uninit member in destructor – Coverity UNINIT and UNINIT_CTOR checkers

Recently we encountered a serious bug like the code below – destructor function delete one member ptr, which was never init’d. At first, we were assuming checker UNINIT could help figure it out as we do not see any difference between destructor and other common functions. Unfortunately, we failed. Then we tried to turn on checker UNINIT_CTOR, which is used to detect the uninit non static members within the constructor. On one hand, it indeed gave the warning like it is expected; on the other hand, this checker did not care about other functions except constructor, which may cause false alarm like below. No matter the golden rule ‘member init within constructor’ is followed or not, the key point would be if this uninit issue could be reported within desctructor – currently seems not.

28      /* daveti - cov code starts */
29      class Daveti
30      {
31      public:
32              int a;
33              int b;
34      };
35
36      class MyCov
37      {
38      public:
39              int c;
/*
Event member_decl: Class member declaration for ""myPtr"".
Also see events: [uninit_member]
*/
40              Daveti *myPtr;
41
42              MyCov()
43              {
44                      c = 0xffff;
/*
Event uninit_member: Non-static class member ""myPtr"" is not initialized in this constructor nor in any functions that it calls.
Also see events: [member_decl]
*/
45              }
46
47              ~MyCov()
48              {
49                      delete(myPtr);
50              }
51
52              void myPrintf()
53              {
54                      printf("c = %d, Daveti.a = %dn", c, myPtr->a);
55              }
56      };
57
58      void myFunc(MyCov *ptr)
59      {
60              // Init the wild ptr
61              ptr->myPtr = new Daveti();
62      }
63      /* daveti - cov code ends */
64
65      void
66      VPEmain(ULONG dummy0, ULONG init_type)
67      {
68      /* daveti - cov code starts */
69      MyCov *myCovObj = new MyCov();
70      myFunc(myCovObj); /* daveti - member init outside constructor */
71      myCovObj->myPrintf();
72      delete(myCovObj); /* daveti - issued line if line 70 is commented */
73      /* daveti - cov code ends */

About daveti

Interested in kernel hacking, compilers, machine learning and guitars.
This entry was posted in Programming, Static Code Analysis and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s