Bug Summary

File:root/firefox-clang/media/libjpeg/src/jcicc.c
Warning:line 100, column 32
Dereference of null pointer (loaded from variable 'icc_data_ptr')

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -O2 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name jcicc.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libjpeg -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libjpeg -resource-dir /usr/lib/llvm-23/lib/clang/23 -include /root/firefox-clang/config/gcc_hidden.h -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/system_wrappers -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D DEBUG=1 -D MOZ_WITH_SIMD=1 -D MOZ_HAS_MOZGLUE -D MOZILLA_INTERNAL_API -D IMPL_LIBXUL -D MOZ_SUPPORT_LEAKCHECKING -D STATIC_EXPORTABLE_JS_API -I /root/firefox-clang/media/libjpeg -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/media/libjpeg -I /root/firefox-clang/media/libjpeg -I /root/firefox-clang/media/libjpeg/src -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -internal-isystem /usr/lib/llvm-23/lib/clang/23/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/16/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-character-conversion -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fdiagnostics-absolute-paths -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -mllvm -dwarf-linkage-names=Abstract -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-09-01-224014-2642839-1 -x c /root/firefox-clang/media/libjpeg/src/jcicc.c
1/*
2 * jcicc.c
3 *
4 * Copyright (C) 1997-1998, Thomas G. Lane, Todd Newman.
5 * Copyright (C) 2017, D. R. Commander.
6 * For conditions of distribution and use, see the accompanying README.ijg
7 * file.
8 *
9 * This file provides code to write International Color Consortium (ICC) device
10 * profiles embedded in JFIF JPEG image files. The ICC has defined a standard
11 * for including such data in JPEG "APP2" markers. The code given here does
12 * not know anything about the internal structure of the ICC profile data; it
13 * just knows how to embed the profile data in a JPEG file while writing it.
14 */
15
16#define JPEG_INTERNALS
17#include "jinclude.h"
18#include "jpeglib.h"
19#include "jerror.h"
20
21
22/*
23 * Since an ICC profile can be larger than the maximum size of a JPEG marker
24 * (64K), we need provisions to split it into multiple markers. The format
25 * defined by the ICC specifies one or more APP2 markers containing the
26 * following data:
27 * Identifying string ASCII "ICC_PROFILE\0" (12 bytes)
28 * Marker sequence number 1 for first APP2, 2 for next, etc (1 byte)
29 * Number of markers Total number of APP2's used (1 byte)
30 * Profile data (remainder of APP2 data)
31 * Decoders should use the marker sequence numbers to reassemble the profile,
32 * rather than assuming that the APP2 markers appear in the correct sequence.
33 */
34
35#define ICC_MARKER(0xE0 + 2) (JPEG_APP00xE0 + 2) /* JPEG marker code for ICC */
36#define ICC_OVERHEAD_LEN14 14 /* size of non-profile data in APP2 */
37#define MAX_BYTES_IN_MARKER65533 65533 /* maximum data len of a JPEG marker */
38#define MAX_DATA_BYTES_IN_MARKER(65533 - 14) (MAX_BYTES_IN_MARKER65533 - ICC_OVERHEAD_LEN14)
39
40
41/*
42 * This routine writes the given ICC profile data into a JPEG file. It *must*
43 * be called AFTER calling jpeg_start_compress() and BEFORE the first call to
44 * jpeg_write_scanlines(). (This ordering ensures that the APP2 marker(s) will
45 * appear after the SOI and JFIF or Adobe markers, but before all else.)
46 */
47
48GLOBAL(void)void
49jpeg_write_icc_profile(j_compress_ptr cinfo, const JOCTET *icc_data_ptr,
50 unsigned int icc_data_len)
51{
52 unsigned int num_markers; /* total number of markers we'll write */
53 int cur_marker = 1; /* per spec, counting starts at 1 */
54 unsigned int length; /* number of bytes to write in this marker */
55
56 if (icc_data_ptr == NULL((void*)0) || icc_data_len == 0)
1
Assuming 'icc_data_ptr' is equal to NULL
→
57 ERREXIT(cinfo, JERR_BUFFER_SIZE)((cinfo)->err->msg_code = (JERR_BUFFER_SIZE), (*(cinfo)
->err->error_exit) ((j_common_ptr)(cinfo)));
58 if (cinfo->global_state < CSTATE_SCANNING101)
2
←
Assuming field 'global_state' is >= CSTATE_SCANNING
→
3
←
Taking false branch
→
59 ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state)((cinfo)->err->msg_code = (JERR_BAD_STATE), (cinfo)->
err->msg_parm.i[0] = (cinfo->global_state), (*(cinfo)->
err->error_exit) ((j_common_ptr)(cinfo)));
60
61 /* Calculate the number of markers we'll need, rounding up of course */
62 num_markers = icc_data_len / MAX_DATA_BYTES_IN_MARKER(65533 - 14);
63 if (num_markers * MAX_DATA_BYTES_IN_MARKER(65533 - 14) != icc_data_len)
4
←
Assuming the condition is false
→
5
←
Taking false branch
→
64 num_markers++;
65
66 while (icc_data_len > 0) {
6
←
Assuming 'icc_data_len' is > 0
→
7
←
Loop condition is true. Entering loop body
→
67 /* length of profile to put in this marker */
68 length = icc_data_len;
69 if (length > MAX_DATA_BYTES_IN_MARKER(65533 - 14))
8
←
Assuming the condition is false
→
9
←
Taking false branch
→
70 length = MAX_DATA_BYTES_IN_MARKER(65533 - 14);
71 icc_data_len -= length;
72
73 /* Write the JPEG marker header (APP2 code and marker length) */
74 jpeg_write_m_header(cinfo, ICC_MARKER(0xE0 + 2),
75 (unsigned int)(length + ICC_OVERHEAD_LEN14));
76
77 /* Write the marker identifying string "ICC_PROFILE" (null-terminated). We
78 * code it in this less-than-transparent way so that the code works even if
79 * the local character set is not ASCII.
80 */
81 jpeg_write_m_byte(cinfo, 0x49);
82 jpeg_write_m_byte(cinfo, 0x43);
83 jpeg_write_m_byte(cinfo, 0x43);
84 jpeg_write_m_byte(cinfo, 0x5F);
85 jpeg_write_m_byte(cinfo, 0x50);
86 jpeg_write_m_byte(cinfo, 0x52);
87 jpeg_write_m_byte(cinfo, 0x4F);
88 jpeg_write_m_byte(cinfo, 0x46);
89 jpeg_write_m_byte(cinfo, 0x49);
90 jpeg_write_m_byte(cinfo, 0x4C);
91 jpeg_write_m_byte(cinfo, 0x45);
92 jpeg_write_m_byte(cinfo, 0x0);
93
94 /* Add the sequencing info */
95 jpeg_write_m_byte(cinfo, cur_marker);
96 jpeg_write_m_byte(cinfo, (int)num_markers);
97
98 /* Add the profile data */
99 while (length--) {
10
←
Loop condition is true. Entering loop body
→
100 jpeg_write_m_byte(cinfo, *icc_data_ptr);
11
←
Dereference of null pointer (loaded from variable 'icc_data_ptr')
101 icc_data_ptr++;
102 }
103 cur_marker++;
104 }
105}