<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - False positive: null pointer dereference with varargs"
href="https://llvm.org/bugs/show_bug.cgi?id=25826">25826</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>False positive: null pointer dereference with varargs
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>kremenek@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>warren@icouldbedeadwrong.net
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=15447" name="attach_15447" title="Test case">attachment 15447</a> <a href="attachment.cgi?id=15447&action=edit" title="Test case">[details]</a></span>
Test case
Platform: Ubuntu 14.04.2 LTS
Tool version (svn info):
URL: <a href="http://llvm.org/svn/llvm-project/cfe/trunk/tools/scan-build">http://llvm.org/svn/llvm-project/cfe/trunk/tools/scan-build</a>
Relative URL: ^/cfe/trunk/tools/scan-build
Repository Root: <a href="http://llvm.org/svn/llvm-project">http://llvm.org/svn/llvm-project</a>
Repository UUID: 91177308-0d34-0410-b5e6-96231b3b80d8
Revision: 254388
The attached test case triggers erroneous behaviour from scan-build - it
reports a NULL pointer dereference when none is possible. Note that the
reported reference goes away if either:
a) The calls to va_start and va_end are commented out
b) The assertion is uncommented
The report from scan-build is:
/opt/llvm/libexec/ccc-analyzer -g -Wall -Wextra -o output input.c
input.c:26:16: warning: Array access (from variable 'ret') results in a null
pointer dereference
ret[i] = NULL;;
~~~ ^
1 warning generated.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>