llvm / llvm/llvm-project

[clang:static analyzer] CTU false positive: `core.NullDereference`

Open
#206,653 3 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

clang Static Analyzer reports a false positive `core.NullDereference` under CTU analysis for this test case (See attachment).

dep = bar(e);
if (dep != NULL && e->a > 0)

In this program, `bar()` returns non-null only when `e != NULL`, so the dereference of `e->a` is infeasible on the `dep != NULL` branch.

The same code does not warn when `bar()` and `foo()` are placed into a single translation unit and analyzed with `clang --analyze`.

This looks like a CTU precision issue where the analyzer loses the implication:
- dep = bar(e)
- dep != NULL
- therefore e != NULL

Observed diagnostic:
main.c:12:24: warning: Access to field 'a' results in a dereference of a null pointer (loaded from variable 'e') [core.NullDereference]
12 | if (dep != NULL && e->a > 0)
| ^~~~

The issue can be reproduced with clang version 23.0.0git
[testcase.rtf](https://github.com/user-attachments/files/29493156/testcase.rtf)

Contributor guide

Open the contributing guide

Research direction

Start with the attached testcase and reproduce the warning at main.c:12 using CTU analysis, then compare it with clang --analyze when bar() and foo() are in one translation unit. Trace how the analyzer handles dep = bar(e) and the dep != NULL branch; done means the reported core.NullDereference false positive no longer occurs for this case.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.