[LLVMbugs] [Bug 16541] New: False positive in for-loop in C: Analyzer says that loop needn't be executed, assert() preceding the loop is ignored

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=16541

            Bug ID: 16541
           Summary: False positive in for-loop in C: Analyzer says that
                    loop needn't be executed, assert() preceding the loop
                    is ignored
           Product: clang
           Version: 3.3
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Static Analyzer
          Assignee: kremenek at apple.com
          Reporter: pspacek at redhat.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

Version:
clang 3.3rc3 (I used package clang-3.3-0.6.rc3.fc19.x86_64 in Fedora 19, i.e.
3.3rc3, source package is
http://kojipkgs.fedoraproject.org//packages/llvm/3.3/0.6.rc3.fc19/src/llvm-3.3-0.6.rc3.fc19.src.rpm)


Following function call generates false positive:

4290    CHECK(ldap_pool_getconnection(inst->pool, &conn));
←    Within the expansion of the macro 'CHECK':     
a    Calling 'ldap_pool_getconnection'
b    Returning from 'ldap_pool_getconnection'

4291    
4292    /* Try to connect. */
4293    while (conn->handle == NULL) {
←    Access to field 'handle' results in a dereference of a null pointer
(loaded from variable 'conn')



The called function contains for-loop and the assertion:

3504    #include <assert.h>
3505    
3506    static isc_result_t
3507    ldap_pool_getconnection(ldap_pool_t *pool, ldap_connection_t ** conn)
3508    {
3509        ldap_connection_t *ldap_conn = NULL;
3510        unsigned int i;
3511        isc_result_t result;
3512    
3513        REQUIRE(pool != NULL);
3514        REQUIRE(conn != NULL && *conn == NULL);
3515        assert(pool->connections > 0);    
←    Within the expansion of the macro 'assert':     
(seriously, there is nothing after the colon!)

3516    
3517        ldap_conn = *conn;
←    Null pointer value stored to 'ldap_conn'    

3518        CHECK(semaphore_wait_timed(&pool->conn_semaphore));
←    Within the expansion of the macro 'CHECK':     
Assuming 'result' is equal to 0

3519        for (i = 0; i < pool->connections; i++) {
←    Loop condition is false. Execution continues on line 3525    

3520            ldap_conn = pool->conns[i];
3521            if (isc_mutex_trylock(&ldap_conn->lock) == ISC_R_SUCCESS)
3522                break;
3523        }
3524    
3525    RUNTIME_CHECK(ldap_conn != NULL);
3526    
3527        *conn = ldap_conn;
←    Null pointer value stored to 'conn'    

3528    
3529    cleanup:
3530        if (result != ISC_R_SUCCESS) {
←    Taking false branch    

3531            log_error("timeout in ldap_pool_getconnection(): try to raise "
3532              "'connections' parameter; potential deadlock?");
3533        }
3534        return result;
3535    }

You can compile
https://fedorahosted.org/released/bind-dyndb-ldap/bind-dyndb-ldap-3.4.tar.bz2
yourself and see the bug in natura.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20130704/b2b391ac/attachment.html>