Synopsis

A pointer is dereferenced after being determined not to be NULL on some paths, but not checked on others.

Enabled by default

Yes

Severity/Certainty

Medium/Medium

Full description

On some execution paths a pointer is determined not to be NULL before being dereferenced, but is dereferenced on other paths without checking. Checking a pointer value indicates that its value might be NULL. It should thus be checked on all possible execution paths that result in a dereference.

Coding standards

Code examples

The following code example fails the check and will give a warning:

int deref(int *p,int q)
{
  if(q)
    *p=q;
  else{
    if(p == 0)
      return 0;
    else{
      *p=1;
      return 1;
    }
  }
}

The following code example passes the check and will not give a warning about this issue:

#define NULL 0

int safe_deref(int *p)
{
  if (p == NULL) {
    return 0;
  } else {
    return *p;
  }
}