rust-lang / rust-lang/rust-clippy

Detect dereference of null pointer

Open
#12,598 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-lint T-MIR
Dominant language
Rust
Stars
13.5k
Forks
2.2k
Avg merge
2d 10h
Merged PRs (30d)
32

Description

What it does

Tracks the creation of null pointers with std::ptr::{null, null_mut}, and any binding that holds them that are never touched until they are dereferenced. When such a case is encountered, a deny-by-default lint is triggered.

Advantage
  • compile time detection of assured UB
  • slightly lowered need for miri
Drawbacks
  • detection logic to avoid false positives might be tricky
  • miri already catches this, this could be considered redundant
Example
fn foo(x: *mut i32) -> i32 {
    unsafe {
        if x.is_null() {
            *x
        } else {
            0
        }
    }
}
fn main() {
    foo(std::ptr::null_mut());
}

Should complain about the access to a null pointer at compile time on *x.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by reviewing Clippy's lint infrastructure and the relationship to Miri, then define how null-pointer tracking should handle the example and avoid false positives. Done means the requested compile-time lint behavior is specified and covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.