https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108251
--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> --- As per comment #4 (optimization disabled), but adding: -fanalyzer-verbosity=3 makes things clearer: ../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: In function ‘smp_fetch_ssl_fc_has_early’: ../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:92:27: warning: dereference of NULL ‘conn’ [CWE-476] [-Wanalyzer-null-dereference] 92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) && | ~~~~^~~~~~~ ‘smp_fetch_ssl_fc_has_early’: events 1-2 | | 78 | smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample *smp, const char *kw, void *private) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (1) entry to ‘smp_fetch_ssl_fc_has_early’ |...... | 83 | conn = objt_conn(smp->sess->origin); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (2) calling ‘objt_conn’ from ‘smp_fetch_ssl_fc_has_early’ | +--> ‘objt_conn’: events 3-6 | | 61 | static inline struct connection *objt_conn(enum obj_type *t) | | ^~~~~~~~~ | | | | | (3) entry to ‘objt_conn’ | 62 | { | 63 | if (!t || *t != OBJ_TYPE_CONN) | | ~ | | | | | (4) following ‘true’ branch (when ‘t’ is NULL)... | 64 | return ((void *)0); | | ~ | | | | | (5) ...to here | | (6) ‘0’ is NULL | <------+ | ‘smp_fetch_ssl_fc_has_early’: events 7-10 | | 83 | conn = objt_conn(smp->sess->origin); | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (7) return of NULL to ‘smp_fetch_ssl_fc_has_early’ from ‘objt_conn’ | 84 | ssl = ssl_sock_get_ssl_object(conn); | 85 | if (!ssl) | | ~ | | | | | (8) following ‘false’ branch (when ‘ssl’ is non-NULL)... |...... | 88 | smp->flags = 0; | | ~~~~~~~~~~~~~~ | | | | | (9) ...to here |...... | 92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) && | | ~~~~~~~~~~~ | | | | | (10) dereference of NULL ‘conn’ |