AI review of 2026-10-27_17-53-36-26543ab97b08-results.txt PR: #8961 https://github.com/cppcheck-opensource/cppcheck/pull/8961 Tested: 26543ab97b08305f3fb7c9b4f8b55c13a48b5fec Merge base: 275f16a5223230cdcadf3f3f92bf9716138ac4fc Reviewed: 2026-10-27 22:01:03 UTC Model: claude-opus-5-5 (effort high) Results: 50 reviewed of 62 in the report (random sample) Verdicts: 33 improvement, 16 neutral, 1 unclear Tokens: 335619 input, 134064 cache read, 2736 cache write, 40590 output The verdicts are written by AI and can be wrong. ---- 1 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: main alpine-2.26/imap/src/c-client/mail.c:3793:38: error: Null pointer dereference: s [nullPointer] alpine-2.26/imap/src/c-client/mail.c:3786:38: note: Calling function 'mail_newstringlist' returns 0 alpine-2.26/imap/src/c-client/mail.c:3786:38: note: Assignment 's=mail_newstringlist()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:3793:25: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:3793:38: note: Null pointer dereference Explanation: The excerpt does not match the reported location: line 3793 is `else return NIL;`, with no `s=mail_newstringlist()` nearby, so the warning itself cannot be checked. Only the severity and wording changed. The error path contains 'Assuming condition is true', so the null value depends on a condition. Reporting it as 'Possible null pointer dereference' (warning) is more accurate than a definite 'Null pointer dereference' (error). Also, in c-client, `mail_newstringlist` probably allocates with `fs_get`, which does not return NULL, so this may be a false positive anyway; a lower severity is then preferable. ---- 2 / 50 ---- Verdict: UNCLEAR (low confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: main alpine-2.26/imap/src/c-client/mail.c:4272:11: error: Null pointer dereference: cur [nullPointer] alpine-2.26/imap/src/c-client/mail.c:4269:45: note: Calling function 'mail_newsearchset' returns 0 alpine-2.26/imap/src/c-client/mail.c:4269:25: note: Assignment 'cur=set=mail_newsearchset()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:4269:9: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:4272:11: note: Null pointer dereference Explanation: The source excerpt does not match the reported location. Line 4272 is a comment in the shown file, so the code at 4269–4273 that uses `mail_newsearchset()` and `cur` cannot be inspected. The PR only changes the message from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the null value depends on an assumed condition ('Assuming condition is true'). That would be more accurate if the warning is real. However, the claim that `mail_newsearchset()` returns 0 is suspicious: that function normally returns freshly allocated, zeroed memory, so the warning may be a false positive either way. Without the actual code, the change cannot be judged. ---- 3 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: main alpine-2.26/imap/src/c-client/mail.c:4273:39: error: Null pointer dereference: cur [nullPointer] alpine-2.26/imap/src/c-client/mail.c:4269:45: note: Calling function 'mail_newsearchset' returns 0 alpine-2.26/imap/src/c-client/mail.c:4269:25: note: Assignment 'cur=set=mail_newsearchset()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:4269:9: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:4273:39: note: Null pointer dereference Explanation: The excerpt does not show the flagged code: line 4273 is a comment, so the file probably differs from what Cppcheck analyzed. The error path itself shows the null value of 'cur' depends on a condition ('Assuming condition is true' at 4269). The value comes from 'mail_newsearchset' supposedly returning 0, which is doubtful for an allocator wrapper. A null dereference that only happens on one branch is not certain. Reporting it as warning/'Possible null pointer dereference' instead of error/'Null pointer dereference' is more accurate. If it is actually a false positive, the lower severity also helps users. Only the wording and severity change; the warning is still reported at the same location with the same path. ---- 4 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: main alpine-2.26/imap/src/c-client/mail.c:5315:5: error: Null pointer dereference: ret [nullPointer] alpine-2.26/imap/src/c-client/mail.c:5310:21: note: Assignment 'ret=0', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:5313:44: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:5315:5: note: Null pointer dereference Explanation: The shown source does not match the reported lines; there is no `ret` near line 5315, so the actual code cannot be checked. The warning is not removed, only reclassified. The error path relies on a condition ('Assuming condition is true' at 5313), so the null value reaches the dereference only on one branch. Calling it a certain 'Null pointer dereference' with error severity overstated it. 'Possible null pointer dereference' as a warning matches the conditional error path, which is the purpose of the PR. The finding itself is unchanged, so the message is simply more accurate. ---- 5 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: your alpine-2.26/imap/src/c-client/mail.c:3793:38: warning: Possible null pointer dereference: s [nullPointer] alpine-2.26/imap/src/c-client/mail.c:3786:38: note: Calling function 'mail_newstringlist' returns 0 alpine-2.26/imap/src/c-client/mail.c:3786:38: note: Assignment 's=mail_newstringlist()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:3793:25: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:3793:38: note: Null pointer dereference Explanation: Only the wording and severity changed: error "Null pointer dereference" became warning "Possible null pointer dereference". The error path shows the null value only reaches the dereference under an assumed condition ("Assuming condition is