Possible bug in tradcpp.c?

[Zack Weinberg]

On Mon, Nov 06, 2000 at 11:11:34AM -0500, Kaveh R. Ghazi wrote:
> While creating an unrelated patch to the trad* files, I noticed that
> there is a possible bug in tradcpp.c:
> 
>  > void
>  > special_symbol (hp, op)
>  >      HASHNODE *hp;
>  >      FILE_BUF *op;
>  > {
>  >   char *buf = 0;
>  >   [...]
>  > 
>  >   switch (hp->type) {
>  >   case T_FILE:
>  >   case T_BASE_FILE:
>  >     {
>  >       const char *string;
>  >       if (hp->type == T_FILE)
>  > 	string = ip->fname;
>  >       else
>  > 	string = instack[0].fname;
>  > 
>  >       if (string)
>  > 	{
>  > 	  buf = (char *) alloca (3 + strlen (string));
>  > 	  sprintf (buf, "\"%s\"", string);
>  > 	}
>  >       else
>  > 	strcpy (buf, "\"\"");
>  > 
>  >       break;
>  >     }
> 
> I think that last strcpy will try to copy two double quotes into a
> NULL pointer buf.  However I can't figure out a testcase to verify
> this.  I think the fix would be to simply assign buf = (char *) "".
> Thoughts?

I'm not sure that code path can ever be executed, but if it does,
you're right, it'll crash.  Look at the section that sets up
instack[0], see if it can ever be null.

If it can happen, buf = (char *) "" would probably work, although
there might be code downstream that modifies the string.

zw