[JAVA] FP: A "NullPointerException" could be thrown

[Julien Herr]

Hi,

I think something is missing in the flow analyze of NPE:

https://sonarcloud.io/project/issues?id=org.testng%3Atestng&open=AV1GDm51NAVDjyrgWoft&resolved=false&severities=MAJOR&sinceLeakPeriod=true&types=BUG

A "NullPointerException" could be thrown; "stack" is nullable here.

BugMajor

1

'stack' is passed to 'getTestRoot()'.

2

Implies 'stack' can be null.

3

Implies 'stack' is null.

4

'stack' is dereferenced.

Step 2: if stack is null, "getTestRoot" return -1

Step 4: it won't be reached if "stack" is "null" because -1 < 0

Regards,

Julien

[Tibor Blenessy]

Hello Julien,

sorry for the late answer, unfortunately, the link is dead now. Do you by chance remember the file where issue was detected?

Best regards

Tibor

--
You received this message because you are subscribed to the Google Groups "SonarQube" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sonarqube+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/aaad3a71-8473-4e4c-9174-4200747ecfb2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Tibor Blenessy | SonarSource

SonarJava Developer

http://sonarsource.com 

[Julien Herr]

Le mardi 5 septembre 2017 18:46:12 UTC+2, Tibor Blenessy a écrit :

Hello Julien,

sorry for the late answer, unfortunately, the link is dead now.

No prob! :)

 

Do you by chance remember the file where issue was detected?

If you remove the filter on the leak period, the link is still valid ;)

https://sonarcloud.io/project/issues?id=org.testng%3Atestng&open=AV1GDm51NAVDjyrgWoft&resolved=false&severities=MAJOR&types=BUG

[Tibor Blenessy]

Hello Julien,

sorry again for the late answer. Indeed this is a false positive, because data flow engine in SonarJava doesn't yet understand arithmetic expressions like -1 < 0 , so it is unable to detect that condition is impossible. We definitely want to implement this feature, but I for the time being can't provide you any timeframe nor concrete JIRA ticket. 

Thank you for reporting the issue, it's always good to have user feedback on which features are needed.

Cheers,

Tibor

To view this discussion on the web visit https://groups.google.com/d/msgid/sonarqube/66361e64-1f55-4da7-9302-038998798bde%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.