Examples of errors detected by the V522 diagnostic.

V522. Dereferencing of the null pointer might take place.


Chromium

V522 Dereferencing of the null pointer 'plugin_instance' might take place. Check the logical condition. chrome_frame_npapi chrome_frame_npapi.cc 517


bool ChromeFrameNPAPI::Invoke(....)
{
  ChromeFrameNPAPI* plugin_instance =
    ChromeFrameInstanceFromNPObject(header);
  if (!plugin_instance &&
      (plugin_instance->automation_client_.get()))
    return false;
  ...
}

Clang

V522 Dereferencing of the null pointer 'DI' might take place. llvm-tblgen dagiselmatchergen.cpp 220


void MatcherGen::EmitLeafMatchCode(const TreePatternNode *N) {
  ...
  if (DI == 0) {
    errs() << "Unknown leaf kind: " << *DI << "\n";
    abort();
  }
  ...
}

PCSX2

V522 Dereferencing of the null pointer 'ptag' might take place. pcsx2 spr.cpp 376


void _SPR1interleave() {
  ...
  u32 *ptag;
  ...
  if (ptag == NULL) {                      // <=
   SysPrintf("SPR1 Tag BUSERR\n");
   spr1->chcr = ( spr1->chcr & 0xFFFF ) |
                ( (*ptag) & 0xFFFF0000 );  // <=
   psHu32(DMAC_STAT)|= 1<<15;
   done = 1;
   spr1finished = done;
   return;
  }
  ...
}

GeoLib

V522 Dereferencing of the null pointer 'pRect' might take place. geOLib geolib.cpp 3282


void WINAPI _GetMonitorRectByIndex( int iMonitor, RECT* pRect )
{
 int iMonitorCount = ::GetSystemMetrics( SM_CMONITORS );

 if ( iMonitor <= iMonitorCount || pRect != NULL ) // <=
 {
  if ( iMonitorCount == 1 )
  {
    pRect->left = 0;
    pRect->top = 0;
    pRect->right = GetSystemMetrics( SM_CXSCREEN );
    pRect->bottom = GetSystemMetrics( SM_CYSCREEN );
  }
  ...
 }
 else
 {
   pRect->left   = -1;   // <=
   pRect->top    = -1;
   pRect->right  = -1;
   pRect->bottom = -1;
 }
}

Blender

V522 Dereferencing of the null pointer 'tpart' might take place. bf_render convertblender.c 1788


static int render_new_particle_system(....)
{
  ParticleSettings *part, *tpart=0;
  ...
  // tpart don't used
  ...
  psys_particle_on_emitter(psmd,tpart->from,tpa->num,
    pa->num_dmcache,tpa->fuv,tpa->foffset,
    co,nor,0,0,sd.orco,0);
  ...
}

Visualization Toolkit (VTK)

V522 Dereferencing of the null pointer 'td' might take place. CommonCxxTests testconditionvariable.cxx 96


VTK_THREAD_RETURN_TYPE vtkTestCondVarThread( void* arg )
{
  ...
  if ( td )                  // <=
  {
    ...
  }
  else
  {
    cout << "No thread data!\n";
    cout << "  Thread " << ( threadId + 1 )
         << " of " << threadCount << " exiting.\n";

    -- td->NumberOfWorkers;  // <=

    cout.flush();
  }
  ...
}

ffdshow

V522 Dereferencing of the null pointer 'audio' might take place. tffdshowdecaudioinputpin.cpp 468


STDMETHODIMP_(bool) TffdshowDecAudioInputPin::getsf(
  TsampleFormat &outsf)
{
  if (!audio)                                      // <=
  {
    .... // audio don't used
    } else if (bitstream_codec(audio->codecId)) {  // <=
      outsf.sf = TsampleFormat::getSampleFormat(codecId);
      outsf.alternateSF = filter->insf.alternateSF;
      return true;
    }
  } else {
  .....
}

D programming language

V522 Dereferencing of the null pointer 'v' might take place. interpret.c 1711


Expression *getVarExp(Loc loc, InterState *istate,
                      Declaration *d, CtfeGoal goal)
{
  ....
  VarDeclaration *v = d->isVarDeclaration();
  if (v)
  {
    ....
  }
  else if (s)
  {
    if (s->dsym->toInitializer() == s->sym)
      ....
    else
      error(loc,
            "cannot interpret symbol %s at compile time",
            v->toChars());
  }
  ....
}

ReactOS

V522 Dereferencing of the null pointer 'device' might take place. bus.c 762


static void
acpi_bus_notify (....)
{
  struct acpi_device *device = NULL;
  ....
  switch (type) {
    ....
    case ACPI_NOTIFY_EJECT_REQUEST:
      DPRINT1("Received EJECT REQUEST "
              "notification for device [%s]\n",
              device->pnp.bus_id);
      /* TBD */
      break;
    ....
  }
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'device' might take place. bus.c 768
  • V522 Dereferencing of the null pointer 'device' might take place. bus.c 774
  • V522 Dereferencing of the null pointer 'device' might take place. bus.c 780
  • And 1 additional diagnostic messages.

