[Bug analyzer/108251] false positive: null dereference

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108251

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
As per comment #4 (optimization disabled), but adding: -fanalyzer-verbosity=3
makes things clearer:

../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: In function
‘smp_fetch_ssl_fc_has_early’:
../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:92:27: warning:
dereference of NULL ‘conn’ [CWE-476] [-Wanalyzer-null-dereference]
   92 |  smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
      |                       ~~~~^~~~~~~
  ‘smp_fetch_ssl_fc_has_early’: events 1-2
    |
    |   78 | smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample
*smp, const char *kw, void *private)
    |      | ^~~~~~~~~~~~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to ‘smp_fetch_ssl_fc_has_early’
    |......
    |   83 |  conn = objt_conn(smp->sess->origin);
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (2) calling ‘objt_conn’ from ‘smp_fetch_ssl_fc_has_early’
    |
    +--> ‘objt_conn’: events 3-6
           |
           |   61 | static inline struct connection *objt_conn(enum obj_type
*t)
           |      |                                  ^~~~~~~~~
           |      |                                  |
           |      |                                  (3) entry to ‘objt_conn’
           |   62 | {
           |   63 |  if (!t || *t != OBJ_TYPE_CONN)
           |      |     ~                             
           |      |     |
           |      |     (4) following ‘true’ branch (when ‘t’ is NULL)...
           |   64 |    return ((void *)0);
           |      |           ~                       
           |      |           |
           |      |           (5) ...to here
           |      |           (6) ‘0’ is NULL
           |
    <------+
    |
  ‘smp_fetch_ssl_fc_has_early’: events 7-10
    |
    |   83 |  conn = objt_conn(smp->sess->origin);
    |      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (7) return of NULL to ‘smp_fetch_ssl_fc_has_early’ from
‘objt_conn’
    |   84 |  ssl = ssl_sock_get_ssl_object(conn);
    |   85 |  if (!ssl)
    |      |     ~    
    |      |     |
    |      |     (8) following ‘false’ branch (when ‘ssl’ is non-NULL)...
    |......
    |   88 |  smp->flags = 0;
    |      |  ~~~~~~~~~~~~~~
    |      |             |
    |      |             (9) ...to here
    |......
    |   92 |  smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
    |      |                       ~~~~~~~~~~~
    |      |                           |
    |      |                           (10) dereference of NULL ‘conn’
    |