<html>
<head>
<base href="http://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - core.NullDereference doesn't check assign of function output"
href="http://llvm.org/bugs/show_bug.cgi?id=21796">21796</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>core.NullDereference doesn't check assign of function output
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>3.5
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>kremenek@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>boloomka@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvmbugs@cs.uiuc.edu
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>core.NullDereference checker can check whether code is dereferencing pointer
that was previously initialized to NULL (or zero) by assignment, but for some
reason it doesn't warn about dereferencing when pointer was initialized to NULL
by calling a function (that returns NULL).
This is smallest testcase how to reproduce it:
int *init() {
return 0;
}
int main() {
int *p = init();
*p = 10;
}
Running static analysis on this code doesn't result in warning about
dereferencing NULL, but when you replace "init()" call with "0", it does show
warning.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>