public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug analyzer/107345] New: - -Wanayzer-null-dereference false positive with  giving weird path infomation
@ 2022-10-21  9:52 geoffreydgr at icloud dot com
  2022-10-24 14:35 ` [Bug analyzer/107345] " dmalcolm at gcc dot gnu.org
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: geoffreydgr at icloud dot com @ 2022-10-21  9:52 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345

            Bug ID: 107345
           Summary: - -Wanayzer-null-dereference false positive with
                    giving weird path infomation
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: geoffreydgr at icloud dot com
  Target Milestone: ---

I got a weird false positive error when compiling the following "minimal,
complete and verifiable example (MCVE)" program.

```
#include <stdio.h>
int main() {   
  int e = 10086;
  int *f = &e;
  int g = 0;
  int *h[2][1];
  h[1][0] = f;
  if (g == (h[1][0])) {
    // printf("if true\n");
    unsigned int *i = 0;
  }
  printf("NPD_FLAG: %d\n ", *f);
  return 0;
}
```

Compiling the above code with gcc 12.1 with `-O0 -fanalyzer` in
https://godbolt.org/z/av4beszh7 results in :

```
<source>: In function 'main':
<source>:8:9: warning: comparison between pointer and integer
    8 |   if (g == (h[1][0])) {
      |         ^~
<source>:12:3: warning: dereference of NULL 'f' [CWE-476]
[-Wanalyzer-null-dereference]
   12 |   printf("NPD_FLAG: %d\n ", *f);
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  'main': events 1-4
    |
    |    8 |   if (g == (h[1][0])) {
    |      |      ^
    |      |      |
    |      |      (1) following 'true' branch...
    |    9 |     // printf("if true\n");
    |   10 |     unsigned int *i = 0;
    |      |                   ~
    |      |                   |
    |      |                   (2) ...to here
    |      |                   (3) '&e' is NULL
    |   11 |   }
    |   12 |   printf("NPD_FLAG: %d\n ", *f);
    |      |   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |   |
    |      |   (4) dereference of NULL 'f'
    |
```

It is obvious that dereference of  'f' at line 12 cannot result in NPD. It is
weird that the tool reports "(3) '&e' is NULL" at line 10.  There is even no 
'&e' there.
But if i change the original program to the following one,  the NPD false
positive goes away.

```
#include <stdio.h>
int main() {   
  int e = 10086;
  int *f = &e;
  int g = 0;
  int *h[2][1];
  h[1][0] = f;
  if (g == (f)) {
    // printf("if true\n");
    unsigned int *i = 0;
  }
  printf("NPD_FLAG: %d\n ", *f);
  return 0;
}
```

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2023-03-29 19:15 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-21  9:52 [Bug analyzer/107345] New: - -Wanayzer-null-dereference false positive with giving weird path infomation geoffreydgr at icloud dot com
2022-10-24 14:35 ` [Bug analyzer/107345] " dmalcolm at gcc dot gnu.org
2022-10-24 20:49 ` cvs-commit at gcc dot gnu.org
2022-10-24 21:02 ` dmalcolm at gcc dot gnu.org
2022-10-28 15:54 ` geoffreydgr at icloud dot com
2022-10-28 15:56 ` geoffreydgr at icloud dot com
2023-03-29 18:18 ` [Bug analyzer/107345] -Wanalyzer-null-dereference " cvs-commit at gcc dot gnu.org
2023-03-29 19:15 ` dmalcolm at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).