Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix #11311 Do not search for null pointer in dead code #6442

Merged
merged 5 commits into from
Jun 25, 2024
Merged

Fix #11311 Do not search for null pointer in dead code #6442

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d2f546c
Fix #11311 Do not search for null pointer in dead code
francois-berder May 25, 2024
9e7c76d
fixup! Fix #11311 Do not search for null pointer in dead code
francois-berder Jun 3, 2024
d56945f
fixup! fixup! Fix #11311 Do not search for null pointer in dead code
francois-berder Jun 11, 2024
1b5cbc7
fixup! fixup! fixup! Fix #11311 Do not search for null pointer in dea…
francois-berder Jun 13, 2024
f0eb67b
fixup! fixup! fixup! fixup! Fix #11311 Do not search for null pointer…
francois-berder Jun 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -533,7 +533,7 @@ $(libcppdir)/checkleakautovar.o: lib/checkleakautovar.cpp lib/addoninfo.h lib/as
$(libcppdir)/checkmemoryleak.o: lib/checkmemoryleak.cpp lib/addoninfo.h lib/astutils.h lib/check.h lib/checkmemoryleak.h lib/color.h lib/config.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/suppressions.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/vfvalue.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/checkmemoryleak.cpp

$(libcppdir)/checknullpointer.o: lib/checknullpointer.cpp lib/addoninfo.h lib/astutils.h lib/check.h lib/checknullpointer.h lib/color.h lib/config.h lib/ctu.h lib/errorlogger.h lib/errortypes.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/suppressions.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/valueflow.h lib/vfvalue.h
$(libcppdir)/checknullpointer.o: lib/checknullpointer.cpp lib/addoninfo.h lib/astutils.h lib/check.h lib/checknullpointer.h lib/color.h lib/config.h lib/ctu.h lib/errorlogger.h lib/errortypes.h lib/findtoken.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/suppressions.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/valueflow.h lib/vfvalue.h
$(CXX) ${INCLUDE_FOR_LIB} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/checknullpointer.cpp

$(libcppdir)/checkother.o: lib/checkother.cpp lib/addoninfo.h lib/astutils.h lib/check.h lib/checkother.h lib/config.h lib/errortypes.h lib/fwdanalysis.h lib/library.h lib/mathlib.h lib/platform.h lib/settings.h lib/smallvector.h lib/sourcelocation.h lib/standards.h lib/suppressions.h lib/symboldatabase.h lib/templatesimplifier.h lib/token.h lib/tokenize.h lib/tokenlist.h lib/utils.h lib/valueflow.h lib/vfvalue.h
Expand Down
78 changes: 52 additions & 26 deletions lib/checknullpointer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
#include "ctu.h"
#include "errorlogger.h"
#include "errortypes.h"
#include "findtoken.h"
#include "library.h"
#include "mathlib.h"
#include "settings.h"
Expand Down Expand Up @@ -279,47 +280,72 @@ static bool isNullablePointer(const Token* tok)
return false;
}

void CheckNullPointer::nullPointerByDeRefAndChec()
static bool isPointerUnevaluated(const Token *tok)
{
if (isUnevaluated(tok))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be checked in findTokensSkipDeadCodeImpl function.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@danmar @pfultz2 I updated my PR to move this in findTokensSkipDeadAndUnevaluatedCode function because I was not very happy with the way I detected unevaluated pointers.

return true;

while (tok) {
if (isUnevaluated(tok->previous()))
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you clarify what will tok->previous() be. if there is parenthesis like ...)tok.. or something then you want to return true?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to make sure that the following code does not trigger a warning.

void f(type* p) {
   x(sizeof ( (p[0])));
    if (!p)
        ;
}

I need to check whether the variable p is unevaluated so I used a similar method found in checkuninitvar.cpp (see method CheckUninitVar::checkExpr).

