BUG OF THE MONTH | Problems with Null Pointers

V522 Dereferencing of the null pointer ‘slot’ might take place. kis_spriter_export.cpp 568

KisImportExportFilter::ConversionStatus KisSpriterExport::convert(
    KisDocument *document,
    QIODevice *io, 
    KisPropertiesConfigurationSP /*configuration*/)
{
    ....
    SpriterSlot *slot = 0;                                  

    // layer.name format: "base_name bone(bone_name) slot(slot_name)"
    if (file.layerName.contains("slot(")) {
        int start = file.layerName.indexOf("slot(") + 5;
        int end = file.layerName.indexOf(')', start);
        slot->name = file.layerName.mid(start, end - start); 
        slot->defaultAttachmentFlag = ....                  
    }
    ....
}

In this example, a dereference of the null pointer slot will certainly occur, which in turn results in undefined behavior.

Please click here to see more bugs from this project.