Geoffrey1014 / SA_Bugs

record bugs of static analyzers
1 stars 1 forks source link

GCC --Wanalyzer-null-dereference false nagetive with `*p = i` #68

Open ghost opened 1 year ago

ghost commented 1 year ago
int array[3] = {};

int main() {
    int i;
    int *p;

    for (i = 0; i < 1; i++) {
        for (p = (void *)array[0]; p != &array[1]; p = &array[2]) {
            if (*p == i) {
                *p = i;
            }
        }
    }
}

report: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110521

ghost commented 1 year ago

Hi, in this case (https://godbolt.org/z/azzTd94hz), the p is a null poinetr, but the analyzer doesn't report an NPD with it. When int array[3] = {0, 0, 0} (https://godbolt.org/z/TM7Ws3Gav), the analyzer reports that.

ghost commented 10 months ago

CSA not FN: https://godbolt.org/z/EMxET5E67