Avoiding selected variables assignments before null pointer checks

[Markus Elfring <Markus.Elfring@web.de>]

Avoiding selected variables assignments before null pointer checks


Hello,

Another source code search approach can occasionally be helpful also by the means
of the semantic patch language (Coccinelle software).


Example:
@display@
expression action, input, target;
identifier member1, member2, var;
type t;
@@
(
*t var = \( & \( input->member1 \| input->member1.member2 \) \| action(..., & \( input->member1 \| input->member1.member2 \), ...) \);
 ... when != input
     when any
|
*target = \( & \( input->member1 \| input->member1.member2 \) \| action(..., & \( input->member1 \| input->member1.member2 \), ...) \);
 ... when != input
     when any
)
*if (input == NULL || ...)
(   return ...;
|{
    ...
    return ...;
 }
)


Test result:
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> time /usr/bin/spatch --timeout 23 -j4 --chunksize 1 --no-loops -dir . …/Projekte/Coccinelle/janitor/show_pointer_dereferences_before_check10.cocci > …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-20260701.diff 2> …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-errors-20260701.txt

real    32m26,907s
user    105m10,515s
sys     0m45,265s
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> lsdiff …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-20260701.diff | wc -l
44



How will chances evolve to adjust more places according to remaining update candidates?

See also once more:
EXP34-C: Do not dereference null pointers
https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/rules/expressions-exp/exp34-c/

Regards,
Markus