Bug Summary

File:root/firefox-clang/media/ffvpx/libavutil/avstring.c
Warning:line 243, column 40
Null pointer passed to 1st parameter expecting 'nonnull'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name avstring.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavutil -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavutil -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -include libavutil_visibility.h -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG=1 -D HAVE_AV_CONFIG_H -D ASSERT_LEVEL=2 -I /root/firefox-clang/media/ffvpx/libavutil -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/media/ffvpx/libavutil -I /root/firefox-clang/third_party/khronos/vulkan-headers/include -I /root/firefox-clang/media/mozva -I /root/firefox-clang/media/ffvpx -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -Wno-parentheses -Wno-pointer-sign -Wno-sign-compare -Wno-switch -Wno-type-limits -Wno-unused-function -Wno-deprecated-declarations -Wno-absolute-value -Wno-incompatible-pointer-types -Wno-string-conversion -Wno-visibility -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/media/ffvpx/libavutil/avstring.c
1/*
2 * Copyright (c) 2000, 2001, 2002 Fabrice Bellard
3 * Copyright (c) 2007 Mans Rullgard
4 *
5 * This file is part of FFmpeg.
6 *
7 * FFmpeg is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2.1 of the License, or (at your option) any later version.
11 *
12 * FFmpeg is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with FFmpeg; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20 */
21
22#include <limits.h>
23#include <stdarg.h>
24#include <stdint.h>
25#include <stdio.h>
26#include <string.h>
27
28#include "config.h"
29#include "mem.h"
30#include "avassert.h"
31#include "avstring.h"
32#include "bprint.h"
33#include "error.h"
34#include "macros.h"
35
36int av_strstart(const char *str, const char *pfx, const char **ptr)
37{
38 while (*pfx && *pfx == *str) {
39 pfx++;
40 str++;
41 }
42 if (!*pfx && ptr)
43 *ptr = str;
44 return !*pfx;
45}
46
47int av_stristart(const char *str, const char *pfx, const char **ptr)
48{
49 while (*pfx && av_toupper((unsigned)*pfx) == av_toupper((unsigned)*str)) {
50 pfx++;
51 str++;
52 }
53 if (!*pfx && ptr)
54 *ptr = str;
55 return !*pfx;
56}
57
58char *av_stristr(const char *s1, const char *s2)
59{
60 if (!*s2)
61 return (char*)(intptr_t)s1;
62
63 do
64 if (av_stristart(s1, s2, NULL((void*)0)))
65 return (char*)(intptr_t)s1;
66 while (*s1++);
67
68 return NULL((void*)0);
69}
70
71char *av_strnstr(const char *haystack, const char *needle, size_t hay_length)
72{
73 size_t needle_len = strlen(needle);
74 if (!needle_len)
75 return (char*)haystack;
76 while (hay_length >= needle_len) {
77 hay_length--;
78 if (!memcmp(haystack, needle, needle_len))
79 return (char*)haystack;
80 haystack++;
81 }
82 return NULL((void*)0);
83}
84
85size_t av_strlcpy(char *dst, const char *src, size_t size)
86{
87 size_t len = 0;
88 while (++len < size && *src)
89 *dst++ = *src++;
90 if (len <= size)
91 *dst = 0;
92 return len + strlen(src) - 1;
93}
94
95size_t av_strlcat(char *dst, const char *src, size_t size)
96{
97 size_t len = strlen(dst);
98 if (size <= len + 1)
99 return len + strlen(src);
100 return len + av_strlcpy(dst + len, src, size - len);
101}
102
103size_t av_strlcatf(char *dst, size_t size, const char *fmt, ...)
104{
105 size_t len = strlen(dst);
106 va_list vl;
107
108 va_start(vl, fmt)__builtin_va_start(vl, fmt);
109 len += vsnprintf(dst + len, size > len ? size - len : 0, fmt, vl);
110 va_end(vl)__builtin_va_end(vl);
111
112 return len;
113}
114
115char *av_asprintf(const char *fmt, ...)
