3 typedef /*@null@*/ int *nip;
9 /*@truenull@*/ bool ptrpred (nip x)
14 void f3 (/*@only@*/ nip x)
16 *gnip = 3; /* 1. Possible dereference of null pointer: *gnip */
22 /*@only@*/ int *f (nip arg0, nip arg1, nip arg2, /*@only@*/ int *aip)
24 int *y = (int *) malloc (sizeof (int));
25 int *z = (int *) malloc (sizeof (int));
27 *arg0 = 3; /* 2. Possible dereference of null pointer: *arg0 */
35 free (y); /* 3. Possibly null storage passed as non-null param: y */
37 *z = 3; /* 4. Possible dereference of null pointer: *z */
38 return z; /* 5. Only storage not released before return: aip */
44 *arg2 = 5; /* 6. Possible dereference of null pointer: *arg2 */
49 if (gnip) { free (gnip); } else { ; } /* okay */
52 *gnip = 3; /* 7. Possible dereference of null pointer: *gnip */
53 gip = z; /* 8, 9. uses z after release, only z not released */
54 /* Note: gip is possibly null now +++ kept*/
55 gnip = aip; /* 10. Only storage gnip not released before assignment: gnip = aip */
60 return y; /* 11, 12. Returned storage y not completely defined,
61 Function returns with non-null global gip referencing null */
65 return y; /* 13, 14, 15. Possibly null storage returned as non-null: y,
66 Returned storage y not completely defined,
67 Function returns with non-null global gip referencing null */
73 *gnip = 3; /* 16. Possible dereference of null pointer: *gnip */