llvm / llvm/llvm-project

[clang][analyzer] core.NonNullParamChecker false positive after repeated array-element loads

Open
#223,400 7 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-positive
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

**Description:**
Analyzer reports that the second argument of `memcmp()` may be null, even though the immediately enclosing condition establishes that both arguments have the same nullness and that the first argument is non-null.

**Reproducer:**
```c
#include

void compare(unsigned left_index, unsigned right_index)
{
const char *left[2] = { 0 }, *right[2] = { 0 };

if (left_index < 2)
left[left_index] = "a";
if (right_index < 2)
right[right_index] = "b";

for (unsigned i = 0; i < 2; ++i) {
if ((!left[i] == !right[i]) && left[i]) {

clang_analyzer_eval(!left[i] == !right[i]); // UNKNOWN
clang_analyzer_eval(left[i] != NULL); // UNKNOWN
clang_analyzer_eval(right[i] != NULL); // FALSE and UNKNOWN

(void)memcmp(left[i], right[i], 1);
}
}
}
```
The condition
```c
(!left[i] == !right[i]) && left[i]
```
establishes:
1. `left[i]` and `right[i]` have the same nullness.
2. `left[i]` is non-null.
Therefore, `right[i]` must also be non-null.

**Workaround:**
Loading the elements into local variables before testing them prevents the warning:

```c
for (unsigned i = 0; i < 2; ++i) {
const char *l = left[i];
const char *r = right[i];

if ((!l == !r) && l)
(void)memcmp(l, r, 1);
}
```

Compiler explorer link can be found [here.](https://compiler-explorer.com/z/zra5qMn8r)

Contributor guide

Open the contributing guide

Research direction

Start with the C reproducer and the clang static analyzer's core.NonNullParamChecker, then compare repeated array-element loads with the provided local-variable workaround. Confirm the current false positive and add a regression test showing that the enclosing condition establishes both arguments as non-null, with no warning for memcmp(left[i], right[i], 1).

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.