Fix dereference of null pointer that Clang Static Analyzer pointed out.

diff --git a/libarchive/archive_entry_link_resolver.c b/libarchive/archive_entry_link_resolver.c
index 07f0d362e48c859d296cd9537f48075c17f7404f..c7d59497a7cfde86258dee21c9e253fad48045d2 100644 (file)
--- a/libarchive/archive_entry_link_resolver.c
+++ b/libarchive/archive_entry_link_resolver.c
@@ -244,6 +244,9 @@ archive_entry_linkify(struct archive_entry_linkresolver *res,
                         * for future use.
                         */
                        le = insert_entry(res, *e);
+                       if (le == NULL)
+                               /* XXX We should return an error code XXX */
+                               return;
                        le->entry = *e;
                        *e = NULL;
                }

diff --git a/libarchive/archive_rb.c b/libarchive/archive_rb.c
index 70bf7e6d3379b873c717d640f0e19c2a5947aec1..5b5da2034497bdf274221ffa5f23d464ecd3ea05 100644 (file)
--- a/libarchive/archive_rb.c
+++ b/libarchive/archive_rb.c
@@ -237,6 +237,8 @@ __archive_rb_tree_reparent_nodes(
        struct archive_rb_node * const new_father = old_child;
        struct archive_rb_node * const new_child = old_father;
 
+       if (new_father == NULL)
+               return;
        /*
         * Exchange descendant linkages.
         */
@@ -552,6 +554,8 @@ __archive_rb_tree_removal_rebalance(struct archive_rb_tree *rbt,
                unsigned int other = which ^ RB_DIR_OTHER;
                struct archive_rb_node *brother = parent->rb_nodes[other];
 
+               if (brother == NULL)
+                       return;/* The tree may be broken. */
                /*
                 * For cases 1, 2a, and 2b, our brother's children must
                 * be black and our father must be black
@@ -573,6 +577,8 @@ __archive_rb_tree_removal_rebalance(struct archive_rb_tree *rbt,
                                 */
                                __archive_rb_tree_reparent_nodes(parent, other);
                                brother = parent->rb_nodes[other];
+                               if (brother == NULL)
+                                       return;/* The tree may be broken. */
                        } else {
                                /*
                                 * Both our parent and brother are black.
@@ -656,6 +662,8 @@ __archive_rb_tree_removal_rebalance(struct archive_rb_tree *rbt,
                         * If we had two red nephews, then after the swap,
                         * our former father would have a red grandson. 
                         */
+                       if (brother->rb_nodes[other] == NULL)
+                               return;/* The tree may be broken. */
                        RB_MARK_BLACK(brother->rb_nodes[other]);
                        __archive_rb_tree_reparent_nodes(parent, other);
                        break;          /* We're done! */

diff --git a/libarchive/archive_read_disk_posix.c b/libarchive/archive_read_disk_posix.c
index 652deb9ec4497168a8f41d119ee685f4d2d15201..1b8cf87f958c137fbc423f5968a34640600723f7 100644 (file)
--- a/libarchive/archive_read_disk_posix.c
+++ b/libarchive/archive_read_disk_posix.c
@@ -2391,7 +2391,7 @@ tree_current_is_dir(struct tree *t)
                        return 1;
                /* Not a dir; might be a link to a dir. */
                /* If it's not a link, then it's not a link to a dir. */
-               if (!S_ISLNK(tree_current_lstat(t)->st_mode))
+               if (!S_ISLNK(st->st_mode))
                        return 0;
                /*
                 * It's a link, but we don't know what it's a link to,