116{
117 char *p = NULL((void*)0);
118 va_list va;
119 int len;
120
121 va_start(va, fmt)__builtin_va_start(va, fmt);
122 len = vsnprintf(NULL((void*)0), 0, fmt, va);
123 va_end(va)__builtin_va_end(va);
124 if (len < 0)
125 goto end;
126
127 p = av_malloc(len + 1);
128 if (!p)
129 goto end;
130
131 va_start(va, fmt)__builtin_va_start(va, fmt);
132 len = vsnprintf(p, len + 1, fmt, va);
133 va_end(va)__builtin_va_end(va);
134 if (len < 0)
135 av_freep(&p);
136
137end:
138 return p;
139}
140
141#define WHITESPACES" \n\t\r" " \n\t\r"
142
143char *av_get_token(const char **buf, const char *term)
144{
145 char *out = av_realloc(NULL((void*)0), strlen(*buf) + 1);
146 char *ret = out, *end = out;
147 const char *p = *buf;
148 if (!out)
149 return NULL((void*)0);
150 p += strspn(p, WHITESPACES" \n\t\r");
151
152 while (*p && !strspn(p, term)) {
153 char c = *p++;
154 if (c == '\\' && *p) {
155 *out++ = *p++;
156 end = out;
157 } else if (c == '\'') {
158 while (*p && *p != '\'')
159 *out++ = *p++;
160 if (*p) {
161 p++;
162 end = out;
163 }
164 } else {
165 *out++ = c;
166 }
167 }
168
169 do
170 *out-- = 0;
171 while (out >= end && strspn(out, WHITESPACES" \n\t\r"));
172
173 *buf = p;
174
175 char *small_ret = av_realloc(ret, out - ret + 2);
176 return small_ret ? small_ret : ret;
177}
178
179char *av_strtok(char *s, const char *delim, char **saveptr)
180{
181 char *tok;
182
183 if (!s && !(s = *saveptr))
184 return NULL((void*)0);
185
186 /* skip leading delimiters */
187 s += strspn(s, delim);
188
189 /* s now points to the first non delimiter char, or to the end of the string */
190 if (!*s) {
191 *saveptr = NULL((void*)0);
192 return NULL((void*)0);
193 }
194 tok = s++;
195
196 /* skip non delimiters */
197 s += strcspn(s, delim);
198 if (*s) {
199 *s = 0;
200 *saveptr = s+1;
201 } else {
202 *saveptr = NULL((void*)0);
203 }
204
205 return tok;
206}
207
208int av_strcasecmp(const char *a, const char *b)
209{
210 uint8_t c1, c2;
211 do {
212 c1 = av_tolower(*a++);
213 c2 = av_tolower(*b++);
214 } while (c1 && c1 == c2);
215 return c1 - c2;
216}
217
218int av_strncasecmp(const char *a, const char *b, size_t n)
219{
220 uint8_t c1, c2;
221 if (n <= 0)
222 return 0;
223 do {
224 c1 = av_tolower(*a++);
225 c2 = av_tolower(*b++);
226 } while (--n && c1 && c1 == c2);
227 return c1 - c2;
228}
229
230char *av_strireplace(const char *str, const char *from, const char *to)
231{
232 char *ret = NULL((void*)0);
233 const char *pstr2, *pstr = str;
1
'pstr' initialized here
→
234 size_t tolen = strlen(to), fromlen = strlen(from);
235 AVBPrint pbuf;
236
237 av_bprint_init(&pbuf, 1, AV_BPRINT_SIZE_UNLIMITED((unsigned)-1));
238 while ((pstr2 = av_stristr(pstr, from))) {
2
←
Assuming pointer value is null
→
3
←
Loop condition is false. Execution continues on line 243
→
239 av_bprint_append_data(&pbuf, pstr, pstr2 - pstr);
240 pstr = pstr2 + fromlen;
241 av_bprint_append_data(&pbuf, to, tolen);
