Avoiding selected variables assignments before null pointer checks

Avoiding selected variables assignments before null pointer checks


Hello,

Another source code search approach can occasionally be helpful also by the means
of the semantic patch language (Coccinelle software).


Example:
@display@
expression action, input, target;
identifier member1, member2, var;
type t;
@@
(
*t var = \( & \( input->member1 \| input->member1.member2 \) \| action(..., & \( input->member1 \| input->member1.member2 \), ...) \);
 ... when != input
     when any
|
*target = \( & \( input->member1 \| input->member1.member2 \) \| action(..., & \( input->member1 \| input->member1.member2 \), ...) \);
 ... when != input
     when any
)
*if (input == NULL || ...)
(   return ...;
|{
    ...
    return ...;
 }
)


Test result:
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> time /usr/bin/spatch --timeout 23 -j4 --chunksize 1 --no-loops -dir . …/Projekte/Coccinelle/janitor/show_pointer_dereferences_before_check10.cocci > …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-20260701.diff 2> …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-errors-20260701.txt

real    32m26,907s
user    105m10,515s
sys     0m45,265s
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> lsdiff …/Projekte/Bau/Linux/scripts/Coccinelle/show_pointer_dereferences_before_check10-20260701.diff | wc -l
44



How will chances evolve to adjust more places according to remaining update candidates?

See also once more:
EXP34-C: Do not dereference null pointers
https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/rules/expressions-exp/exp34-c/

Regards,
Markus