diff --git a/libarchive/archive_write_disk_posix.c b/libarchive/archive_write_disk_posix.c
index 58c9ce8156ff9528d68fbba49239d522947dbe06..4663cec4f6c7788a3b57ba0c7955bf45aedc33b9 100644 (file)
--- a/libarchive/archive_write_disk_posix.c
+++ b/libarchive/archive_write_disk_posix.c
@@ -525,6 +525,8 @@ _archive_write_disk_header(struct archive *_a, struct archive_entry *entry)
         */
        if (a->deferred & TODO_MODE) {
                fe = current_fixup(a, archive_entry_pathname(entry));
+               if (fe == NULL)
+                       return (ARCHIVE_FATAL);
                fe->fixup |= TODO_MODE_BASE;
                fe->mode = a->mode;
        }
@@ -533,6 +535,8 @@ _archive_write_disk_header(struct archive *_a, struct archive_entry *entry)
                && (archive_entry_mtime_is_set(entry)
                    || archive_entry_atime_is_set(entry))) {
                fe = current_fixup(a, archive_entry_pathname(entry));
+               if (fe == NULL)
+                       return (ARCHIVE_FATAL);
                fe->mode = a->mode;
                fe->fixup |= TODO_TIMES;
                if (archive_entry_atime_is_set(entry)) {
@@ -563,6 +567,8 @@ _archive_write_disk_header(struct archive *_a, struct archive_entry *entry)
 
        if (a->deferred & TODO_ACLS) {
                fe = current_fixup(a, archive_entry_pathname(entry));
+               if (fe == NULL)
+                       return (ARCHIVE_FATAL);
                fe->fixup |= TODO_ACLS;
                archive_acl_copy(&fe->acl, archive_entry_acl(entry));
        }
@@ -573,6 +579,8 @@ _archive_write_disk_header(struct archive *_a, struct archive_entry *entry)
                metadata = archive_entry_mac_metadata(a->entry, &metadata_size);
                if (metadata != NULL && metadata_size > 0) {
                        fe = current_fixup(a, archive_entry_pathname(entry));
+                       if (fe == NULL)
+                               return (ARCHIVE_FATAL);
                        fe->mac_metadata = malloc(metadata_size);
                        if (fe->mac_metadata != NULL) {
                                memcpy(fe->mac_metadata, metadata, metadata_size);
@@ -584,6 +592,8 @@ _archive_write_disk_header(struct archive *_a, struct archive_entry *entry)
 
        if (a->deferred & TODO_FFLAGS) {
                fe = current_fixup(a, archive_entry_pathname(entry));
+               if (fe == NULL)
+                       return (ARCHIVE_FATAL);
                fe->fixup |= TODO_FFLAGS;
                /* TODO: Complete this.. defer fflags from below. */
        }
@@ -1495,8 +1505,11 @@ new_fixup(struct archive_write_disk *a, const char *pathname)
        struct fixup_entry *fe;
 
        fe = (struct fixup_entry *)calloc(1, sizeof(struct fixup_entry));
-       if (fe == NULL)
+       if (fe == NULL) {
+               archive_set_error(&a->archive, ENOMEM,
+                   "Can't allocate memory for a fixup");
                return (NULL);
+       }
        fe->next = a->fixup_list;
        a->fixup_list = fe;
        fe->fixup = 0;
@@ -1883,6 +1896,8 @@ create_dir(struct archive_write_disk *a, char *path)
        if (mkdir(path, mode) == 0) {
                if (mode != mode_final) {
                        le = new_fixup(a, path);
+                       if (le == NULL)
+                               return (ARCHIVE_FATAL);
                        le->fixup |=TODO_MODE_BASE;
                        le->mode = mode_final;
                }
@@ -2320,6 +2335,8 @@ set_fflags(struct archive_write_disk *a)
                 */
                if ((critical_flags != 0)  &&  (set & critical_flags)) {
                        le = current_fixup(a, a->name);
+                       if (le == NULL)
+                               return (ARCHIVE_FATAL);
                        le->fixup |= TODO_FFLAGS;
                        le->fflags_set = set;
                        /* Store the mode if it's not already there. */

diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
index 3b0f4ae294da0619031be0352959ed0c0642729a..f07dd0dcbc41c1dd80d8d529af9e96857b62070e 100644 (file)
--- a/libarchive/archive_write_set_format_pax.c
+++ b/libarchive/archive_write_set_format_pax.c
@@ -1862,7 +1862,7 @@ _sparse_list_add_block(struct pax *pax, int64_t offset, int64_t length,
        sb->is_hole = is_hole;
        sb->offset = offset;
        sb->remaining = length;
-       if (pax->sparse_list == NULL)
+       if (pax->sparse_list == NULL || pax->sparse_tail == NULL)
                pax->sparse_list = pax->sparse_tail = sb;
        else {
                pax->sparse_tail->next = sb;