facebook / facebook/infer

False alarm with dynamic_cast and reference type

Open
#698 2 comments 0 reactions 0 assignees View on GitHub
c++ false-positive
Dominant language
OCaml
Stars
15.7k
Forks
2.1k
Avg merge
19h 36m
Merged PRs (30d)
13

Description

I got the following null pointer dereference issue:
```
/Users/joshua/Documents/Infer/solidity/libsolidity/analysis/TypeChecker.cpp:372: error: NULL_DEREFERENCE
pointer `lhs` last assigned on line 369 could be null and is dereferenced at line 372, column 20
370. TupleType const& rhs = dynamic_cast(*type(_assignment.rightHandSide()));
371.
372. > bool fillRight = !lhs.components().empty() && (!lhs.components().back() || lhs.components().front());
373. size_t storageToStorageCopies = 0;
374. size_t toStorageCopies = 0;
```

And I believe this is a false alarm. What happens here is that a `dynamic_cast` is used with a reference type. This means that if the cast fails, an exception will be raised and so no null dereference actually happens. (Also it's a bit confusing `lhs` is consider as a pointer in the error message.)

I tried making a smaller test case, but did not succeed... So it seems that infer deals with `dynamic_cast` correctly, except in the above code. If there is anything I should try, just let me know.

[](url)

The relevant code can be found here: [Solidity TypeChecker.cpp:372](https://github.com/ethereum/solidity/blob/develop/libsolidity/analysis/TypeChecker.cpp#L372) . Here is a copy (`TypePointer` is a `shared_ptr`):

```
TypePointer const& TypeChecker::type(Expression const& _expression) const
{
solAssert(!!_expression.annotation().type, "Type requested but not present.");
return _expression.annotation().type;
}
[...]
void TypeChecker::checkDoubleStorageAssignment(Assignment const& _assignment)
{
TupleType const& lhs = dynamic_cast(*type(_assignment.leftHandSide()));
TupleType const& rhs = dynamic_cast(*type(_assignment.rightHandSide()));

bool fillRight = !lhs.components().empty() && (!lhs.components().back() || lhs.components().front());
```

infer version 0.12.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.