return true;

tok = tok->astParent();
}
return false;
}


void CheckNullPointer::nullPointerByDeRefAndCheck()
{
const bool printInconclusive = (mSettings->certainty.isEnabled(Certainty::inconclusive));

for (const Token *tok = mTokenizer->tokens(); tok; tok = tok->next()) {
if (isUnevaluated(tok)) {
tok = tok->linkAt(1);
continue;
}
const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();
for (const Scope * scope : symbolDatabase->functionScopes) {
auto pred = [printInconclusive](const Token* tok) -> bool {
if (!tok)
return false;

if (Token::Match(tok, "%num%|%char%|%str%"))
continue;
if (Token::Match(tok, "%num%|%char%|%str%"))
return false;

if (!isNullablePointer(tok) ||
(tok->str() == "." && isNullablePointer(tok->astOperand2()) && tok->astOperand2()->getValue(0))) // avoid duplicate warning
continue;
if (!isNullablePointer(tok) ||
(tok->str() == "." && isNullablePointer(tok->astOperand2()) && tok->astOperand2()->getValue(0))) // avoid duplicate warning
return false;

// Can pointer be NULL?
const ValueFlow::Value *value = tok->getValue(0);
if (!value)
continue;
// Can pointer be NULL?
const ValueFlow::Value *value = tok->getValue(0);
if (!value)
return false;

if (!printInconclusive && value->isInconclusive())
continue;
if (!printInconclusive && value->isInconclusive())
return false;

// Pointer dereference.
bool unknown = false;
if (!isPointerDeRef(tok,unknown)) {
if (unknown)
nullPointerError(tok, tok->expressionString(), value, true);
continue;
}
return true;
};
std::vector<const Token *> tokens = findTokensSkipDeadCode(mSettings->library, scope->bodyStart, scope->bodyEnd, pred);
for (const Token *tok : tokens) {
if (isPointerUnevaluated(tok))
continue;

nullPointerError(tok, tok->expressionString(), value, value->isInconclusive());
const ValueFlow::Value *value = tok->getValue(0);

// Pointer dereference.
bool unknown = false;
if (!isPointerDeRef(tok, unknown)) {
if (unknown)
nullPointerError(tok, tok->expressionString(), value, true);
continue;
}

nullPointerError(tok, tok->expressionString(), value, value->isInconclusive());
}
}
}

void CheckNullPointer::nullPointer()
{
logChecker("CheckNullPointer::nullPointer");
nullPointerByDeRefAndChec();
nullPointerByDeRefAndCheck();
}

namespace {
Expand Down
2 changes: 1 addition & 1 deletion lib/checknullpointer.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@ class CPPCHECKLIB CheckNullPointer : public Check {
* @brief Does one part of the check for nullPointer().
* Dereferencing a pointer and then checking if it's NULL..
*/
void nullPointerByDeRefAndChec();
void nullPointerByDeRefAndCheck();

/** undefined null pointer arithmetic */
void arithmetic();
Expand Down
2 changes: 1 addition & 1 deletion oss-fuzz/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,7 +212,7 @@ $(libcppdir)/checkleakautovar.o: ../lib/checkleakautovar.cpp ../lib/addoninfo.h
$(libcppdir)/checkmemoryleak.o: ../lib/checkmemoryleak.cpp ../lib/addoninfo.h ../lib/astutils.h ../lib/check.h ../lib/checkmemoryleak.h ../lib/color.h ../lib/config.h ../lib/errorlogger.h ../lib/errortypes.h ../lib/library.h ../lib/mathlib.h ../lib/platform.h ../lib/settings.h ../lib/smallvector.h ../lib/sourcelocation.h ../lib/standards.h ../lib/suppressions.h ../lib/symboldatabase.h ../lib/templatesimplifier.h ../lib/token.h ../lib/tokenize.h ../lib/tokenlist.h ../lib/utils.h ../lib/vfvalue.h
$(CXX) ${LIB_FUZZING_ENGINE} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/checkmemoryleak.cpp

