baloghadamsoftware added a comment.
Please consider the following test cases:
void test_NullCorrectCheck3() {
void *P = aligned_alloc(4, 8);
use(*P); // A developer inserted this line before the check by mistake.
This will be a null pointer dereference.
if (P == NULL) {
}
}
Or:
void test_NullCorrectCheck3() {
void *P = aligned_alloc(4, 8);
if (dice()) { // A deloper introduced a new branch, but by mistake, before
the check.
if (P == NULL) {
use(*P);
}
} else {
use(*P); // No check in this branch, thus a null pointer dereference.
}
}
False positive (or not?):
void g(void*); // Unknown function
void test_NullBadCheck1() {
void *P = aligned_alloc(4, 8);
g(P); // If g() checks its parameter for null, then false positive. If not,
then true positive.
}
Repository:
rG LLVM Github Monorepo
CHANGES SINCE LAST ACTION
https://reviews.llvm.org/D72705/new/
https://reviews.llvm.org/D72705
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
