On Thu, 17 Sep 2026 15:47:12 GMT, Matthias Baesken <[email protected]> wrote:
> The gcc static analyzer reports this issue : > > > src/jdk.jdwp.agent/share/native/libjdwp/signature.c:49:28: warning: > dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] > src/jdk.jdwp.agent/share/native/libjdwp/signature.c:50:12: warning: > dereference of NULL 'tagPtr' [CWE-476] [-Wanalyzer-null-dereference] > > > Normally the > char *tagPtr = strchr(signature, SIGNATURE_END_ARGS); > call should not return NULL; but maybe (in theory with bad/malformed input) > it could happen so better add a NULL check. > In debug builds, the following JDI_ASSERT should handle it. > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/jdk.jdwp.agent/share/native/libjdwp/signature.c line 49: > 47: if (tagPtr == NULL) { > 48: EXIT_ERROR(AGENT_ERROR_NULL_POINTER, "Invalid method signature"); > 49: } request->methodSignature is setup by the following: error = methodSignature(method, NULL, &request->methodSignature, NULL); methodSignature() does the following: error = JVMTI_FUNC_PTR(gdata->jvmti,GetMethodName) (gdata->jvmti, method, &name, &signature, &generic_signature); And then: if ( psignature != NULL ) { *psignature = signature; psignature is the &request->methodSignature argument. So this is how it gets setup. I don't see how strchr(signature, SIGNATURE_END_ARGS) can ever fail. It would mean a bug in the JVMTI or the debug agent, which we should be catching with an assert in debug builds as we currently do, not with an EXIT_ERROR that applies to all builds. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32929#discussion_r4051258173
