false positive due to lack of bit-level constraints

[llvmbot]

Bugzilla Link	4173
Resolution	DUPLICATE
Resolved on	Feb 22, 2010 12:55
Version	unspecified
OS	Linux
Reporter	LLVM Bugzilla Contributor
CC	@tkremenek,@xuzhongxing

Extended Description

scan-build gcc -Wall -O3 -c tst1.c

produce

ANALYZE: tst1.c foo
tst1.c:21:10: warning: Dereference of null pointer
pB->n = 0;
~~~~^
1 diagnostic generated.
scan-build: 1 bugs found.

cat tst1.c
#include <stdio.h>

struct blob {
int n;
void *p;
};

extern void bar(FILE**);

void foo(int x, int *y)
{
struct blob *pB = NULL;

if( !(x & 0x16) )
    bar((FILE**) (void*)&pB);

if( !(x & 0x16) ) {
    if(*y==0) {
        *y = 5;
    } else {
        pB->n = 0;
    }
}

}

[llvmbot]

assigned to @tkremenek

[llvmbot]

reduced testcase with rev.# 71165
emit "tst2.c:16:6: warning: Dereference of undefined pointer value"

struct blob {
int n;
void *p;
};

extern void bar(struct blob**);

void foo(int x)
{
struct blob *pB;

if( !(x & 0x16) )
    bar(&pB);

if( !(x & 0x16) )
pB->n = 0;

}

[tkremenek]

Should be an easy one to fix.

[tkremenek]

Should be an easy one to fix.

Correction: this isn't an easy fix. It requires being able to reason that at least one of the bits remaining after the bit-mask is non-zero.

The issue is with 'x & 0x16'. For example, this doesn't trigger a warning:

struct blob {
int n;
void *p;
};

extern void bar(struct blob**);

void foo(int x)
{
struct blob *pB;

if( !(x) )
    bar(&pB);

if( !(x) )
    pB->n = 0;

}

We need some kind of bit-level constraints for this.

[tkremenek]

*** Bug llvm/llvm-bugzilla-archive#4268 has been marked as a duplicate of this bug. ***

[llvmbot]

I think a lot of false positives can be eliminated if the analyzer at least could detect the case that a value has not changed at all between two identical bit-wise tests (in this case, x did not change at all).

This would be a good stop-gap measure before complete bit-level constraints are implemented.

[tkremenek]

Consolidating the tracking of the resolution of this issue with an earlier PR: 3098

*** This bug has been marked as a duplicate of bug #3470 ***

[tkremenek]

mentioned in issue llvm/llvm-bugzilla-archive#4268