[Bug analyzer/109266] New: Wanalyzer-null-dereference does not warn when struct is at null

[jg at jguk dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109266

            Bug ID: 109266
           Summary: Wanalyzer-null-dereference does not warn when struct
                    is at null
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: jg at jguk dot org
  Target Milestone: ---

Couldn't find an existing report for this.
Hope the very useful Analyzer can be enhanced to handle nullptr for structs.
Which means that when reading members of the struct they might be at 0x4 etc,
not directly 0x0

Analyzer does detect if the first 'int' in this struct at address nullptr is
read. If the code reads the bytes after in the struct, it doesn't identify that
0x4 address is also inaccessible.

Only way to ensure to get a warning is to copy the struct to a local variable
(before reading those bytes at offset 0x4 from the copy).

Try it live:
https://godbolt.org/z/9a611jvfM

-fanalyzer -Wall -O2

typedef struct a
{
    int b;
    char c[3];
} a_t;

void f(a_t * s)
{
    //s->b = 0;
    s->c[0] = 'b';
}

int main()
{
    a_t * s = nullptr;
    f(s);
}