true"), so the dereference is not certain on every path. Calling it "Possible" at warning severity is more accurate. The source excerpt does not line up with the reported lines, so the code itself cannot be checked. The finding also looks doubtful, since mail_newstringlist allocates with fs_get, which normally never returns NULL. If it is a false positive, lowering its severity is still not a loss. The same pattern applies to the sibling diffs. ---- 6 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: your alpine-2.26/imap/src/c-client/mail.c:4272:11: warning: Possible null pointer dereference: cur [nullPointer] alpine-2.26/imap/src/c-client/mail.c:4269:45: note: Calling function 'mail_newsearchset' returns 0 alpine-2.26/imap/src/c-client/mail.c:4269:25: note: Assignment 'cur=set=mail_newsearchset()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:4269:9: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:4272:11: note: Null pointer dereference Explanation: The same finding is still reported. Only the severity and wording changed, from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. The error path itself says 'Assuming condition is true' at 4269, so the null value of cur only holds on one branch. That makes 'Possible' at warning severity the more accurate description, which is exactly what the PR intends. The source excerpt shown does not match line 4272 (it shows a comment), so I cannot check the dereference directly. It is also doubtful that mail_newsearchset really returns 0, since it is an allocator, so the finding may be a false positive; if so, downgrading it is better still. ---- 7 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: your alpine-2.26/imap/src/c-client/mail.c:4273:39: warning: Possible null pointer dereference: cur [nullPointer] alpine-2.26/imap/src/c-client/mail.c:4269:45: note: Calling function 'mail_newsearchset' returns 0 alpine-2.26/imap/src/c-client/mail.c:4269:25: note: Assignment 'cur=set=mail_newsearchset()', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:4269:9: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:4273:39: note: Null pointer dereference Explanation: The warning was only reworded, from '(error) Null pointer dereference' to '(warning) Possible null pointer dereference'. Its location and error path are unchanged. The error path depends on 'Assuming condition is true', so the null value only holds on some paths. 'Possible' at warning severity therefore describes it more accurately, which is what the PR intends. However, the source shown does not match the reported line: line 4273 is a comment, and the 'cur=set=mail_newsearchset()' code is not visible. So I cannot check whether the warning is real. It may be a false positive, since mail_newsearchset presumably returns allocated memory. Either way, a less alarming message is no worse for users, but confidence is low. ---- 8 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/a/alpine/alpine_2.26+dfsg.orig.tar.xz Result: your alpine-2.26/imap/src/c-client/mail.c:5315:5: warning: Possible null pointer dereference: ret [nullPointer] alpine-2.26/imap/src/c-client/mail.c:5310:21: note: Assignment 'ret=0', assigned value is 0 alpine-2.26/imap/src/c-client/mail.c:5313:44: note: Assuming condition is true alpine-2.26/imap/src/c-client/mail.c:5315:5: note: Null pointer dereference Explanation: Only the wording and severity changed, from error "Null pointer dereference" to warning "Possible null pointer dereference". The error path itself says the null value at line 5315 depends on "Assuming condition is true" at line 5313, so the dereference happens only on some paths. Calling it "possible" at warning severity matches that conditional path better than a definite error does. The source excerpt shown does not match the notes (no 'ret=0' at line 5310), so I cannot judge whether the underlying warning is a true positive. The message change itself is consistent and more accurate. ---- 9 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:804:47: error: Null pointer dereference: serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:770:47: note: Assignment 'serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:776:24: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:804:47: note: Null pointer dereference Explanation: The main line is not dropped; it is replaced by the same finding as a warning, 'Possible null pointer dereference'. Cppcheck thinks serv_ex is still nullptr at line 804. In fact `unk_ex->exception() >>= serv_ex` is the CORBA Any extraction operator, which sets serv_ex through a reference. So the finding is most likely a false positive in both versions. The null value only exists after assuming the condition at line 776 is true, so 'Possible' at warning severity fits that path better than a definite error, and a false positive at lower severity is less harmful. The false positive itself is not fixed, so the benefit is small. ---- 10 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:812:29: error: Null pointer dereference: multi_serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:772:58: note: Assignment 'multi_serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:810:40: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:812:29: note: Null pointer dereference Explanation: Cppcheck does not see that the CORBA operator `>>=` takes `multi_serv_ex` by reference and assigns it. When the extraction returns true, the pointer is non-null, so the dereference at line 812 is a false positive either way. The PR does not remove the warning. It reports it as a warning ('Possible null pointer dereference') instead of an error ('Null pointer dereference'). That matches the error path, which only reaches the dereference by 'Assuming condition is true'. The message is more accurate and less severe for a false positive, so it