[Bug analyzer/109060] New: -Wanalyzer-deref-before-check false positives seen in haproxy's cfgparse.c: parse_process_number

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109060

            Bug ID: 109060
           Summary: -Wanalyzer-deref-before-check false positives seen in
                    haproxy's cfgparse.c: parse_process_number
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: dmalcolm at gcc dot gnu.org
  Target Milestone: ---

Created attachment 54603
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54603&action=edit
Reproducer

https://godbolt.org/z/qnd1TrWsh

Trunk falsely emits this on the attached file:

$ ./xgcc -B. -S -fanalyzer -Wall ../../src/haproxy-cfgparse.c 
../../src/haproxy-cfgparse.c: In function ‘parse_process_number’:
../../src/haproxy-cfgparse.c:58:21: warning: check of ‘dash’ for NULL after
already dereferencing it [-Wanalyzer-deref-before-check]
   58 |       if (*p == '-' && !dash)
      |           ~~~~~~~~~~^~~~~~~~
  ‘parse_process_number’: events 1-16
    |
    |   47 |   if (strcmp(arg, "all") == 0)
    |      |      ~^~~~~~~~~~~~~~~~~~
    |      |      ||
    |      |      |(1) pointer ‘dash’ is dereferenced here
    |      |      (2) following ‘false’ branch (when the strings are
non-equal)...
    |   48 |     *proc |= ~0UL;
    |   49 |   else if (strcmp(arg, "odd") == 0)
    |      |           ~~~~~~~~~~~~~~~~~~~
    |      |           ||
    |      |           |(3) ...to here
    |      |           (4) following ‘false’ branch (when the strings are
non-equal)...
    |   50 |     *proc |= ~0UL / 3UL;
    |   51 |   else if (strcmp(arg, "even") == 0)
    |      |           ~~~~~~~~~~~~~~~~~~~~
    |      |           ||
    |      |           |(5) ...to here
    |      |           (6) following ‘false’ branch (when the strings are
non-equal)...
    |......
    |   54 |     const char *p, *dash = ((void*)0);
    |      |                     ~~~~
    |      |                     |
    |      |                     (7) ...to here
    |......
    |   57 |     for (p = arg; *p; p++) {
    |      |                   ~
    |      |                   |
    |      |                   (8) following ‘true’ branch...
    |      |                   (12) following ‘true’ branch...
    |   58 |       if (*p == '-' && !dash)
    |      |          ~~~~~~~~~~~~~~~~~~~
    |      |          ||         |
    |      |          ||         (10) following ‘true’ branch (when ‘dash’ is
NULL)...
    |      |          ||         (15) ...to here
    |      |          ||         (16) pointer ‘dash’ is checked for NULL here
but it was already dereferenced at (1)
    |      |          |(9) ...to here
    |      |          |(13) ...to here
    |      |          (14) following ‘true’ branch...
    |   59 |         dash = p;
    |      |         ~~~~~~~~
    |      |              |
    |      |              (11) ...to here
    |
../../src/haproxy-cfgparse.c:68:8: warning: check of ‘dash’ for NULL after
already dereferencing it [-Wanalyzer-deref-before-check]
   68 |     if (dash)
      |        ^
  ‘parse_process_number’: events 1-12
    |
    |   47 |   if (strcmp(arg, "all") == 0)
    |      |      ~^~~~~~~~~~~~~~~~~~
    |      |      ||
    |      |      |(1) pointer ‘dash’ is dereferenced here
    |      |      (2) following ‘false’ branch (when the strings are
non-equal)...
    |   48 |     *proc |= ~0UL;
    |   49 |   else if (strcmp(arg, "odd") == 0)
    |      |           ~~~~~~~~~~~~~~~~~~~
    |      |           ||
    |      |           |(3) ...to here
    |      |           (4) following ‘false’ branch (when the strings are
non-equal)...
    |   50 |     *proc |= ~0UL / 3UL;
    |   51 |   else if (strcmp(arg, "even") == 0)
    |      |           ~~~~~~~~~~~~~~~~~~~~
    |      |           ||
    |      |           |(5) ...to here
    |      |           (6) following ‘false’ branch (when the strings are
non-equal)...
    |......
    |   54 |     const char *p, *dash = ((void*)0);
    |      |                     ~~~~
    |      |                     |
    |      |                     (7) ...to here
    |......
    |   57 |     for (p = arg; *p; p++) {
    |      |                   ~
    |      |                   |
    |      |                   (8) following ‘true’ branch...
    |   58 |       if (*p == '-' && !dash)
    |      |           ~~~~~~~~~~~~~~~~~~
    |      |           |         |
    |      |           |         (10) following ‘true’ branch (when ‘dash’ is
NULL)...
    |      |           (9) ...to here
    |   59 |         dash = p;
    |      |         ~~~~~~~~
    |      |              |
    |      |              (11) ...to here
    |......
    |   68 |     if (dash)
    |      |        ~
    |      |        |
    |      |        (12) pointer ‘dash’ is checked for NULL here but it was
already dereferenced at (1)
    |