ReactOS

V522 Dereferencing of the null pointer 'tag' might take place. ir_reader.cpp 904


ir_texture *
ir_reader::read_texture(s_expression *expr)
{
  s_symbol *tag = NULL;
  ....
  } else if (MATCH(expr, other_pattern)) {
    op = ir_texture::get_opcode(tag->value());
    if (op == -1)
      return NULL;
  }
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 's_shadow' might take place. ir_reader.cpp 964
  • V522 Dereferencing of the null pointer 'BootSectorInfo' might take place. disksup.c 1750
  • V522 Dereferencing of the null pointer 'BootSectorInfo' might take place. disksup.c 1751
  • And 1 additional diagnostic messages.

Windows 8 Driver Samples

V522 Dereferencing of the null pointer 'pSensor' might take place. sensorddi.cpp 903


HRESULT CSensorDDI::OnGetDataFields(....)
{
  ....
  if (nullptr != pSensor)
  {
    ....
  }
  else
  {
    hr = E_POINTER;
    Trace(TRACE_LEVEL_ERROR,
      "pSensor == NULL before getting datafield %!GUID!-%i "
      "value from %s, hr = %!HRESULT!",
      &Key.fmtid, Key.pid, pSensor->m_SensorName, hr);
  }
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'pSensor' might take place. sensorddi.cpp 1852

NetXMS

V522 Dereferencing of the null pointer 'subnet' might take place. session.cpp 10823


void ClientSession::findIpAddress(CSCPMessage *request)
{
  ....
  if (subnet != NULL)
  {
    debugPrintf(5, _T("findIpAddress(%s): found subnet %s"),
                ipAddrText,
                subnet->Name());
    found = subnet->findMacAddress(ipAddr, macAddr);
  }
  else
  {
    debugPrintf(5, _T("findIpAddress(%s): subnet not found"),
                ipAddrText,
                subnet->Name());
  }
  ....
}

Multi Theft Auto

V522 Dereferencing of the null pointer 'pPlayer' might take place. cgame.cpp 1895


void CGame::Packet_PlayerJoinData ( .... )
{
  ....
  // Add the player
  CPlayer* pPlayer = m_pPlayerManager->Create (....);
  if ( pPlayer )
  {
    ....
  }
  else
  {
    // Tell the console
    CLogger::LogPrintf(
      "CONNECT: %s failed to connect "
      "(Player Element Could not be created.)\n",
      pPlayer->GetSourceIP() );
  }
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'pPlayer' might take place. cgame.cpp 1901

Multi Theft Auto

V522 Dereferencing of the null pointer 'szCmdLine' might take place. Check the logical condition. clientcommands.cpp 396


void COMMAND_MessageTarget ( const char* szCmdLine )
{
  if ( !(szCmdLine || szCmdLine[0]) )
    return;
  ....
}

Trans-Proteomic Pipeline

V522 Dereferencing of the null pointer 'pepIndx' might take place. asapcgidisplay2main.cxx 534


void ASAPRatio_getDataStrctRatio(dataStrct *data, ....)
{
  ....
  int *outliers, *pepIndx=NULL;
  ....
  //pepIndx don't used
  ....
  if(data->dataCnts[i] == 1 && pepIndx[i] == 0)
     data->dataCnts[i] = 0;
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'peptides' might take place. asapcgidisplay2main.cxx 556
  • V522 Dereferencing of the null pointer 'peptides' might take place. asapcgidisplay2main.cxx 557
  • V522 Dereferencing of the null pointer 'peptides' might take place. asapcgidisplay2main.cxx 558
  • And 3 additional diagnostic messages.

