Re: [PATCH GnuPG 4/7] common: check strchr for null

Sam James via Gnupg-devel <[email protected]> Wed, 28 Jan 2026 18:08:20 +0000

Newsgroups	gmane.comp.encryption.gpg.devel
Organization	Gentoo
Message-ID	<[email protected]>

Werner Koch <[email protected]> writes:

> Hi!

Hi!

>
> Here is an example on why manual introspection is required on all static
> analyzer output:
>
> On Wed, 28 Jan 2026 12:35, Sam James said:
>>            p = strchr (program, '|');
>> -          *p++ = 0;
>> +          if (p)
>> +              *p++ = 0;
>
> This is is something the analyzer did not got right.  This if-branch is
> only entered iff program_name already contains a '|'.  program is a copy
> of program_name.
>
> A log_assert could be used but the code is short enoigh to see that this
> will never be triggred.
>

Gah, yes, I'm sorry for the noise. I clearly got carried away with
that. I'll check more carefully and see if any are still worth it in
that case.

Thank you!

>
>
> Salam-Shalom,
>
>    Werner

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

signature.asc (application/pgp-signature, 418 B)