On Fri, 18 Sep 2026 22:50:45 GMT, Chris Plummer <[email protected]> wrote:
>> The gcc static analyzer reports this issue : >> >> >> src/jdk.jdwp.agent/share/native/libjdwp/signature.c:49:28: warning: >> dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] >> src/jdk.jdwp.agent/share/native/libjdwp/signature.c:50:12: warning: >> dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] >> >> >> Normally the >> char *tagPtr = strchr(signature, SIGNATURE_END_ARGS); >> call should not return NULL; but maybe (in theory with bad/malformed input) >> it could happen so better add a NULL check. >> In debug builds, the following JDI_ASSERT should handle it. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > src/jdk.jdwp.agent/share/native/libjdwp/signature.c line 49: > >> 47: if (tagPtr == NULL) { >> 48: EXIT_ERROR(AGENT_ERROR_NULL_POINTER, "Invalid method signature"); >> 49: } > > request->methodSignature is setup by the following: > > error = methodSignature(method, NULL, &request->methodSignature, NULL); > > methodSignature() does the following: > > error = JVMTI_FUNC_PTR(gdata->jvmti,GetMethodName) > (gdata->jvmti, method, &name, &signature, &generic_signature); > > And then: > > if ( psignature != NULL ) { > *psignature = signature; > > psignature is the &request->methodSignature argument. So this is how it gets > setup. I don't see how strchr(signature, SIGNATURE_END_ARGS) can ever fail. > It would mean a bug in the JVMTI or the debug agent, which we should be > catching with an assert in debug builds as we currently do, not with an > EXIT_ERROR that applies to all builds. Could there be something overwritten in the signature in error cases, that leads to 'bad'/broken method signatures? ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32929#discussion_r4060016915
