Reported by Static Analyzer Tool:
Inside "SemaExprMember.cpp" file, in clang::Sema::BuildMemberReferenceExpr(clang::Expr *, clang::QualType, clang::SourceLocation, bool, clang::CXXScopeSpec &, clang::SourceLocation, clang::NamedDecl *, clang::DeclarationNameInfo const &, clang::TemplateArgumentListInfo const *, clang::Scope const *, clang::Sema::ActOnMemberAccessExtraArgs *): Return value of function which returns null is dereferenced without checking.
//Condition !Base, taking true branch.
if (!Base) {
TypoExpr *TE = nullptr;
QualType RecordTy = BaseType;
//Condition IsArrow, taking true branch.
if (IsArrow) RecordTy = RecordTy->castAs<PointerType>()->getPointeeType();
//returned_null: getAs returns nullptr (checked 279 out of 294 times).
//Condition TemplateArgs != NULL, taking true branch.
//Dereference null return value (NULL_RETURNS)
//dereference: Dereferencing a pointer that might be nullptr RecordTy->getAs() when calling LookupMemberExprInRecord.
if (LookupMemberExprInRecord(
*this, R, nullptr, RecordTy->getAs<RecordType>(), OpLoc, IsArrow,
SS, TemplateArgs != nullptr, TemplateKWLoc, TE))
return ExprError();
if (TE)
return TE;This patch uses castAs instead of getAs which will assert if the type doesn't match.