False alarm with dynamic_cast and reference type
- Langage dominant
- OCaml
- Étoiles
- 15.7k
- Forks
- 2.1k
- Merge moyen
- 19 h 36 min
- PR mergées (30 j)
- 13
Description
I got the following null pointer dereference issue:
```
/Users/joshua/Documents/Infer/solidity/libsolidity/analysis/TypeChecker.cpp:372: error: NULL_DEREFERENCE
pointer `lhs` last assigned on line 369 could be null and is dereferenced at line 372, column 20
370. TupleType const& rhs = dynamic_cast(*type(_assignment.rightHandSide()));
371.
372. > bool fillRight = !lhs.components().empty() && (!lhs.components().back() || lhs.components().front());
373. size_t storageToStorageCopies = 0;
374. size_t toStorageCopies = 0;
```
And I believe this is a false alarm. What happens here is that a `dynamic_cast` is used with a reference type. This means that if the cast fails, an exception will be raised and so no null dereference actually happens. (Also it's a bit confusing `lhs` is consider as a pointer in the error message.)
I tried making a smaller test case, but did not succeed... So it seems that infer deals with `dynamic_cast` correctly, except in the above code. If there is anything I should try, just let me know.
[](url)
The relevant code can be found here: [Solidity TypeChecker.cpp:372](https://github.com/ethereum/solidity/blob/develop/libsolidity/analysis/TypeChecker.cpp#L372) . Here is a copy (`TypePointer` is a `shared_ptr`):
```
TypePointer const& TypeChecker::type(Expression const& _expression) const
{
solAssert(!!_expression.annotation().type, "Type requested but not present.");
return _expression.annotation().type;
}
[...]
void TypeChecker::checkDoubleStorageAssignment(Assignment const& _assignment)
{
TupleType const& lhs = dynamic_cast(*type(_assignment.leftHandSide()));
TupleType const& rhs = dynamic_cast(*type(_assignment.rightHandSide()));
bool fillRight = !lhs.components().empty() && (!lhs.components().back() || lhs.components().front());
```
infer version 0.12.0
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.