Re: FYI: clang static analyzer page has moved to http://scan.freebsd.your.org/freebsd-head/

On Wednesday 05 January 2011 14:14:39 Ulrich Spörlein wrote:
> Now that I'm fairly confident that the stability issues with your.org's
> VMs have been resolved, I'd like to point you to the new and improved,
> semi-weekly analyzer runs at
> 
>         http://scan.freebsd.your.org/freebsd-head/

I came across an interesting false positive here:
http://scan.freebsd.your.org/freebsd-head/sbin.geom.class/2011-01-15-amd64/report-1aAmgE.html#EndPath

| assert((strcmp(type, "keyfile") == 0 && ctxp != NULL &&
|     passbuf == NULL && passbufsize == 0) ||
|     (strcmp(type, "passfile") == 0 && ctxp == NULL &&
|     passbuf != NULL && passbufsize > 0));
| assert(strcmp(type, "keyfile") == 0 || passbuf[0] == '\0');
| 
|   Within the expansion of the macro 'assert':
|   Array access (from variable 'passbuf') results in a null pointer
|   dereference.

I think the problem here is that the analyser allows strcmp(type,
"keyfile") to return zero in the first assertion and nonzero in the
second. This cannot happen of course and the analyser should know that
because strcmp has been declared __pure__ in string.h.

A workaround in this case would be to merge the two assertions.