242 }
243 av_bprint_append_data(&pbuf, pstr, strlen(pstr));
4
←
Null pointer passed to 1st parameter expecting 'nonnull'
244 if (!av_bprint_is_complete(&pbuf)) {
245 av_bprint_finalize(&pbuf, NULL((void*)0));
246 } else {
247 av_bprint_finalize(&pbuf, &ret);
248 }
249
250 return ret;
251}
252
253const char *av_basename(const char *path)
254{
255 char *p;
256#if HAVE_DOS_PATHS0
257 char *q, *d;
258#endif
259
260 if (!path || *path == '\0')
261 return ".";
262
263 p = strrchr(path, '/');
264#if HAVE_DOS_PATHS0
265 q = strrchr(path, '\\');
266 d = strchr(path, ':');
267 p = FFMAX3(p, q, d)((((p) > (q) ? (p) : (q))) > (d) ? (((p) > (q) ? (p)
: (q))) : (d));
268#endif
269
270 if (!p)
271 return path;
272
273 return p + 1;
274}
275
276const char *av_dirname(char *path)
277{
278 char *p = path ? strrchr(path, '/') : NULL((void*)0);
279
280#if HAVE_DOS_PATHS0
281 char *q = path ? strrchr(path, '\\') : NULL((void*)0);
282 char *d = path ? strchr(path, ':') : NULL((void*)0);
283
284 d = d ? d + 1 : d;
285
286 p = FFMAX3(p, q, d)((((p) > (q) ? (p) : (q))) > (d) ? (((p) > (q) ? (p)
: (q))) : (d));
287#endif
288
289 if (!p)
290 return ".";
291
292 *p = '\0';
293
294 return path;
295}
296
297char *av_append_path_component(const char *path, const char *component)
298{
299 size_t p_len, c_len;
300 char *fullpath;
301
302 if (!path)
303 return av_strdup(component);
304 if (!component)
305 return av_strdup(path);
306
307 p_len = strlen(path);
308 c_len = strlen(component);
309 if (p_len > SIZE_MAX(18446744073709551615UL) - c_len || p_len + c_len > SIZE_MAX(18446744073709551615UL) - 2)
310 return NULL((void*)0);
311 fullpath = av_malloc(p_len + c_len + 2);
312 if (fullpath) {
313 if (p_len) {
314 av_strlcpy(fullpath, path, p_len + 1);
315 if (c_len) {
316 if (fullpath[p_len - 1] != '/' && component[0] != '/')
317 fullpath[p_len++] = '/';
318 else if (fullpath[p_len - 1] == '/' && component[0] == '/')
319 p_len--;
320 }
321 }
322 av_strlcpy(&fullpath[p_len], component, c_len + 1);
323 fullpath[p_len + c_len] = 0;
324 }
325 return fullpath;
326}
327
328int av_escape(char **dst, const char *src, const char *special_chars,
329 enum AVEscapeMode mode, int flags)
330{
331 AVBPrint dstbuf;
332 int ret;
333
334 av_bprint_init(&dstbuf, 1, INT_MAX2147483647); /* (int)dstbuf.len must be >= 0 */
335 av_bprint_escape(&dstbuf, src, special_chars, mode, flags);
336
337 if (!av_bprint_is_complete(&dstbuf)) {
338 av_bprint_finalize(&dstbuf, NULL((void*)0));
339 return AVERROR(ENOMEM)(-(12));
340 }
341 if ((ret = av_bprint_finalize(&dstbuf, dst)) < 0)
342 return ret;
343 return dstbuf.len;
344}
345
346int av_match_name(const char *name, const char *names)
347{
348 const char *p;
349 size_t len, namelen;
350
351 if (!name || !names)
352 return 0;
353
354 namelen = strlen(name);
355 while (*names) {
356 int negate = '-' == *names;
357 p = strchr(names, ',');
358 if (!p)
359 p = names + strlen(names);
