https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108251
--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
As per comment #4 (optimization disabled), but adding: -fanalyzer-verbosity=3
makes things clearer:
../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c: In function
‘smp_fetch_ssl_fc_has_early’:
../../src/null-deref-pr108251-smp_fetch_ssl_fc_has_early.c:92:27: warning:
dereference of NULL ‘conn’ [CWE-476] [-Wanalyzer-null-dereference]
92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
| ~~~~^~~~~~~
‘smp_fetch_ssl_fc_has_early’: events 1-2
|
| 78 | smp_fetch_ssl_fc_has_early(const struct arg *args, struct sample
*smp, const char *kw, void *private)
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) entry to ‘smp_fetch_ssl_fc_has_early’
|......
| 83 | conn = objt_conn(smp->sess->origin);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (2) calling ‘objt_conn’ from ‘smp_fetch_ssl_fc_has_early’
|
+--> ‘objt_conn’: events 3-6
|
| 61 | static inline struct connection *objt_conn(enum obj_type
*t)
| | ^~~~~~~~~
| | |
| | (3) entry to ‘objt_conn’
| 62 | {
| 63 | if (!t || *t != OBJ_TYPE_CONN)
| | ~
| | |
| | (4) following ‘true’ branch (when ‘t’ is NULL)...
| 64 | return ((void *)0);
| | ~
| | |
| | (5) ...to here
| | (6) ‘0’ is NULL
|
<------+
|
‘smp_fetch_ssl_fc_has_early’: events 7-10
|
| 83 | conn = objt_conn(smp->sess->origin);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (7) return of NULL to ‘smp_fetch_ssl_fc_has_early’ from
‘objt_conn’
| 84 | ssl = ssl_sock_get_ssl_object(conn);
| 85 | if (!ssl)
| | ~
| | |
| | (8) following ‘false’ branch (when ‘ssl’ is non-NULL)...
|......
| 88 | smp->flags = 0;
| | ~~~~~~~~~~~~~~
| | |
| | (9) ...to here
|......
| 92 | smp->data.u.sint = ((conn->flags & CO_FL_EARLY_DATA) &&
| | ~~~~~~~~~~~
| | |
| | (10) dereference of NULL ‘conn’
|