is a small improvement for users. ---- 11 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1780:25: error: Null pointer dereference: multi_serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1768:54: note: Assignment 'multi_serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1778:36: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1780:25: note: Null pointer dereference Explanation: At line 1778, `unk_ex->exception() >>= multi_serv_ex` is the CORBA Any extraction operator. It writes the extracted pointer into `multi_serv_ex` through a reference and returns true only on success. So the dereference at 1780 is safe, and the report is a false positive in both versions. Cppcheck does not model that the overloaded `>>=` assigns the pointer. The PR does not remove the warning. It changes it from a definite "error: Null pointer dereference" to "warning: Possible null pointer dereference". The null value only reaches line 1780 by "Assuming condition is true", so it is conditional. Calling it a possible dereference describes Cppcheck's reasoning more accurately than the old certain error. A lower severity also makes this false positive less harmful. ---- 12 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1390:39: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1378:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1388:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1390:39: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then filled by `send >>= data_in;`, the CORBA Any extraction operator, which takes the pointer by reference. It stays null only if extraction fails. So a definite "(error) Null pointer dereference" at line 1390 is wrong: Cppcheck cannot know the value is null there. The main warning is essentially a false positive caused by missing knowledge of operator>>=. The PR keeps the report but downgrades it to "(warning) Possible null pointer dereference", because the path relies on an assumed condition. That matches the real situation better: null only if extraction fails. A less certain message on a doubtful finding is a modest improvement in accuracy. ---- 13 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1443:54: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1415:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1437:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1443:54: note: Null pointer dereference Explanation: `data_in` is set to nullptr, but `send >>= data_in;` (CORBA Any extraction through a reference) then assigns it, so the reported dereference at 1443 is almost certainly a false positive in both versions. The PR only changes how it is reported. Main called it an error, 'Null pointer dereference', even though its own path depends on 'Assuming condition is true'. The new version reports a warning, 'Possible null pointer dereference', which matches the conditional path and is less loud for what is likely a false positive. The underlying false positive remains, so the gain is small. ---- 14 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1449:91: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1415:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1437:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1449:91: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by `send >>= data_in;`, a CORBA extraction that writes through a reference. In real use it is not null, so this warning is a false positive both before and after the PR. Cppcheck's own error path also relies on 'Assuming condition is true' (line 1437), so the value is conditional, not certain. The PR downgrades the report from error 'Null pointer dereference' to warning 'Possible null pointer dereference'. That matches the conditional evidence better and makes the false positive less severe. It is still a false positive, so the gain is modest. ---- 15 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1522:53: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1522:53: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then filled by `send >>= data_in` (CORBA Any extraction through a pointer reference). Cppcheck does not model that assignment, so it keeps the null value. It can only stay null if the extraction fails, so a definite "error: Null pointer dereference" at line 1522 overstates the problem. The new "warning: Possible null pointer dereference" fits the conditional error path better and lowers the severity of what is mostly a false positive. ---- 16 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1539:68: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1539:68: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled through the CORBA reference extraction `send >>= data_in`. Cppcheck evidently does not model that and treats the pointer as still null. It is only really null if the extraction fails, which the code does not check. The warning is therefore questionable in both versions. The PR changes it from error 'Null pointer dereference' to warning 'Possible null pointer dereference'. It does so only because the value passed through the unrelated `dev_it != end()` condition at line 1520, which has nothing to do with `data_in`. The softer wording fits the real code a little better but for the wrong reason. The same questionable warning is still reported at the same place, so users see little real difference. ---- 17 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1545:57: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1545:57: note: Null pointer dereference Explanation: `data_in` is initialised to nullptr, but `send >>= data_in;` (CORBA Any extraction) assigns it before any dereference. So the nullPointer report at 1545 is a false positive both before and after the PR. