[Bug analyzer/103685] New: false positive error: dereference of NULL ‘params’ [CWE-476]

[Bug analyzer/103685] New: false positive error: dereference of NULL ‘params’ [CWE-476]

[vt at altlinux dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

            Bug ID: 103685
           Summary: false positive error: dereference of NULL ‘params’
                    [CWE-476]
           Product: gcc
           Version: 11.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: vt at altlinux dot org
  Target Milestone: ---

Obvious false positive:

gost_ec_sign.c: In function ‘fill_GOST_EC_params’:
gost_ec_sign.c:105:15: error: dereference of NULL ‘params’ [CWE-476]
[-Werror=analyzer-null-dereference]
  105 |     if (params->group) {
      |         ~~~~~~^~~~~~~
  ‘fill_GOST_EC_params’: events 1-3
    |
    |  100 |     if (!eckey || !params) {
    |      |        ^
    |      |        |
    |      |        (1) following ‘false’ branch...
    |......
    |  105 |     if (params->group) {
    |      |     ~~  ~~~~~~~~~~~~~
    |      |     |         |
    |      |     |         (3) dereference of NULL ‘params’
    |      |     (2) ...to here
    |


With the code like this:

  100     if (!eckey || !params) {
  101         GOSTerr(GOST_F_FILL_GOST_EC_PARAMS,
GOST_R_UNSUPPORTED_PARAMETER_SET);
  102         return 0;
  103     }
  104
  105     if (params->group) {

This is on compiling https://github.com/gost-engine/engine/

Back reference:
https://github.com/gost-engine/engine/issues/245#issuecomment-992007686

[Bug analyzer/103685] false positive error: dereference of NULL ‘params’ [CWE-476]

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.  Please can you provide a preprocessed reproducer
(using -E), and state the compilation flags and GCC version that you see this
with.

[Bug analyzer/103685] false positive error: dereference of NULL ‘params’ [CWE-476]

[vt at altlinux dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

--- Comment #2 from Vitaly Chikunov <vt at altlinux dot org> ---
Created attachment 51995
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51995&action=edit
reproducer created with -save-temps

