public inbox for gcc-bugs@sourceware.org help / color / mirror / Atom feed
From: "mengli.ming at outlook dot com" <gcc-bugzilla@gcc.gnu.org> To: gcc-bugs@gcc.gnu.org Subject: [Bug analyzer/108028] New: --Wanalyzer-null-dereference false posiative with *q = 1 Date: Fri, 09 Dec 2022 07:08:58 +0000 [thread overview] Message-ID: <bug-108028-4@http.gcc.gnu.org/bugzilla/> (raw) https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108028 Bug ID: 108028 Summary: --Wanalyzer-null-dereference false posiative with *q = 1 Product: gcc Version: 13.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: analyzer Assignee: dmalcolm at gcc dot gnu.org Reporter: mengli.ming at outlook dot com Target Milestone: --- I got a false positive error when compiling the following program with gcc(trunk) -fanalyzer -O2 in https://godbolt.org/z/W37MzrPqd. The `__analyzer_eval()` statement is added at some suitable places in the code in order to keep track of the information already available to the analyzer at some point in the static analysis of the program. After that, I found that under -O0, for this program (https://godbolt.org/z/Y1GMEMaG9), `__analyzer_eval(p && (0 == q))`, `__analyzer_eval(p)`, `__analyzer_eval(0 == q)` give the same result at the same program point as -O2 without generating the NPD warning. The following is the result of the analysis obtained using -O2, please take a look, thank you. ``` #include "stdio.h" int f(int, int *); int f(int p, int *q) { __analyzer_eval(p && (0 == q)); if (p && (0 == q)) { __analyzer_eval(p && (0 == q)); __analyzer_eval(p); __analyzer_eval(0 == p); __analyzer_eval(q); __analyzer_eval(0 == q); *q = 1; } printf("NPD_FLAG\n"); } int main() { int a = 0; int *b = (void*)0; f(a, b); } ``` ``` <source>: In function 'f': <source>:6:5: warning: FALSE 6 | __analyzer_eval(p && (0 == q)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <source>:6:5: warning: UNKNOWN <source>:9:9: warning: TRUE 9 | __analyzer_eval(p && (0 == q)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ <source>:10:9: warning: TRUE 10 | __analyzer_eval(p); | ^~~~~~~~~~~~~~~~~~ <source>:11:9: warning: FALSE 11 | __analyzer_eval(0 == p); | ^~~~~~~~~~~~~~~~~~~~~~~ <source>:12:9: warning: UNKNOWN 12 | __analyzer_eval(q); | ^~~~~~~~~~~~~~~~~~ <source>:13:9: warning: TRUE 13 | __analyzer_eval(0 == q); | ^~~~~~~~~~~~~~~~~~~~~~~ <source>:14:12: warning: dereference of NULL '0' [CWE-476] [-Wanalyzer-null-dereference] 14 | *q = 1; | ~~~^~~ 'f': events 1-3 | | 7 | if (p && (0 == q)) | | ^ | | | | | (1) following 'true' branch... | 8 | { | 9 | __analyzer_eval(p && (0 == q)); | | ~~~~~~~~~~~~~~~ | | | | | (2) ...to here |...... | 14 | *q = 1; | | ~~~~~~ | | | | | (3) dereference of NULL '0' ``` In the analysis under -O2 above, lines 12 and 13 are somewhat contradictory, as `__analyzer_eval(q)` results in UNKNOWN while `__analyzer_eval(0 == q)` results in TRUE.
next reply other threads:[~2022-12-09 7:08 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-12-09 7:08 mengli.ming at outlook dot com [this message] 2022-12-13 22:38 ` [Bug analyzer/108028] Misleading -fanalyzer messages at -O2 and above dmalcolm at gcc dot gnu.org 2022-12-13 22:55 ` dmalcolm at gcc dot gnu.org 2022-12-14 15:27 ` mengli.ming at outlook dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-108028-4@http.gcc.gnu.org/bugzilla/ \ --to=gcc-bugzilla@gcc.gnu.org \ --cc=gcc-bugs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).