[ https://issues.apache.org/jira/browse/CASSANDRA-12568?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15450645#comment-15450645 ]
Dave Brosius commented on CASSANDRA-12568: ------------------------------------------ this assumes there are no tokens passed to the constructor. If that were the case, it would have already exploded. > Null Dereference > ---------------- > > Key: CASSANDRA-12568 > URL: https://issues.apache.org/jira/browse/CASSANDRA-12568 > Project: Cassandra > Issue Type: Sub-task > Reporter: Eduardo Aguinaga > > Overview: > In May through June of 2016 a static analysis was performed on version 3.0.5 > of the Cassandra source code. The analysis included an automated analysis > using HP Fortify v4.21 SCA and a manual analysis utilizing SciTools > Understand v4. The results of that analysis includes the issue below. > Issue: > In the file ReplicationAwareTokenAllocator.java on line 189 the object curr > may be null causing a null dereference. > The member first is initialized to null on line 175. If the for loop that > begins on line 176 is never entered, curr will be assigned the value of first > (which would be null in this example) on line 185. This will result in a null > dereference on line 189. > {code:java} > ReplicationAwareTokenAllocator.java, lines 171-193: > 171 private TokenInfo<Unit> createTokenInfos(Map<Unit, UnitInfo<Unit>> units, > GroupInfo newUnitGroup) > 172 { > 173 // build the circular list > 174 TokenInfo<Unit> prev = null; > 175 TokenInfo<Unit> first = null; > 176 for (Map.Entry<Token, Unit> en : sortedTokens.entrySet()) > 177 { > 178 Token t = en.getKey(); > 179 UnitInfo<Unit> ni = units.get(en.getValue()); > 180 TokenInfo<Unit> ti = new TokenInfo<>(t, ni); > 181 first = ti.insertAfter(first, prev); > 182 prev = ti; > 183 } > 184 > 185 TokenInfo<Unit> curr = first; > 186 do > 187 { > 188 populateTokenInfoAndAdjustUnit(curr, newUnitGroup); > 189 curr = curr.next; > 190 } while (curr != first); > 191 > 192 return first; > 193 } > {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)