The potential null pointer is passed into '_fread' function. Inspect the first argument. Check lines: 272, 269. directiv.c 272
/* v2.14 : Get File Size */
fseek( file, 0L, SEEK_END );
sz = ftell( file ) - fileoffset; // sz = total data size to load into segment/section.
fseek( file, 0L, SEEK_SET );
pBinData = (unsigned char*)malloc(sz);
if ( fileoffset )
fseek( file, fileoffset, SEEK_SET ); /* fixme: use fseek64() */
result = fread(pBinData, sz, 1, file);
OutputBinBytes(pBinData, sz);
The 'alloca' function is used inside the loop. This can quickly overflow stack. listing.c 279
case LSTTYPE_TMACRO:
ll.buffer[1] = '=';
for ( p1 = sym->string_ptr, p2 = &ll.buffer[3], pll = ≪ *p1; ) {
if ( p2 >= &pll->buffer[28] ) {
struct lstleft *next = myalloca( sizeof( struct lstleft ) );
pll->next = next;
pll = next;
pll->next = NULL;
memset( pll->buffer, ' ', sizeof( pll->buffer) );
p2 = &pll->buffer[3];
}
*p2++ = *p1++;
}
break;
The potential null pointer is passed into 'strcpy' function. Inspect the first argument. Check lines: 331, 330. macrolib.c 331
for (j = 0; j < macroLen[i]; j++)
{
srcLines[j] = (char *)malloc(MAX_LINE_LEN);
strcpy(srcLines[j], macCode[(start_pos + j)]);
}
It is possible that 'break' statement is missing in switch statement. invoke.c 4148
case 8:
#if AMD64_SUPPORT
if ((ModuleInfo.curr_cpu & P_CPU_MASK) >= P_64)
break;
#endif
/* v2.06: added support for double constants */
if (opnd.kind == EXPR_CONST || opnd.kind == EXPR_FLOAT) {
AddLineQueueX(" pushd %r (%s)", T_HIGH32, fullparam);
qual = T_LOW32;
instr = "d";
break;
}
default:
DebugMsg1(("PushInvokeParm(%u): error, CONST, asize=%u, psize=%u, pushsize=%u\n",
reqParam, asize, psize, pushsize));
EmitErr(INVOKE_ARGUMENT_TYPE_MISMATCH, reqParam + 1);
The 'alloca' function is used inside the loop. This can quickly overflow stack. macro.c 499
The 'alloca' function is used inside the loop. This can quickly overflow stack. macro.c 834
A call of the 'sprintf' function will lead to overflow of the buffer 'buffer + strlen(buffer)'. proc.c 2290
for (i = unw_info.CountOfCodes; i; i--) {
/* v2.11: use field FrameOffset */
//sprintf( buffer + strlen( buffer ), "%s 0%xh", pfx, unw_code[i-1] );
sprintf(buffer + strlen(buffer), "%s 0%xh", pfx, unw_code[i - 1].FrameOffset);
pfx = ",";
if (i == 1 || strlen(buffer) > 72) {
AddLineQueue(buffer);
buffer[0] = NULLC;
pfx = "dw";
}
Numeric Truncation Error. Return value of the 'strlen' function is written to the 8-bit variable. symbols.c 557
It is possible that 'break' statement is missing in switch statement. tokenize.c 649
case '/' : /* 0x2F: binary operator */
minuslbl:
/* all of these are themselves a token */
p->input++;
buf->token = symbol;
buf->specval = 0; /* initialize, in case the token needs extra data */
/* v2.06: use constants for the token string */
buf->string_ptr = (char *)&stokstr1[symbol - '('];
break;
case '[' : /* T_OP_SQ_BRACKET operator - needs a matching ']' (0x5B) */
a = '[';
case ']' : /* T_CL_SQ_BRACKET (0x5D) */
p->input++;
The potential null pointer is passed into '_fseek_nolock' function. Inspect the first argument. symbols.c 1023
It is possible that 'break' statement is missing in switch statement. tbyte.c 439
It is possible that 'break' statement is missing in switch statement. parser.c 3542
It is possible that 'break' statement is missing in switch statement. parser.c 3529
It is possible that 'break' statement is missing in switch statement. parser.c 2496
It is possible that 'break' statement is missing in switch statement. parser.c 2481
It is possible that 'break' statement is missing in switch statement. parser.c 299
It is possible that 'break' statement is missing in switch statement. data.c 999
It is possible that 'break' statement is missing in switch statement. condasm.c 628
It is possible that 'break' statement is missing in switch statement. branch.c 423