Data Distribution Service

V522 Dereferencing of the null pointer 'file' might take place. util.h 24


static ACE_FILE_IO *audio_to_text (ACE_FILE_Addr &,
                                   ACE_FILE_Addr &dest)
{
  ACE_FILE_Connector connector;
  ACE_FILE_IO *file = 0;
  if (connector.connect (*file, dest) == -1)
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'file' might take place. util.h 39

Scilab

V522 Dereferencing of the null pointer 'dataPtr' might take place. scilababstractmemoryallocator.hxx 222


inline static int *alloc(void * pvApiCtx, const int position,
  const int rows, const int cols, int * ptr)
{
  int * _ptr = 0;
  SciErr err = allocMatrixOfInteger32(
    pvApiCtx, position, rows, cols, &_ptr);
  checkError(err);
  return _ptr;
}

inline static void create(void * pvApiCtx, const int position,
  const int rows, const int cols, long long * ptr)
{
  int * dataPtr = 0;
  alloc(pvApiCtx, position, rows, cols, dataPtr);
  for (int i = 0; i < rows * cols; i++)
  {
    dataPtr[i] = static_cast<int>(ptr[i]);
  }
}

This is what should have been written here: dataPtr = alloc(pvApiCtx, position, rows, cols, dataPtr);

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'dataPtr' might take place. scilababstractmemoryallocator.hxx 237
  • V522 Dereferencing of the null pointer 'ptr' might take place. scilababstractmemoryallocator.hxx 401

Unreal Engine 4

V522 Dereferencing of the null pointer 'LevelStreamingObject' might take place. unrealengine.cpp 10768


bool UEngine::CommitMapChange( FWorldContext &Context )
{
  ....
  LevelStreamingObject = Context.World()->StreamingLevels[j];
  if (LevelStreamingObject != NULL)
  {
    ....
  }
  else
  {
    check(LevelStreamingObject);
    UE_LOG(LogStreaming, Log,
           TEXT("Unable to handle streaming object %s"),
           *LevelStreamingObject->GetName());
  }
  ....
}

Unreal Engine 4

V522 Dereferencing of the null pointer 'GStreamingPauseBackground' might take place. streamingpauserendering.cpp 197


void FStreamingPause::Init()
{
  ....
  if( GStreamingPauseBackground == NULL && GUseStreamingPause )
  {
    // @todo UE4 merge andrew
    // GStreamingPauseBackground = new FFrontBufferTexture(....);
    GStreamingPauseBackground->InitRHI();
  }
}

Qt

V522 Dereferencing of the null pointer 'dn' might take place. qdocindexfiles.cpp 539


void QDocIndexFiles::readIndexSection(....)
{
  ....
  DocNode* dn = qdb_->findGroup(groupNames[i]);
  if (dn) {
    dn->addMember(node);
  }
  else {
    ....
    qDebug() << "DID NOT FIND GROUP:" << dn->name()
             << "for:" << node->name();
  }
  ....
}

Qt

V522 Dereferencing of the null pointer 'm' might take place. qquickcontext2d.cpp 3169


QV4::ReturnedValue QQuickJSContext2DPixelData::getIndexed(
  QV4::Managed *m, uint index, bool *hasProperty)
{
  ....
  if (!m)
    return m->engine()->currentContext()->throwTypeError();
  ....
}

OpenJPEG

V522 Dereferencing of the null pointer 'l_image' might take place. j2k.c 5205


bool j2k_write_rgn(....)
{
  OPJ_BYTE * l_current_data = 00;
  OPJ_UINT32 l_nb_comp;
  OPJ_UINT32 l_rgn_size;
  opj_image_t *l_image = 00;
  opj_cp_t *l_cp = 00;
  opj_tcp_t *l_tcp = 00;
  opj_tccp_t *l_tccp = 00;
  OPJ_UINT32 l_comp_room;

  // preconditions
  assert(p_j2k != 00);
  assert(p_manager != 00);
  assert(p_stream != 00);

  l_cp = &(p_j2k->m_cp);
  l_tcp = &l_cp->tcps[p_tile_no];
  l_tccp = &l_tcp->tccps[p_comp_no];

  l_nb_comp = l_image->numcomps;
  ....
}

Miranda NG

V522 Dereferencing of the null pointer 'cont' might take place. EmLanProto mlan.cpp 342


void CMLan::OnRecvPacket(u_char* mes, int len, in_addr from)
{
  ....
  TContact* cont = m_pRootContact;
  ....
  if (!cont)
    RequestStatus(true, cont->m_addr.S_un.S_addr);
  ....
}