$(libcppdir)/checknullpointer.o: ../lib/checknullpointer.cpp ../lib/addoninfo.h ../lib/astutils.h ../lib/check.h ../lib/checknullpointer.h ../lib/color.h ../lib/config.h ../lib/ctu.h ../lib/errorlogger.h ../lib/errortypes.h ../lib/library.h ../lib/mathlib.h ../lib/platform.h ../lib/settings.h ../lib/smallvector.h ../lib/sourcelocation.h ../lib/standards.h ../lib/suppressions.h ../lib/symboldatabase.h ../lib/templatesimplifier.h ../lib/token.h ../lib/tokenize.h ../lib/tokenlist.h ../lib/utils.h ../lib/valueflow.h ../lib/vfvalue.h
$(libcppdir)/checknullpointer.o: ../lib/checknullpointer.cpp ../lib/addoninfo.h ../lib/astutils.h ../lib/check.h ../lib/checknullpointer.h ../lib/color.h ../lib/config.h ../lib/ctu.h ../lib/errorlogger.h ../lib/errortypes.h ../lib/findtoken.h ../lib/library.h ../lib/mathlib.h ../lib/platform.h ../lib/settings.h ../lib/smallvector.h ../lib/sourcelocation.h ../lib/standards.h ../lib/suppressions.h ../lib/symboldatabase.h ../lib/templatesimplifier.h ../lib/token.h ../lib/tokenize.h ../lib/tokenlist.h ../lib/utils.h ../lib/valueflow.h ../lib/vfvalue.h
$(CXX) ${LIB_FUZZING_ENGINE} $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $(libcppdir)/checknullpointer.cpp

$(libcppdir)/checkother.o: ../lib/checkother.cpp ../lib/addoninfo.h ../lib/astutils.h ../lib/check.h ../lib/checkother.h ../lib/config.h ../lib/errortypes.h ../lib/fwdanalysis.h ../lib/library.h ../lib/mathlib.h ../lib/platform.h ../lib/settings.h ../lib/smallvector.h ../lib/sourcelocation.h ../lib/standards.h ../lib/suppressions.h ../lib/symboldatabase.h ../lib/templatesimplifier.h ../lib/token.h ../lib/tokenize.h ../lib/tokenlist.h ../lib/utils.h ../lib/valueflow.h ../lib/vfvalue.h
Expand Down
42 changes: 42 additions & 0 deletions test/testnullpointer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ class TestNullPointer : public TestFixture {
TEST_CASE(nullpointer_in_typeid);
TEST_CASE(nullpointer_in_alignof); // #11401
TEST_CASE(nullpointer_in_for_loop);
TEST_CASE(nullpointerDeadCode); // #11311
TEST_CASE(nullpointerDelete);
TEST_CASE(nullpointerSubFunction);
TEST_CASE(nullpointerExit);
Expand Down Expand Up @@ -3657,6 +3658,47 @@ class TestNullPointer : public TestFixture {
ASSERT_EQUALS("", errout_str());
}

void nullpointerDeadCode() {
// Ticket #11311
check ("void f() {\n"
" if (0)\n"
" *(int *)0 = 1;\n"
" else\n"
" ;\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check ("void f() {\n"
" if (0)\n"
" *(int *)0 = 1;\n"
" else {\n"
" if (0)\n"
" *(int *)0 = 2;\n"
" else\n"
" ;\n"
" }\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check ("void f() {\n"
" while(0)\n"
" *(int*)0 = 1;\n"
" do {\n"
" } while(0);\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check ("int f() {\n"
" return 0 ? *(int*)0 = 1 : 1;\n"
"}\n");
ASSERT_EQUALS("", errout_str());

check ("int f() {\n"
" return 1 ? 1 : *(int*)0 = 1;\n"
"}\n");
ASSERT_EQUALS("", errout_str());
}

void nullpointerDelete() {
check("void f() {\n"
" K *k = getK();\n"
Expand Down
Loading