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the value depends on an assumed condition (line 1520). The FP is not removed, but it is now reported with lower severity and a less absolute message, which is slightly less misleading for users. The underlying misunderstanding of `>>=` remains. ---- 18 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1624:91: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1609:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1619:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1624:91: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then filled by `send >>= data_in`. CORBA's `operator>>=` takes the pointer by reference and assigns it. Cppcheck does not model this, so the null dereference warning at line 1624 is a false positive both before and after the PR. The PR only changes the report from `error: Null pointer dereference` to `warning: Possible null pointer dereference`, because the path passes through an unrelated 'Assuming condition is true' (line 1619). Lowering the severity and certainty of a false positive is mildly better for users. However, in Cppcheck's own model the value is unconditionally null, so the new wording is arguably less precise. The warning itself remains wrong in both versions. ---- 19 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1700:43: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1675:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1697:28: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1700:43: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by `send >>= data_in;`. CORBA Any extraction writes the pointer through a reference, so `data_in` is not null at line 1700. The warning is a false positive in both versions; Cppcheck does not model the `>>=` extraction. The PR only changes the report from error "Null pointer dereference" to warning "Possible null pointer dereference", because the null value is reached only along an assumed-condition path (line 1697). Downgrading a false positive and making it less assertive is a small gain for users. The warning itself remains wrong, so confidence is low. ---- 20 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1749:54: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1675:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1697:28: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1743:10: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1749:54: note: Null pointer dereference Explanation: `data_in` is set to nullptr at line 1675, but it is then filled by `send >>= data_in` (CORBA Any extraction, which takes the pointer by reference). Cppcheck misses that assignment, so the warning at line 1749 is a false positive either way. The PR only changes it from an error ('Null pointer dereference') to a warning ('Possible null pointer dereference'), because the value depends on assumed conditions (lines 1697 and 1743). Showing a false positive at lower severity and with hedged wording is slightly better for users. It is also consistent with the PR's intent of not calling condition-dependent values certain errors. ---- 21 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1855:39: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1843:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1853:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1855:39: note: Null pointer dereference Explanation: `send >>= data_in` is a CORBA Any extraction operator. It takes the pointer by reference and assigns it, so `data_in` is not null at line 1855. The report is therefore a false positive both before and after the PR. Cppcheck simply does not model `operator>>=` writing to `data_in`. The PR does not remove the warning. It only marks this value as conditional, because it was reached after 'Assuming condition is true', and so reports it as a 'Possible null pointer dereference' warning instead of an error. Lowering the severity of a false positive is a small benefit for users, which makes this a slight improvement rather than neutral. Confidence is low because the condition at line 1853 has nothing to do with whether `data_in` is null, so the 'Possible' wording is not more accurate in itself. ---- 22 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1898:48: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1898:48: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by the CORBA extraction `send >>= data_in`, so it is not null at line 1898. Line 1888 also dereferences it unconditionally first. The warning is a false positive both before and after the PR, because Cppcheck does not see that `>>=` assigns the pointer. The PR only changes the message from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. The 'Assuming condition is true' step has nothing to do with whether the pointer is null. The downgrade makes the false positive a bit less loud but does not fix it, so it makes no real difference to users. ---- 23 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1902:54: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1902:54: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then set by `send >>= data_in;`. That is a CORBA Any extraction operator, which writes the pointer through a reference. Cppcheck does not model this, so the null dereference at 1902 is a false positive both before and after the PR. