https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107345
Bug ID: 107345
Summary: - -Wanayzer-null-dereference false positive with
giving weird path infomation
Product: gcc
Version: 12.1.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: geoffreydgr at icloud dot com
Target Milestone: ---
I got a weird false positive error when compiling the following "minimal,
complete and verifiable example (MCVE)" program.
```
#include <stdio.h>
int main() {
int e = 10086;
int *f = &e;
int g = 0;
int *h[2][1];
h[1][0] = f;
if (g == (h[1][0])) {
// printf("if true\n");
unsigned int *i = 0;
}
printf("NPD_FLAG: %d\n ", *f);
return 0;
}
```
Compiling the above code with gcc 12.1 with `-O0 -fanalyzer` in
https://godbolt.org/z/av4beszh7 results in :
```
<source>: In function 'main':
<source>:8:9: warning: comparison between pointer and integer
8 | if (g == (h[1][0])) {
| ^~
<source>:12:3: warning: dereference of NULL 'f' [CWE-476]
[-Wanalyzer-null-dereference]
12 | printf("NPD_FLAG: %d\n ", *f);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'main': events 1-4
|
| 8 | if (g == (h[1][0])) {
| | ^
| | |
| | (1) following 'true' branch...
| 9 | // printf("if true\n");
| 10 | unsigned int *i = 0;
| | ~
| | |
| | (2) ...to here
| | (3) '&e' is NULL
| 11 | }
| 12 | printf("NPD_FLAG: %d\n ", *f);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) dereference of NULL 'f'
|
```
It is obvious that dereference of 'f' at line 12 cannot result in NPD. It is
weird that the tool reports "(3) '&e' is NULL" at line 10. There is even no
'&e' there.
But if i change the original program to the following one, the NPD false
positive goes away.
```
#include <stdio.h>
int main() {
int e = 10086;
int *f = &e;
int g = 0;
int *h[2][1];
h[1][0] = f;
if (g == (f)) {
// printf("if true\n");
unsigned int *i = 0;
}
printf("NPD_FLAG: %d\n ", *f);
return 0;
}
```
