https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109060
Bug ID: 109060
Summary: -Wanalyzer-deref-before-check false positives seen in
haproxy's cfgparse.c: parse_process_number
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
Created attachment 54603
--> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54603&action=edit
Reproducer
https://godbolt.org/z/qnd1TrWsh
Trunk falsely emits this on the attached file:
$ ./xgcc -B. -S -fanalyzer -Wall ../../src/haproxy-cfgparse.c
../../src/haproxy-cfgparse.c: In function ‘parse_process_number’:
../../src/haproxy-cfgparse.c:58:21: warning: check of ‘dash’ for NULL after
already dereferencing it [-Wanalyzer-deref-before-check]
58 | if (*p == '-' && !dash)
| ~~~~~~~~~~^~~~~~~~
‘parse_process_number’: events 1-16
|
| 47 | if (strcmp(arg, "all") == 0)
| | ~^~~~~~~~~~~~~~~~~~
| | ||
| | |(1) pointer ‘dash’ is dereferenced here
| | (2) following ‘false’ branch (when the strings are
non-equal)...
| 48 | *proc |= ~0UL;
| 49 | else if (strcmp(arg, "odd") == 0)
| | ~~~~~~~~~~~~~~~~~~~
| | ||
| | |(3) ...to here
| | (4) following ‘false’ branch (when the strings are
non-equal)...
| 50 | *proc |= ~0UL / 3UL;
| 51 | else if (strcmp(arg, "even") == 0)
| | ~~~~~~~~~~~~~~~~~~~~
| | ||
| | |(5) ...to here
| | (6) following ‘false’ branch (when the strings are
non-equal)...
|......
| 54 | const char *p, *dash = ((void*)0);
| | ~~~~
| | |
| | (7) ...to here
|......
| 57 | for (p = arg; *p; p++) {
| | ~
| | |
| | (8) following ‘true’ branch...
| | (12) following ‘true’ branch...
| 58 | if (*p == '-' && !dash)
| | ~~~~~~~~~~~~~~~~~~~
| | || |
| | || (10) following ‘true’ branch (when ‘dash’ is
NULL)...
| | || (15) ...to here
| | || (16) pointer ‘dash’ is checked for NULL here
but it was already dereferenced at (1)
| | |(9) ...to here
| | |(13) ...to here
| | (14) following ‘true’ branch...
| 59 | dash = p;
| | ~~~~~~~~
| | |
| | (11) ...to here
|
../../src/haproxy-cfgparse.c:68:8: warning: check of ‘dash’ for NULL after
already dereferencing it [-Wanalyzer-deref-before-check]
68 | if (dash)
| ^
‘parse_process_number’: events 1-12
|
| 47 | if (strcmp(arg, "all") == 0)
| | ~^~~~~~~~~~~~~~~~~~
| | ||
| | |(1) pointer ‘dash’ is dereferenced here
| | (2) following ‘false’ branch (when the strings are
non-equal)...
| 48 | *proc |= ~0UL;
| 49 | else if (strcmp(arg, "odd") == 0)
| | ~~~~~~~~~~~~~~~~~~~
| | ||
| | |(3) ...to here
| | (4) following ‘false’ branch (when the strings are
non-equal)...
| 50 | *proc |= ~0UL / 3UL;
| 51 | else if (strcmp(arg, "even") == 0)
| | ~~~~~~~~~~~~~~~~~~~~
| | ||
| | |(5) ...to here
| | (6) following ‘false’ branch (when the strings are
non-equal)...
|......
| 54 | const char *p, *dash = ((void*)0);
| | ~~~~
| | |
| | (7) ...to here
|......
| 57 | for (p = arg; *p; p++) {
| | ~
| | |
| | (8) following ‘true’ branch...
| 58 | if (*p == '-' && !dash)
| | ~~~~~~~~~~~~~~~~~~
| | | |
| | | (10) following ‘true’ branch (when ‘dash’ is
NULL)...
| | (9) ...to here
| 59 | dash = p;
| | ~~~~~~~~
| | |
| | (11) ...to here
|......
| 68 | if (dash)
| | ~
| | |
| | (12) pointer ‘dash’ is checked for NULL here but it was
already dereferenced at (1)
|