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the path goes through an assumed condition (`it == end`). The false positive is still there. Showing it at lower severity is mildly better for users, and 'possible' is closer to the truth than a certain error. The branch condition does not actually affect whether `data_in` is null, so the benefit is small. ---- 24 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1923:91: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1923:91: note: Null pointer dereference Explanation: `data_in` is set to nullptr at 1880, but `send >>= data_in;` at 1884 assigns it through the CORBA Any extraction operator before any dereference. The warning at 1923 is therefore a false positive both before and after the PR. The PR only changes the wording and severity, from "error: Null pointer dereference" to "warning: Possible null pointer dereference". The condition at 1896 (`it == m_server.classes.end()`) has nothing to do with `data_in`, so the new "possible" wording is not more accurate. The same false positive is reported either way, just at a lower severity, so users gain or lose little. ---- 25 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1990:53: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1990:53: note: Null pointer dereference Explanation: `data_in` starts as nullptr, but `send >>= data_in` (CORBA Any extraction through a reference parameter) assigns it before any dereference. So the reported null dereference at line 1990 is a false positive in both versions. The PR only changes it from an error, 'Null pointer dereference', to a warning, 'Possible null pointer dereference', because the value flows through an unrelated branch (`it == end`). The underlying false positive remains. Demoting it to a warning means it is no longer shown by default without --enable=warning, which slightly reduces its impact on users. ---- 26 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2010:68: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2010:68: note: Null pointer dereference Explanation: `data_in` starts as nullptr, but `send >>= data_in;` (CORBA Any extraction) sets it before any use. So the null pointer warning at line 2010 is a false positive in both versions; Cppcheck does not see that `operator>>=` writes to `data_in`. The PR does not remove the warning. It only downgrades it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. Strictly, the null value here does not depend on the branch condition, so 'Possible' is not more precise. Still, a lower severity for a false positive is less misleading, which makes this a slight improvement. ---- 27 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: main tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2014:57: error: Null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2014:57: note: Null pointer dereference Explanation: `data_in` is initialised to nullptr at line 1970, but `send >>= data_in;` at line 1978 is a CORBA Any extraction that assigns it a real pointer. So the dereference at line 2014 is not a null dereference, and the report is a false positive both before and after the PR, because Cppcheck does not model `>>=` as writing to `data_in`. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. That is because the value passed through 'Assuming condition is false' at line 1983, even though that condition has nothing to do with `data_in`. The false positive is still reported, just at lower severity, so for users this is essentially neutral. ---- 28 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:779:23: warning: Possible null pointer dereference: serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:770:47: note: Assignment 'serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:776:24: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/Connection_asyn_cb.cpp:779:23: note: Null pointer dereference Explanation: The warning is a false positive both before and after the PR. `serv_ex` starts as nullptr, but `unk_ex->exception() >>= serv_ex;` is the CORBA Any extraction operator, which takes a `const T*&` and sets the pointer. Cppcheck does not model that write, so it still reports a null dereference at line 779. The PR only changes the message from `error: Null pointer dereference` to `warning: Possible null pointer dereference`, because the null value comes through the `version < 3` branch. The `version` condition does not affect whether `serv_ex` is null, so the new wording is not more accurate about the real problem. The false positive is still reported. Its lower severity slightly reduces the harm, but the diagnosis has not improved, so the net effect is roughly neutral. ---- 29 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/Database.cpp:3255:42: warning: Possible null pointer dereference: class_list [nullPointer] tango-10.3.3/lib/cpp/src/client/Database.cpp:3238:43: note: Assignment 'class_list=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/Database.cpp:3252:55: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/Database.cpp:3255:42: note: Null pointer dereference Explanation: `class_list` is set to nullptr, then filled through `received.inout() >>= class_list`, then checked against nullptr (with a throw) before use. Line 3248 dereferences it unconditionally. So the dereference at 3255 is not a real null dereference, and the warning is a false positive both before and after the PR. The PR only changes how the value is reported. The value reaches 3255 only after 'Assuming condition is true' (a conditional value), so it is now reported as a 'Possible null pointer dereference' warning instead of a definite error. This matches the error path better and makes the false positive less severe. ---- 30 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1774:19: warning: Possible null pointer dereference: serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1766:43: note: Assignment 'serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1771:20: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1774:19: note: Null pointer dereference Explanation: `serv_ex` starts as nullptr and is then passed to the CORBA `operator>>=` extraction, whose return value is ignored. If the extraction fails, the pointer may stay null, so line 1774 is at most a possible dereference, not a certain one. The null value Cppcheck tracks also depends on the condition `version < 3` ("Assuming condition is true"), so calling it