Reported by Static Analyzer Tool:
Inside "SemaExprMember.cpp" file, in clang::Sema::BuildMemberReferenceExpr(clang::Expr *, clang::QualType, clang::SourceLocation, bool, clang::CXXScopeSpec &, clang::SourceLocation, clang::NamedDecl *, clang::DeclarationNameInfo const &, clang::TemplateArgumentListInfo const *, clang::Scope const *, clang::Sema::ActOnMemberAccessExtraArgs *): Return value of function which returns null is dereferenced without checking.
//Condition !Base, taking true branch. if (!Base) { TypoExpr *TE = nullptr; QualType RecordTy = BaseType; //Condition IsArrow, taking true branch. if (IsArrow) RecordTy = RecordTy->castAs<PointerType>()->getPointeeType(); //returned_null: getAs returns nullptr (checked 279 out of 294 times). //Condition TemplateArgs != NULL, taking true branch. //Dereference null return value (NULL_RETURNS) //dereference: Dereferencing a pointer that might be nullptr RecordTy->getAs() when calling LookupMemberExprInRecord. if (LookupMemberExprInRecord( *this, R, nullptr, RecordTy->getAs<RecordType>(), OpLoc, IsArrow, SS, TemplateArgs != nullptr, TemplateKWLoc, TE)) return ExprError(); if (TE) return TE;
This patch uses castAs instead of getAs which will assert if the type doesn't match.