PVS V522: null pointer dereferences

Change-Id: Iaa753ef3a93c36031789a85f87e569fc410d3304
Reviewed-on: https://review.haiku-os.org/c/1604
Reviewed-by: Stephan Aßmus <superstippi@gmx.de>

headers/os/media/MediaRecorder.h

@@ -72,7 +72,7 @@ protected:
 			// Get the producer node source
 			const media_source&	MediaSource() const;
 			// This is the our own input
-			const media_input&	MediaInput() const;
+			const media_input	MediaInput() const;
 
 	virtual	void				BufferReceived(void* buffer, size_t size,
 									const media_header& header);

src/add-ons/kernel/bus_managers/usb/Device.cpp

@@ -255,17 +255,22 @@ Device::Device(Object* parent, int8 hubAddress, uint8 hubPort,
 				}
 
 				case USB_DESCRIPTOR_ENDPOINT_COMPANION: {
-					usb_endpoint_descriptor* desc = currentInterface
-						->endpoint[currentInterface->endpoint_count - 1].descr;
-					if ((uint8*)desc != (&configData[descriptorStart
-							- desc->length])) {
-						TRACE_ERROR("found endpoint companion descriptor not immediately "
-							"following endpoint descriptor, ignoring!\n");
-						break;
+					if (currentInterface != NULL) {
+						usb_endpoint_descriptor* desc
+							= currentInterface->endpoint[
+								currentInterface->endpoint_count - 1].descr;
+						if ((uint8*)desc != (&configData[descriptorStart
+								- desc->length])) {
+							TRACE_ERROR("found endpoint companion descriptor "
+								"not immediately following endpoint "
+								"descriptor, ignoring!\n");
+							break;
+						}
+						// TODO: It'd be nicer if we could store the endpoint
+						// companion descriptor along with the endpoint
+						// descriptor, but as the interface struct is public
+						// API, that would be an ABI break.
 					}
-					// TODO: It'd be nicer if we could store the endpoint companion
-					// descriptor along with the endpoint descriptor, but as the
-					// interface struct is public API, that would be an ABI break.
 
 					// fall through
 				}

src/add-ons/kernel/drivers/network/wlan/marvell88w8335/dev/malo/if_malohal.c

@@ -347,7 +347,8 @@ malo_hal_send_helper(struct malo_hal *mh, int bsize,
 {
 	mh->mh_cmdbuf[0] = htole16(MALO_HOSTCMD_CODE_DNLD);
 	mh->mh_cmdbuf[1] = htole16(bsize);
-	memcpy(&mh->mh_cmdbuf[4], data , dsize);
+	if (data != NULL)
+		memcpy(&mh->mh_cmdbuf[4], data , dsize);
 
 	malo_hal_trigger_pcicmd(mh);
 
@@ -410,7 +411,8 @@ malo_hal_send_main(struct malo_hal *mh, const void *data, size_t dsize,
 	mh->mh_cmdbuf[1] = htole16(dsize);
 	mh->mh_cmdbuf[2] = htole16(seqnum);
 	mh->mh_cmdbuf[3] = 0;
-	memcpy(&mh->mh_cmdbuf[4], data, dsize);
+	if (data != NULL)
+		memcpy(&mh->mh_cmdbuf[4], data, dsize);
 
 	malo_hal_trigger_pcicmd(mh);
 

src/add-ons/kernel/file_systems/netfs/shared/RequestUnflattener.cpp

@@ -26,7 +26,7 @@ status_t
 Reader::Read(int32 size, void** buffer, bool* mustFree)
 {
 	// check params
-	if (size < 0 || !buffer || mustFree)
+	if (size < 0 || !buffer || !mustFree)
 		return B_BAD_VALUE;
 
 	// deal with size == 0

src/apps/icon-o-matic/generic/gui/scrollview/Scrollable.cpp

@@ -39,7 +39,7 @@ Scrollable::SetScrollSource(Scroller* source)
 		fScrollSource = NULL;
 		// Notify the old source, if it doesn't know about the change.
 		if (oldSource && oldSource->ScrollTarget() == this)
-			fScrollSource->SetScrollTarget(NULL);
+			oldSource->SetScrollTarget(NULL);
 		fScrollSource = source;
 		// Notify the new source, if it doesn't know about the change.
 		if (source && source->ScrollTarget() != this)

src/kits/media/MediaRecorder.cpp

@@ -333,14 +333,14 @@ BMediaRecorder::MediaSource() const
 }
 
 
-const media_input&
+const media_input
 BMediaRecorder::MediaInput() const
 {
 	CALLED();
 
-	media_input* input = NULL;
-	fNode->GetInput(input);
-	return *input;
+	media_input input;
+	fNode->GetInput(&input);
+	return input;
 }
 
 

src/kits/media/experimental/MediaClientNode.cpp

@@ -675,8 +675,9 @@ BMediaClientNode::_GetNextBuffer(BMediaOutput* output, bigtime_t eventTime)
 {
 	CALLED();
 
-	BBuffer* buffer = NULL;
-	if (output->fBufferGroup->RequestBuffer(buffer, 0) != B_OK) {
+	BBuffer* buffer
+		= output->fBufferGroup->RequestBuffer(output->BufferSize(), 0);
+	if (buffer == NULL) {
 		TRACE("MediaClientNode:::_GetNextBuffer: Failed to get the buffer\n");
 		return NULL;
 	}

src/kits/tracker/NodeWalker.cpp

@@ -391,6 +391,9 @@ static int32
 build_dirent(const BEntry* source, struct dirent* ent,
 	size_t size, int32 count)
 {
+	if (source == NULL)
+		return 0;
+
 	entry_ref ref;
 	source->GetRef(&ref);