LibreOffice

V522 Dereferencing of the null pointer 'pLabelData' might take place. Check the logical condition. pivotlayouttreelistdata.cxx 157


void ScPivotLayoutTreeListData::PushDataFieldNames(
  vector<ScDPName>& rDataFieldNames)
{
  ....
  ScDPLabelData* pLabelData = mpParent->GetLabelData(nColumn);

  if (pLabelData == NULL && pLabelData->maName.isEmpty())
    continue;
  ....
}

LibreOffice

V522 Dereferencing of the null pointer 'pWindow' might take place. Check the logical condition. querycontroller.cxx 293


void grabFocusFromLimitBox( OQueryController& _rController )
{
  ....
  vcl::Window* pWindow = VCLUnoHelper::GetWindow( xWindow );
  if( pWindow || pWindow->HasChildPathFocus() )
  {
    pWindow->GrabFocusToDocument();
  }
  ....
}

LibreOffice

V522 Dereferencing of the null pointer 'piTmpConnection' might take place. adodatalinks.cxx 84


BSTR PromptNew(long hWnd)
{
  ....
  ADOConnection* piTmpConnection = NULL;

  ::CoInitialize( NULL );

  hr = CoCreateInstance(
                CLSID_DataLinks,
                NULL,
                CLSCTX_INPROC_SERVER,
                IID_IDataSourceLocator,
                (void**)&dlPrompt
                );
  if( FAILED( hr ) )
  {
    piTmpConnection->Release();
    dlPrompt->Release( );
    return connstr;
  }
  ....
}

.NET CoreCLR

V522 Dereferencing of the null pointer 'hp' might take place. cee_wks gc.cpp 4488


heap_segment* gc_heap::get_segment_for_loh (size_t size
#ifdef MULTIPLE_HEAPS
                                           , gc_heap* hp
#endif //MULTIPLE_HEAPS
                                           )
{
#ifndef MULTIPLE_HEAPS
    gc_heap* hp = 0;
#endif //MULTIPLE_HEAPS
    heap_segment* res = hp->get_segment (size, TRUE);
  ....
}

When 'MULTIPLE_HEAPS' is not defined, it's no good because the pointer will equal zero.


Godot Engine

V522 Dereferencing of the null pointer 'create_trimesh_collision_node()' might take place. mesh_instance.cpp 177


Node* MeshInstance::create_trimesh_collision_node()
{
  if (mesh.is_null())
    return NULL;
  Ref<Shape> shape = mesh->create_trimesh_shape();
  if (shape.is_null())
    return NULL;
  StaticBody * static_body = memnew( StaticBody );
  static_body->add_shape( shape );
  return static_body;
  return NULL;
}

void MeshInstance::create_trimesh_collision()
{
  StaticBody* static_body =
    create_trimesh_collision_node()->cast_to<StaticBody>();
  ERR_FAIL_COND(!static_body);
  static_body->set_name( String(get_name()) + "_col" );
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'create_convex_collision_node()' might take place. mesh_instance.cpp 211

Unreal Engine 4

V522 Dereferencing of the null pointer 'GEngine' might take place. Check the logical condition. gameplaystatics.cpp 988\


void UGameplayStatics::DeactivateReverbEffect(....)
{
  if (GEngine || !GEngine->UseSound()) // <=
  {
    return;
  }
  UWorld* ThisWorld = GEngine->GetWorldFromContextObject(....);
  ....
}

Mozilla Thunderbird

V522 Dereferencing of the null pointer 'aStyleValues' might take place. sdnaccessible.cpp 252


STDMETHODIMP sdnAccessible::get_computedStyle(
                   BSTR __RPC_FAR* aStyleProperties,
                   BSTR __RPC_FAR* aStyleValues,
                   unsigned short __RPC_FAR* aNumStyleProperties)
{
  if (!aStyleProperties || aStyleValues || !aNumStyleProperties)
    return E_INVALIDARG;
  ....
  aStyleValues[realIndex] = ::SysAllocString(value.get());
  ....
}

ChakraCore

V522 Dereferencing of the null pointer 'tempNumberTracker' might take place. backwardpass.cpp 578


void
BackwardPass::MergeSuccBlocksInfo(BasicBlock * block)
{
  TempNumberTracker * tempNumberTracker = nullptr; // <= line 346
  ....
  if (!block->isDead)
  {
      ....
      if(!IsCollectionPass())
      {
          ....
          if (this->DoMarkTempNumbers())
          {
              tempNumberTracker = JitAnew(....);   // <= line 413
          }
      ....
  ....
  if (blockSucc->tempNumberTracker != nullptr)
  {
      ....
      tempNumberTracker->MergeData(....);          // <= line 578
      if (deleteData)
      {
          blockSucc->tempNumberTracker = nullptr;
      }
  }
  ....
}

FreeBSD Kernel

V522 Dereferencing of the null pointer 'sc' might take place. mrsas.c 4027


void
mrsas_aen_handler(struct mrsas_softc *sc)
{
  ....
  if (!sc) {
    device_printf(sc->mrsas_dev, "invalid instance!\n");
    return;
  }
  if (sc->evt_detail_mem) {
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'sc' might take place. mrsas.c 1279
  • V522 Dereferencing of the null pointer 'sc' might take place. tws_cam.c 1066
  • V522 Dereferencing of the null pointer 'sc' might take place. blkfront.c 677
  • And 4 additional diagnostic messages.