360 names += negate;
361 len = FFMAX(p - names, namelen)((p - names) > (namelen) ? (p - names) : (namelen));
362 if (!av_strncasecmp(name, names, len) || !strncmp("ALL", names, FFMAX(3, p - names)((3) > (p - names) ? (3) : (p - names))))
363 return !negate;
364 names = p + (*p == ',');
365 }
366 return 0;
367}
368
369int av_utf8_decode(int32_t *codep, const uint8_t **bufp, const uint8_t *buf_end,
370 unsigned int flags)
371{
372 const uint8_t *p = *bufp;
373 uint32_t top;
374 uint64_t code;
375 int ret = 0, tail_len;
376 uint32_t overlong_encoding_mins[6] = {
377 0x00000000, 0x00000080, 0x00000800, 0x00010000, 0x00200000, 0x04000000,
378 };
379
380 if (p >= buf_end)
381 return 0;
382
383 code = *p++;
384
385 /* first sequence byte starts with 10, or is 1111-1110 or 1111-1111,
386 which is not admitted */
387 if ((code & 0xc0) == 0x80 || code >= 0xFE) {
388 ret = AVERROR(EILSEQ)(-(84));
389 goto end;
390 }
391 top = (code & 128) >> 1;
392
393 tail_len = 0;
394 while (code & top) {
395 int tmp;
396 tail_len++;
397 if (p >= buf_end) {
398 (*bufp) ++;
399 return AVERROR(EILSEQ)(-(84)); /* incomplete sequence */
400 }
401
402 /* we assume the byte to be in the form 10xx-xxxx */
403 tmp = *p++ - 128; /* strip leading 1 */
404 if (tmp>>6) {
405 (*bufp) ++;
406 return AVERROR(EILSEQ)(-(84));
407 }
408 code = (code<<6) + tmp;
409 top <<= 5;
410 }
411 code &= (top << 1) - 1;
412
413 /* check for overlong encodings */
414 av_assert0(tail_len <= 5)do { if (!(tail_len <= 5)) { av_log(((void*)0), 0, "Assertion %s failed at %s:%d\n"
, "tail_len <= 5", "/root/firefox-clang/media/ffvpx/libavutil/avstring.c"
, 414); abort(); } } while (0);
415 if (code < overlong_encoding_mins[tail_len]) {
416 ret = AVERROR(EILSEQ)(-(84));
417 goto end;
418 }
419
420 if (code >= 1U<<31) {
421 ret = AVERROR(EILSEQ)(-(84)); /* out-of-range value */
422 goto end;
423 }
424
425 *codep = code;
426
427 if (code > 0x10FFFF &&
428 !(flags & AV_UTF8_FLAG_ACCEPT_INVALID_BIG_CODES1))
429 ret = AVERROR(EILSEQ)(-(84));
430 if (code < 0x20 && code != 0x9 && code != 0xA && code != 0xD &&
431 flags & AV_UTF8_FLAG_EXCLUDE_XML_INVALID_CONTROL_CODES8)
432 ret = AVERROR(EILSEQ)(-(84));
433 if (code >= 0xD800 && code <= 0xDFFF &&
434 !(flags & AV_UTF8_FLAG_ACCEPT_SURROGATES4))
435 ret = AVERROR(EILSEQ)(-(84));
436 if ((code == 0xFFFE || code == 0xFFFF) &&
437 !(flags & AV_UTF8_FLAG_ACCEPT_NON_CHARACTERS2))
438 ret = AVERROR(EILSEQ)(-(84));
439
440end:
441 *bufp = p;
442 return ret;
443}
444
445int av_match_list(const char *name, const char *list, char separator)
446{
447 const char *p, *q;
448
449 for (p = name; p && *p; ) {
450 for (q = list; q && *q; ) {
451 int k;
452 for (k = 0; p[k] == q[k] || (p[k]*q[k] == 0 && p[k]+q[k] == separator); k++)
453 if (k && (!p[k] || p[k] == separator))
454 return 1;
455 q = strchr(q, separator);
456 if(q)
457 q++;
458 }
459 p = strchr(p, separator);
460 if (p)
461 p++;
462 }
463
464 return 0;
465}