Re: gcc warn when pointers not checked non-null before de-referencing.

[Jonny Grant <jg@jguk.org>]

On 03/07/2021 17:22, Segher Boessenkool wrote:
> On Sat, Jul 03, 2021 at 03:14:21PM +0100, Jonny Grant wrote:
>> We'd rather have stability and logging of errors than a core dump. Especially on embedded systems that need to guarantee safety. It's easy enough to check for NULL and check the bounds of buffers etc before using. Asserts would trigger in a debug build.
> 
> There *is* no generic way you can sanely and even safely handle null
> pointer dereferences at all.  You *have to* separately write code for
> every place you want to do something special with null pointers (or any
> other special case for that matter).
> 
> In case you are talking about a system with an event loop (or similar),
> where you can just abort the task you are doing, and get back to waiting
> for more work to do: you can just catch *all* fatal errors (which a null
> dereference normally is), log it, and go back to the main loop.  But
> even then the null dereference could be caused by something that is not
> yet fixed.  If you are lucky other tasks can still be done.   OTOH,
> perhaps just as often nothing will work anymore.

Yes, you are quite right! The error could be handled by the calling code, or logged for later debugging use, and hopefully for a safety critical system it continues to run. In some instances we would restart that module after a recurring error, and use a watchdog thread to reboot if something severe that can't be recovered on an overall system.

An example would be as follows sample function:

int component_msg(unsigned int component, const char * msg)
{
    if(NULL == msg)
    {
        log_msg("component_msg component %d called with NULL msg\n", component);
        return EFAULT;
    }
    else
    {
        log_msg("%s", msg);
        return 0;
    }
}

The calling code could also check the return of component_msg() and handle some appropriate way. Restarting the module, notifying another system, ignoring a faulty device etc

> 
> In any case, there is nothing the compiler can do for you here.  If
> programming were a mechanical job, we wouldn't need all those pesky
> programmers :-)
> 
> 
> Segher
> 


Cheers, Jonny