Bugs item #3042715, was opened at 2010-08-10 12:51
Message generated for change (Settings changed) made by wsalivar
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3042715&group_id=976

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: libcurl
Group: hang
>Status: Deleted
Resolution: None
Priority: 5
Private: No
Submitted By: Bill Salivar (wsalivar)
Assigned to: Daniel Stenberg (bagder)
Summary: Infinite loop condition in glob_cleanup() (urlglob.c)

Initial Comment:
A run against version 7.19.4 of libCurl using Coverity Prevent has found an infinite loop condition. I have checked the latest version of libCurl (7.21.0) and the code is the same. Any idea what the correct loop logic should be?

374 void glob_cleanup(URLGlob* glob)
375 {
376 size_t i;
377 int elem;
378
Event non_progress_update: Update "--i" makes no progress toward falsifying loop condition "i < glob->size"
Event loop_top: Top of loop.
Event loop_bottom: Bottom of loop.
Event loop_condition: "i < glob->size" must remain true for the loop to continue.
379 for (i = glob->size - 1; i < glob->size; --i) {
380 if (!(i & 1)) { /* even indexes contain literals */
381 free(glob->literal[i/2]);
382 }
383 else { /* odd indexes contain sets or ranges */
384 if (glob->pattern[i/2].type == UPTSet) {
385 for (elem = glob->pattern[i/2].content.Set.size - 1;
386 elem >= 0;
387 --elem) {
388 free(glob->pattern[i/2].content.Set.elements[elem]);
389 }
390 free(glob->pattern[i/2].content.Set.elements);
391 }
392 }
393 }
394 free(glob->glob_buffer);
395 free(glob);
396 }

----------------------------------------------------------------------

You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=100976&aid=3042715&group_id=976
Received on 2010-08-10