[cfe-dev] [Static Analyzer Query] Why is suppress-null-return-paths enabled by default?

[Karthik Bhat]

Hi,
I was running the following code through clang SA -

#include <stdlib.h>
int* myAlloca(int i,int maxCount) {
  if (i >= maxCount)
    return 0;
  int* k = (int*) malloc(sizeof(int));
  return k;
}

int main() {
  int max = 1;
  for(int i =0;i< 2;i++) {
    int* k = myAlloca(i,max);
    *k = 1;
  }
  return 0;
}

This code will result in Null Deference in the second iteration of for
loop.
When i debugged i found that the reason for it is by default null return
paths are suppressed by clang SA.

Running the above code with suppress-null-return-paths=false gives the
desired result.

Any particular reason why this flag is enabled by default in clang SA?

Isn't it common in code to return null from a function in case we have a
failure and hence can result in deref if used further?

Shouldn't we be disabling this by default? or am i missing something?

Thanks
Karthik Bhat
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20130822/00ff2420/attachment.html>