https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107526
Bug ID: 107526
Summary: - -Wanayzer-null-dereference false positive with
different behaviors when delete unrelated statement
“int *e = 0;”
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: analyzer
Assignee: dmalcolm at gcc dot gnu.org
Reporter: geoffreydgr at icloud dot com
Target Milestone: ---
I encountered a false positive when compiling the following MCVE program with
gcc (trunk) with -fanalyzer -O0 in https://godbolt.org/z/ojqa7PjPf
```
#include <stdio.h>
void f(short *g) {
int a =0;
int b = (0 != g);
am:
if (b) {
int *c = &b;
*c = printf("NPD_FLAG\n");
}
int *e = 0; // (3) 'g' is NULL
(*g)++;
if (a)
goto am;
}
int main() {
short d=0;
f(&d);
return 0;
}
```
Gcc static analyzer reports dereference of NULL 'g' at line 4, which is a
false positive. while it gives wrong path note (3) 'g' is NULL at line 12.
If I delete line 12 as the following code, gcc analyzer does not report NPD
warning anymore.The statement `int *e = 0; ` is unrelated to `g` , but gcc
analyzer has different behaviors before and after deleting the statement.
```
#include <stdio.h>
void f(short *g) {
int a =0;
int b = (0 != g);
am:
if (b) {
int *c = &b;
*c = printf("NPD_FLAG\n");
}
int *e = 0; // (3) 'g' is NULL
(*g)++;
if (a)
goto am;
}
int main() {
short d=0;
f(&d);
return 0;
}
```
Do you have any thoughts about this false positive?
