https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99671
Bug ID: 99671
Summary: RFE: analyzer could complain about ptr derefs that
occur before the ptr is checked
Product: gcc
Version: 11.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: dmalcolm at gcc dot gnu.org
Target Milestone: ---
See e.g. bug 80049, where we have code of the form
expr = p->field;
[...]
if (p) ...
We could complain that 'p' has already been dereferenced before the check.
This might be implementable using sm-malloc: the "p->field" dereference
transitions "p" to non-null, and we could thus complain at the "if (p)" on
non-null if the transition was due to such a transition (rather than being
known to be non-null) - or perhaps a new state "assumed-non-null"?
PVS Studio complains about this:
https://www.viva64.com/en/w/v595/
https://www.viva64.com/en/examples/v595/
using CWE 476:
https://cwe.mitre.org/data/definitions/476.html
