On Thu, 17 Sep 2026 15:47:12 GMT, Matthias Baesken <[email protected]> wrote:
> The gcc static analyzer reports this issue : > > > src/jdk.jdwp.agent/share/native/libjdwp/signature.c:49:28: warning: > dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] > src/jdk.jdwp.agent/share/native/libjdwp/signature.c:50:12: warning: > dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] > > > Normally the > char *tagPtr = strchr(signature, SIGNATURE_END_ARGS); > call should not return NULL; but maybe (in theory with bad/malformed input) > it could happen so better add a NULL check. > In debug builds, the following JDI_ASSERT should handle it. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). In check_code we are also defensive https://github.com/openjdk/jdk/blob/46fbea9c4b9b628e43dd8474bde2bd8e984bf857/src/java.base/share/native/libverify/check_code.c#L3834-L3838 (not sure if the method and class signatures need different handling and one is more 'trustworthy' than the other) ------------- PR Comment: https://git.openjdk.org/jdk/pull/32929#issuecomment-5934402999
