9)">&#x2190;</a></div></td></td><td>Taking true branch</td><td><div class="PathNav"><a href="#Path11" title="Next event (11)">&#x2192;</a></div></td></tr></table></div></td></tr>
175<tr><td class="num" id="LN84">84</td><td class="line"> <span class='keyword'>char</span>* buffer = <span class="mrange"><span class='keyword'>new</span> <span class='keyword'>char</span>[data.Length() * 4 / 3]</span>;</td></tr>
176<tr><td class="num"></td><td class="line"><div id="Path11" class="msg msgEvent" style="margin-left:32ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexEvent">11</div></td><td><div class="PathNav"><a href="#Path10" title="Previous event (10)">&#x2190;</a></div></td></td><td>Memory is allocated</td><td><div class="PathNav"><a href="#Path12" title="Next event (12)">&#x2192;</a></div></td></tr></table></div></td></tr>
177<tr><td class="num" id="LN85">85</td><td class="line"> payload = buffer;</td></tr>
178<tr><td class="num" id="LN86">86</td><td class="line"> <span class='comment'>// payload must be a const char* so we can assign data.String() to</span></td></tr>
179<tr><td class="num" id="LN87">87</td><td class="line"> <span class='comment'>// it below, but decode_64 modifies buffer.</span></td></tr>
180<tr><td class="num" id="LN88">88</td><td class="line"> length = decode_base64(buffer, data.String(), data.Length());</td></tr>
181<tr><td class="num" id="LN89">89</td><td class="line"> } <span class='keyword'>else</span> {</td></tr>
182<tr><td class="num" id="LN90">90</td><td class="line"> payload = data.String();</td></tr>
183<tr><td class="num" id="LN91">91</td><td class="line"> length = data.Length();</td></tr>
184<tr><td class="num" id="LN92">92</td><td class="line"> }</td></tr>
185<tr><td class="num" id="LN93">93</td><td class="line"> </td></tr>
186<tr><td class="num" id="LN94">94</td><td class="line"> fResult.SetLength(length);</td></tr>
187<tr><td class="num" id="LN95">95</td><td class="line"> </td></tr>
188<tr><td class="num" id="LN96">96</td><td class="line"> <span class='keyword'>if</span> (fListener != <span class='macro'>NULL<span class='expansion'>__null</span></span>) {</td></tr>
189<tr><td class="num"></td><td class="line"><div id="Path12" class="msg msgControl" style="margin-left:9ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">12</div></td><td><div class="PathNav"><a href="#Path11" title="Previous event (11)">&#x2190;</a></div></td></td><td>Taking false branch</td><td><div class="PathNav"><a href="#Path13" title="Next event (13)">&#x2192;</a></div></td></tr></table></div></td></tr>
190<tr><td class="num" id="LN97">97</td><td class="line"> fListener-&gt;DownloadProgress(<span class='keyword'>this</span>, length, length);</td></tr>
191<tr><td class="num" id="LN98">98</td><td class="line"> <span class='keyword'>if</span> (length &gt; 0)</td></tr>
192<tr><td class="num" id="LN99">99</td><td class="line"> fListener-&gt;DataReceived(<span class='keyword'>this</span>, payload, length);</td></tr>
193<tr><td class="num" id="LN100">100</td><td class="line"> }</td></tr>
194<tr><td class="num" id="LN101">101</td><td class="line"> </td></tr>
195<tr><td class="num" id="LN102">102</td><td class="line"> <span class='keyword'>if</span> (isBase64)</td></tr>
196<tr><td class="num"></td><td class="line"><div id="Path13" class="msg msgControl" style="margin-left:9ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexControl">13</div></td><td><div class="PathNav"><a href="#Path12" title="Previous event (12)">&#x2190;</a></div></td></td><td>Taking true branch</td><td><div class="PathNav"><a href="#EndPath" title="Next event (14)">&#x2192;</a></div></td></tr></table></div></td></tr>
197<tr><td class="num" id="LN103">103</td><td class="line"> <span class='keyword'>delete</span> <span class="mrange">payload</span>;</td></tr>
198<tr><td class="num"></td><td class="line"><div id="EndPath" class="msg msgEvent" style="margin-left:17ex"><table class="msgT"><tr><td valign="top"><div class="PathIndex PathIndexEvent">14</div></td><td><div class="PathNav"><a href="#Path13" title="Previous event (13)">&#x2190;</a></div></td></td><td>Memory allocated by 'new[]' should be deallocated by 'delete[]', not 'delete'</td></tr></table></div></td></tr>
199<tr><td class="num" id="LN104">104</td><td class="line"> </td></tr>
200<tr><td class="num" id="LN105">105</td><td class="line"> <span class='keyword'>return</span> B_PROT_SUCCESS;</td></tr>
201<tr><td class="num" id="LN106">106</td><td class="line">}</td></tr>
202</table></body></html>