gost-engine (master *)$ gcc -v -DHAVE_ADDCARRY_U64 -DL_ENDIAN -O2 -g -fanalyzer
-fPIC -Werror -Wall -Wno-unused-parameter -Wno-unused-function
-Wno-missing-braces -Wno-error=unknown-pragmas -Wno-error=pragmas
-Wno-deprecated-declarations -std=gnu90 gost_ec_sign.c.i
Using built-in specs.
COLLECT_GCC=x86_64-alt-linux-gcc
COLLECT_LTO_WRAPPER=/usr/lib64/gcc/x86_64-alt-linux/11/lto-wrapper
Target: x86_64-alt-linux
Configured with: ../configure --host=x86_64-alt-linux --build=x86_64-alt-linux
--target=x86_64-alt-linux --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin
--sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share
--includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec
--localstatedir=/var/lib --sharedstatedir=/var/lib --mandir=/usr/share/man
--infodir=/usr/share/info --disable-dependency-tracking --disable-silent-rules
--without-included-gettext --enable-shared --program-suffix=-11
--with-slibdir=/lib64 --libexecdir=/usr/lib64
--with-bugurl=http://bugzilla.altlinux.org --enable-__cxa_atexit
--enable-threads=posix --enable-checking=release --with-system-zlib
--without-included-gettext --enable-multilib --enable-default-pie
--enable-gnu-unique-object --enable-linker-build-id
--with-linker-hash-style=gnu --with-arch_32=i586 --with-tune_32=generic
--with-multilib-list=m64,m32,mx32 --with-gcc-major-version-only
--enable-vtable-verify --enable-bootstrap --with-build-config=bootstrap-lto
--enable-link-serialization=1
--enable-languages=c,c++,fortran,objc,obj-c++,ada,go,d,lto --enable-plugin
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.2.1 20210911 (ALT Sisyphus 11.2.1-alt1) (GCC)
COLLECT_GCC_OPTIONS='-v' '-D' 'HAVE_ADDCARRY_U64' '-D' 'L_ENDIAN' '-O2' '-g'
'-fanalyzer' '-fPIC' '-Werror' '-Wall' '-Wno-unused-parameter'
'-Wno-unused-function' '-Wno-missing-braces' '-Wno-error=unknown-pragmas'
'-Wno-error=pragmas' '-Wno-deprecated-declarations' '-std=gnu90'
'-mtune=generic' '-march=x86-64' '-dumpdir' 'a-'
 /usr/lib64/gcc/x86_64-alt-linux/11/cc1 -fpreprocessed gost_ec_sign.c.i
-fstack-protector-strong -fstack-clash-protection -quiet -dumpdir a- -dumpbase
gost_ec_sign.c.i -dumpbase-ext .i -mtune=generic -march=x86-64 -g -O2 -Werror
-Wall -Wno-unused-parameter -Wno-unused-function -Wno-missing-braces
-Wno-error=unknown-pragmas -Wno-error=pragmas -Wno-deprecated-declarations
-std=gnu90 -version -fanalyzer -fPIC -o /tmp/.private/vt/ccyb8qr0.s
GNU C89 (GCC) version 11.2.1 20210911 (ALT Sisyphus 11.2.1-alt1)
(x86_64-alt-linux)
        compiled by GNU C version 11.2.1 20210911 (ALT Sisyphus 11.2.1-alt1),
GMP version 6.2.1, MPFR version 4.1.0, MPC version 1.2.1, isl version none
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
GNU C89 (GCC) version 11.2.1 20210911 (ALT Sisyphus 11.2.1-alt1)
(x86_64-alt-linux)
        compiled by GNU C version 11.2.1 20210911 (ALT Sisyphus 11.2.1-alt1),
GMP version 6.2.1, MPFR version 4.1.0, MPC version 1.2.1, isl version none
GGC heuristics: --param ggc-min-expand=100 --param ggc-min-heapsize=131072
Compiler executable checksum: aff18b076d6b4cd27f175dbe6da41edc
/home/vt/src/gost-engine/gost_ec_sign.c: In function ‘fill_GOST_EC_params’:
/home/vt/src/gost-engine/gost_ec_sign.c:105:15: error: dereference of NULL
‘params’ [CWE-476] [-Werror=analyzer-null-dereference]
  105 |     if (params->group) {
      |         ~~~~~~^~~~~~~
  ‘fill_GOST_EC_params’: events 1-3
    |
    |  100 |     if (!eckey || !params) {
    |      |        ^
    |      |        |
    |      |        (1) following ‘false’ branch...
    |......
    |  105 |     if (params->group) {
    |      |     ~~  ~~~~~~~~~~~~~
    |      |     |         |
    |      |     |         (3) dereference of NULL ‘params’
    |      |     (2) ...to here
    |
cc1: all warnings being treated as errors

[Bug analyzer/103685] false positive error: dereference of NULL ‘params’ [CWE-476]

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:f5a9d76be849b4cf20b1b687febc34a937381dc3

commit r12-6781-gf5a9d76be849b4cf20b1b687febc34a937381dc3
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Wed Jan 19 12:09:09 2022 -0500

    analyzer: add regression test [PR103685]

    PR analyzer/103685 reports a false positive from
-Wanalyzer-null-dereference
    seen at -O2 with GCC 11.  I can reproduce it with GCC 11, but not with
    trunk; this patch adds a reduced test case that reproduces it with
    GCC 11 as a regression test for GCC 12 onwards.

    gcc/testsuite/ChangeLog:
            PR analyzer/103685
            * gcc.dg/analyzer/torture/pr103685.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/103685] false positive error: dereference of NULL ‘params’ [CWE-476]

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Seems to be fixed on trunk for gcc 12; feel free to reopen if this reoccurs
with gcc 12 onwards.

[Bug analyzer/103685] false positive error: dereference of NULL ‘params’ [CWE-476]

[vt at altlinux dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103685

--- Comment #5 from Vitaly Chikunov <vt at altlinux dot org> ---
(In reply to David Malcolm from comment #4)
> Seems to be fixed on trunk for gcc 12; feel free to reopen if this reoccurs
> with gcc 12 onwards.

Thanks!