[PATCH] getugroups: Add _GL_ATTRIBUTE_NONNULL_IF_NONZERO for grouplist

getugroups has no explicit contract for the case where the caller
passes NULL as grouplist. However, all callers inside gnulib follow
the same convention: if maxcount is nonzero, grouplist is assumed to
be non-NULL.

Under this convention, whether grouplist may be dereferenced is
determined by maxcount alone, and maxcount is already used throughout
the function. So usage of explicit NULL check for grouplist creates
inconsistency which is detected by static analyzers resulting in a
False Positive report.

This patch adds the _GL_ATTRIBUTE_NONNULL_IF_NONZERO attribute to
getugroups, making it explicit that grouplist must not be NULL when
maxcount is nonzero. The NULL check of grouplist is replaced with a
maxcount check, so relation between maxcount and grouplist is
consistent enough to not create questions about difference between
grouplist and maxcount being zero.

Signed-off-by: Sergey Zhidkih <[email protected]>
---
 lib/getugroups.h | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/getugroups.h b/lib/getugroups.h
index bb6210e832..08c08a83e7 100644
--- a/lib/getugroups.h
+++ b/lib/getugroups.h
@@ -14,6 +14,11 @@
    You should have received a copy of the GNU Lesser General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
 
+/* This file uses _GL_ATTRIBUTE_NONNULL_IF_NONZERO. */
+#if !_GL_CONFIG_H_INCLUDED
+ #error "Please include config.h first."
+#endif
+
 #include <sys/types.h>
 
 #ifdef __cplusplus
@@ -22,7 +27,8 @@ extern "C" {
 
 
 int getugroups (int maxcount, gid_t *grouplist, char const *username,
-                gid_t gid);
+                gid_t gid)
+                _GL_ATTRIBUTE_NONNULL_IF_NONZERO (2, 1);
 
 
 #ifdef __cplusplus
-- 
2.50.1