https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108251
--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Without optimization, trunk with just -Wno-address-of-packed-member (and
-fanalyzer), I get:
../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: In function
‘smp_fetch_ssl_fc_has_early’:
../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:92:27: warning:
dereference of NULL ‘conn’ [CWE-476] [-Wanalyzer-null-dereference]
92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
| ~~~~^~~~~~~
‘smp_fetch_ssl_fc_has_early’: events 1-2
|
| 78 | smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample
*smp, const char *kw, void *private)
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) entry to ‘smp_fetch_ssl_fc_has_early’
|......
| 83 | conn = objt_conn(smp->sess->origin);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (2) calling ‘objt_conn’ from ‘smp_fetch_ssl_fc_has_early’
|
+--> ‘objt_conn’: events 3-4
|
| 61 | static inline struct connection *objt_conn(enum obj_type
*t)
| | ^~~~~~~~~
| | |
| | (3) entry to ‘objt_conn’
|......
| 64 | return ((void *)0);
| | ~
| | |
| | (4) ‘0’ is NULL
|
<------+
|
‘smp_fetch_ssl_fc_has_early’: events 5-8
|
| 83 | conn = objt_conn(smp->sess->origin);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (5) return of NULL to ‘smp_fetch_ssl_fc_has_early’ from
‘objt_conn’
| 84 | ssl = ssl_sock_get_ssl_object(conn);
| 85 | if (!ssl)
| | ~
| | |
| | (6) following ‘false’ branch (when ‘ssl’ is non-NULL)...
|......
| 88 | smp->flags = 0;
| | ~~~~~~~~~~~~~~
| | |
| | (7) ...to here
|......
| 92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
| | ~~~~~~~~~~~
| | |
| | (8) dereference of NULL ‘conn’
|
