[llvm-bugs] [Bug 39239] New: False positive division by zero

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=39239

            Bug ID: 39239
           Summary: False positive division by zero
           Product: clang
           Version: 6.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Static Analyzer
          Assignee: dcoughlin at apple.com
          Reporter: benbuck at gmail.com
                CC: llvm-bugs at lists.llvm.org

To reproduce:

$ cat false_div_zero.c
int false_div_zero(int size, int nitems) {
    int len = nitems * size;
    if (size && ((len / size) != nitems))
        return 0;
    return len ? (len / size) : 0;
}

$ clang --analyze false_div_zero.c
false_div_zero.c:5:23: warning: Division by zero
    return len ? (len / size) : 0;
                  ~~~~^~~~~~
1 warning generated.


The analyzer seems to assume on line 3 that size is zero, and on line 5 that
len is not zero. However, if size is zero on line 2, then len should also be
zero.

Please note that this reproduction case is a very simplified version of the
relevant part of the gzfwrite() implementation in gzwrite.c from zlib.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20181010/545bb1cc/attachment.html>