Possible null pointer dereference - otherwise it is redundant to check it against null

问题

I have the following code, which is working properly:

int result = ERRORCODE_OK;
if (dataObj == NULL || dataObj->inputSignal == NULL)
{
   result = ERRORCODE_MISSING_DATAOBJ;
}
if (result == ERRORCODE_OK && dataObj->spectrum == NULL) // CPP-Check error
{
   result = Calculate(dataObj->inputSignal, .. );
} 
return result;

But CppCheck gives me the following error:

Possible null pointer dereference: dataObj - otherwise it is redundant to check it against null.

I don't understand why. If the dataobj is NULL, then the result will be something else then ERRORCODE_OK.

回答1:

CppCheck doesn't inspect deep enough to see that your second condition won't be fully evaluated if the first one succeeds:

int result = ERRORCODE_OK;
if (dataObj == NULL || dataObj->inputSignal == NULL)
    result = ERRORCODE_MISSING_DATAOBJ;

// Here, you can see that either dataObj!=NULL or result!=ERRORCODE_OK.
// But CppCheck can't!

if (result == ERRORCODE_OK && dataObj->spectrum == NULL)
    result = Calculate(dataObj->inputSignal, .. );
return result;

Three alternative ways of pacifying the checker present themselves. Firstly, just repeat the check that dataObj is non-null in the second if. Secondly, change the second if to else if:

int result = ERRORCODE_OK;
if (dataObj == NULL || dataObj->inputSignal == NULL)
{
    result = ERRORCODE_MISSING_DATAOBJ;
}
else if (result == ERRORCODE_OK && dataObj->spectrum == NULL)
{
    result = Calculate(dataObj->inputSignal, .. );
} 
return result;

Thirdly, return as soon as you find one of the error cases:

if (!dataObj || !dataObj->inputSignal)
    return ERRORCODE_MISSING_DATAOBJ;
if (dataObj->spectrum)
    return ERRORCODE_OK;
return Calculate(dataObj->inputSignal, .. );

回答2:

It happens because you check that variable for NULL here:

if (dataObj == NULL || dataObj->inputSignal == NULL)

This makes the analyzer think that dataObj can, in some circumstances, be NULL.

Now, Cppcheck can't know the logic behind your code, there is no way for it to know that result == ERRORCODE_OK ensures that dataObj != NULL, so it gives you the warning about your second if. Basically it assumes that if you check a variable for NULL in the first condition, then it makes sence to check it for NULL in the second condition too.

Note that it says "Possible null pointer dereference", so in your case it's just a false-positive.

回答3:

My theory - You are checking against null in the first if so the checked assumes that dataObj can be null, and then in the second if you use dataObj without checking if it can be null so the checked is flagging a possible real problem.

Your code sets result result though so it will never actually happend.... Perhaps the checker isn't clever enough to notice that the problem can't actually happen.

回答4:

In general these tool check for NULL check statement which hints them that this object can be null so after null check if you are trying to refer that it will show error. It is good practice to return if anything wrong happens if possible or keep the referring code out of reach. You can rearrange your if statements to achieve that or add return in your first if .

来源：https://stackoverflow.com/questions/32839786/possible-null-pointer-dereference-otherwise-it-is-redundant-to-check-it-agains

标签

c++

cppcheck