a definite "Null pointer dereference" error was overstated. The PR changes it to a "Possible null pointer dereference" warning, which better matches both Cppcheck's conditional reasoning and the real risk. ---- 31 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1780:25: warning: Possible null pointer dereference: multi_serv_ex [nullPointer] tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1768:54: note: Assignment 'multi_serv_ex=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1778:36: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/DeviceProxy_asyn.cpp:1780:25: note: Null pointer dereference Explanation: At line 1778, `unk_ex->exception() >>= multi_serv_ex` is the CORBA Any extraction operator. It assigns a valid pointer to `multi_serv_ex` and returns true on success. So the dereference at line 1780 inside the true branch is safe. Cppcheck does not model that `>>=` writes to the pointer, so the report is a false positive both before and after the PR. The PR only changes how it is reported. Before, it was a definite `error: Null pointer dereference`. Now it is `warning: Possible null pointer dereference`, because the null value depends on an assumed condition ('Assuming condition is true'). The false positive remains, but it is now less severe and less assertive. The wording also better matches the conditional reasoning. That makes this a mild improvement for users. ---- 32 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1443:54: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1415:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1437:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1443:54: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then filled by `send >>= data_in;`, the CORBA Any extraction, which takes the pointer by reference. So the dereference at 1443 is not a real null dereference. Cppcheck evidently does not model that extraction. The warning is a false positive in both main and the PR. The PR only changes it from an error saying 'Null pointer dereference' to a warning saying 'Possible null pointer dereference'. The cited condition (`dev_it != end`) has nothing to do with `data_in`, so the 'conditional' reasoning behind the downgrade does not really apply. The lower severity makes the false positive slightly less harmful, but it is still reported. Overall this changes little for users. ---- 33 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1449:91: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1415:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1437:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1449:91: note: Null pointer dereference Explanation: `data_in` starts as nullptr but is then filled by the CORBA extraction `send >>= data_in;`, which takes the pointer by reference. Cppcheck does not model this assignment, so the warning is a false positive both before and after the PR. The PR only changes the wording and severity from "(error) Null" to "(warning) Possible null" because the value is tagged conditional. Here the condition `dev_it != end` has nothing to do with `data_in`, so the new wording is not really more accurate either. A false positive stays a false positive, just reported at lower severity. ---- 34 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1522:53: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1522:53: note: Null pointer dereference Explanation: `data_in` starts as nullptr, but `send >>= data_in` (CORBA Any extraction, which takes `const T*&`) assigns it before any use. Both the old error and the new warning are false positives. The PR only lowers this one from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. The value is marked conditional because of the unrelated `dev_it != end()` check. Downgrading a false positive and hedging its wording is mildly better for users, though the false positive itself remains. ---- 35 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1530:84: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1530:84: note: Null pointer dereference Explanation: `data_in` is initialized to nullptr but then filled by `send >>= data_in;`, a CORBA Any extraction that writes the pointer through a reference. So the dereference at line 1530 is a false positive in both main and the PR; Cppcheck just does not model `operator>>=`. The PR only changes the report from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference' because the value passed through the `dev_it != end()` condition. That condition has nothing to do with `data_in`, so by Cppcheck's own reasoning the pointer would be null on every path, and the 'conditional' downgrade is not more accurate. The false positive stays either way; only its severity drops, so the net effect for users is negligible. ---- 36 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1539:68: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1504:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1520:15: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1539:68: note: Null pointer dereference Explanation: `data_in` is set to nullptr, then filled by `send >>= data_in;`, the CORBA Any extraction operator that writes the pointer through a reference. Cppcheck does not see this assignment, so the warning is a false positive in both versions. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the value passed through a condition (line 1520) that has nothing to do with `data_in`. The false positive is still reported. Lowering the severity of a false positive barely matters to users, and the new wording is not more accurate about the real code. ---- 37 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1624:91: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1609:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1619:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1624:91: note: Null pointer dereference Explanation: This is a false positive either way. `send >>= data_in;` is the CORBA Any extraction operator, which takes `const T*&` and assigns `data_in`. So the nullptr from line 1609 does not survive to line 1624, and Cppcheck simply misses that assignment. The PR keeps the bogus finding but lowers it from error 'Null pointer dereference' to warning 'Possible null pointer dereference', so it is less disruptive. The stated reason for the downgrade (the value depends on the condition at 1619) does not really fit here: nullness of `data_in` does not depend on that condition, and line 1617 already dereferences it unconditionally. So this is only a slight improvement. ---- 38 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1626:47: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1609:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1619:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1624:32: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1626:47: note: Null pointer dereference Explanation: `data_in` starts as nullptr, but `send >>= data_in;` is a CORBA Any extraction that writes the pointer through a reference. Cppcheck misses this, so the warning is a false positive both before and after the PR. In Cppcheck's own model the pointer is null on every path; the conditions only decide whether line 1626 is reached. So calling it 'Possible' is not more accurate. The PR only changes the label of a false positive from error to warning: slightly less harm to users, but no real gain in accuracy. ---- 39 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1700:43: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1675:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1697:28: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1700:43: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by the CORBA extraction `send >>= data_in;` (line 1679). Cppcheck does not model that this operator assigns the pointer, so the warning at line 1700 is a false positive both before and after the PR. The PR only changes how it is reported: the null value comes through an 'Assuming condition is true' path, so it is now a 'Possible null pointer dereference' warning instead of an error. That matches the PR's intent. However, the same pointer is already dereferenced unconditionally at lines 1686, 1688 and 1697, so the new wording is not really more accurate either. The false positive remains, just at lower severity, so the practical effect is negligible. ---- 40 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1749:54: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1675:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1697:28: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1743:10: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1749:54: note: Null pointer dereference Explanation: In DbGetClassProperty, `data_in` is set to nullptr at line 1675 and then filled by `send >>= data_in;`, the CORBA extraction operator that takes the pointer by reference. This follows the same pattern visible at lines 1767-1773. So `data_in` is not null at line 1749, and the warning is a false positive both before and after the PR. The PR only changes the message from '(error) Null pointer dereference' to '(warning) Possible null pointer dereference'. That wording fits better, because the error path depends on assumed conditions (1697 false, 1743 true). It also lowers the severity of a false positive. This is a small gain in accuracy, but the false positive itself remains. ---- 41 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1855:39: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1843:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1853:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1855:39: note: Null pointer dereference Explanation: `data_in` starts as nullptr, but `send >>= data_in;` is the CORBA Any extraction operator, which takes the pointer by reference and sets it. So `data_in` is not null at line 1855. Cppcheck does not see this and reports a false positive both before and after the PR. The PR only relabels it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the path goes through the unrelated `it != end` condition. The false positive is still reported. The new wording is not more correct either: under Cppcheck's own model the value would be null on every path, regardless of that condition. For users the change makes no real difference. ---- 42 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1898:48: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1898:48: note: Null pointer dereference Explanation: `data_in` is initialized to nullptr but then filled by the CORBA extraction `send >>= data_in`, which takes the pointer by reference and sets it. Cppcheck does not model this, so the dereference at line 1898 is a false positive either way. The PR keeps the warning but downgrades it from a certain 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the value is only reached via an assumed condition. A false positive reported with less certainty and lower severity is slightly better for users, though the warning remains wrong. ---- 43 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1902:54: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1902:54: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by `send >>= data_in;`, which is CORBA Any extraction through a pointer reference. Cppcheck does not model this assignment, so the null dereference report at line 1902 is a false positive both before and after the PR. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the error path goes through a condition (line 1896). That condition only controls whether the line is reached; it does not affect `data_in`, so the 'possible' wording is not more accurate. Still, the finding remains a false positive, and lowering it from error to warning makes it less harmful to users. This is a mild improvement, not a real fix. ---- 44 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1916:50: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1916:50: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by `send >>= data_in`, which is the CORBA Any extraction operator. Cppcheck does not model this operator as writing to `data_in`, so the null dereference warning at 1916 is a false positive both before and after the PR. The PR only changes it from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference', because the value passed through an unrelated condition (`it == m_server.classes.end()`). The false positive remains, just at a lower severity. The new wording is not more accurate either: that condition has nothing to do with `data_in`. So this makes no real difference to users. ---- 45 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1923:91: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1880:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1896:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1923:91: note: Null pointer dereference Explanation: `data_in` is set to nullptr at line 1880, but `send >>= data_in;` at 1884 assigns it through CORBA Any extraction before any use. The report is a false positive both before and after the PR; only the severity and wording changed, from error 'Null' to warning 'Possible null'. The condition at 1896 (class not found) has nothing to do with whether `data_in` is null, so 'Possible' is no more accurate in substance. The same false positive is still reported, just at a lower severity. ---- 46 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1985:92: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is true tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1985:92: note: Null pointer dereference Explanation: `data_in` is initialised to nullptr but is then filled by the CORBA extraction `send >>= data_in;` (operator>>= takes `const T*&`). So the dereference at 1985 is not a real null dereference, and the report is a false positive either way. The PR only changes the wording and severity, from 'error: Null pointer dereference' to 'warning: Possible null pointer dereference'. Strictly, the condition `it == end` has nothing to do with whether `data_in` is null, so 'Possible' is not more precise in Cppcheck's own model. Still, showing a false positive at a lower severity is mildly better for users. ---- 47 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1990:53: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1990:53: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by the CORBA extraction `send >>= data_in;`. In real code it is not null at line 1990, so this warning is most likely a false positive both before and after the PR. The PR only changes how it is reported. The error path depends on 'Assuming condition is false', so the value is conditional. The PR lowers it from an unconditional (error) 'Null pointer dereference' to (warning) 'Possible null pointer dereference'. That fits the conditional error path better and makes a probable false positive less severe, so it is a mild improvement. ---- 48 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2001:84: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2001:84: note: Null pointer dereference Explanation: `data_in` is set to nullptr and then filled by the CORBA extraction `send >>= data_in`. Cppcheck does not model that extraction. In practice `data_in` is only null if the extraction fails, so a definite "(error) Null pointer dereference" overstated the problem. The finding is still a likely false positive, but the PR now reports it as "(warning) Possible null pointer dereference" because the path goes through a condition. The finding is the same, its severity is less alarming, and the wording fits the code better. ---- 49 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2010:68: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2010:68: note: Null pointer dereference Explanation: `data_in` is set to nullptr, but `send >>= data_in;` (CORBA Any extraction, which takes the pointer by reference) then assigns it before any dereference. So the warning at line 2010 is a false positive in both versions. The PR only changes the severity and wording from error "Null pointer dereference" to warning "Possible null pointer dereference". The condition at line 1983 (`it == classes.end()`) has nothing to do with `data_in`, so even under Cppcheck's own model the "possible" wording is not more accurate. The false positive is still reported, so users see no real change. ---- 50 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/t/tango/tango_10.3.3+dfsg1.orig.tar.xz Result: your tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2014:57: warning: Possible null pointer dereference: data_in [nullPointer] tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1970:47: note: Assignment 'data_in=nullptr', assigned value is 0 tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:1983:11: note: Assuming condition is false tango-10.3.3/lib/cpp/src/client/FileDatabase.cpp:2014:57: note: Null pointer dereference Explanation: `data_in` is set to nullptr at line 1970 but is then filled by `send >>= data_in;` at line 1978. That CORBA Any extraction assigns the pointer through a reference, so the dereference at line 2014 is not really null. The warning is a false positive both before and after the PR. The PR only turns the error 'Null pointer dereference' into the warning 'Possible null pointer dereference' because the value passed through a condition. That condition (`it == m_server.classes.end()`) has nothing to do with `data_in`. The underlying false positive is unchanged, so it does not matter much to users either way.