OpenToonz

V522 Dereferencing of the null pointer 'region' might take place. Check the logical condition. palettecmd.cpp 102


bool isStyleUsed(const TVectorImageP vi, int styleId)
{
  ....
  TRegion *region = vi->getRegion(i);
  if (region || region->getStyle() != styleId)
    return true;
  ....
}

OpenJDK

V522 Dereferencing of the null pointer 'data' might take place. util.c 2424


static jint JNICALL
cbObjectTagInstance(....)
{
    ClassInstancesData  *data;

    /* Check data structure */
    data = (ClassInstancesData*)user_data;
    if (data == NULL) {
        data->error = AGENT_ERROR_ILLEGAL_ARGUMENT;
        return JVMTI_VISIT_ABORT;
    }
  ....
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'data' might take place. util.c 2543
  • V522 Dereferencing of the null pointer 'data' might take place. util.c 2601
  • V522 Dereferencing of the null pointer 'data' might take place. util.c 2760

Blender

V522 Dereferencing of the null pointer 've' might take place. functions1d.cpp 107


int QuantitativeInvisibilityF1D::operator()(....)
{
  ViewEdge *ve = dynamic_cast<ViewEdge*>(&inter;);
  if (ve) {
    result = ve->qi();
    return 0;
  }
  FEdge *fe = dynamic_cast<FEdge*>(&inter;);
  if (fe) {
    result = ve->qi(); //<=
    return 0;
  }
  ....
}

Blender

V522 Dereferencing of the null pointer 'ibuf' might take place. tracking_util.c 765


static ImBuf *accessor_get_ibuf(....)
{
  ImBuf *ibuf, *orig_ibuf, *final_ibuf;
  ....
  /* First try to get fully processed image from the cache. */
  ibuf = accesscache_get(accessor,
                         clip_index,
                         frame,
                         input_mode,
                         downscale,
                         transform_key);
  if (ibuf != NULL) {
        return ibuf;
    }
  /* And now we do postprocessing of the original frame. */
  orig_ibuf = accessor_get_preprocessed_ibuf(accessor,
                                             clip_index,
                                             frame);
  if (orig_ibuf == NULL) {
        return NULL;
  }
  ....
  if (downscale > 0) {
      if (final_ibuf == orig_ibuf) {
          final_ibuf = IMB_dupImBuf(orig_ibuf);
      }
      IMB_scaleImBuf(final_ibuf,
                     ibuf->x / (1 << downscale),  //<=
                     ibuf->y / (1 << downscale)); //<=
  }
  ....
  if (input_mode == LIBMV_IMAGE_MODE_RGBA) {
      BLI_assert(ibuf->channels == 3 ||          //<=
                 ibuf->channels == 4);           //<=
  }
  ....
  return final_ibuf;
}

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'ibuf' might take place. tracking_util.c 766
  • V522 Dereferencing of the null pointer 'ibuf' might take place. tracking_util.c 783

Chromium

V522 Dereferencing of the null pointer 'item' might take place. action_wait.cc 41


// Returns the item associated with the component |id| or nullptr
// in case of errors.
CrxUpdateItem* FindUpdateItemById(const std::string& id) const;

void ActionWait::Run(UpdateContext* update_context,
                     Callback callback)
{
....
  while (!update_context->queue.empty())
  {
      auto* item =
        FindUpdateItemById(update_context->queue.front());
      if (!item) {                                         // <=
        item->error_category =                             // <=
          static_cast<int>(ErrorCategory::kServiceError);
        item->error_code =                                 // <=
          static_cast<int>(ServiceError::ERROR_WAIT);
        ChangeItemState(item, CrxUpdateItem::State::kNoUpdate);
      } else {
        NOTREACHED();
      }
      update_context->queue.pop();
  }
....
}

Clang

V522 Dereferencing of the null pointer 'PdbFileBuffer' might take place. PDBFileBuilder.cpp 106


Expected<std::unique_ptr<PDBFile>>
PDBFileBuilder::build(
  std::unique_ptr<msf::WritableStream> PdbFileBuffer)
{
  ....
  auto File = llvm::make_unique<PDBFile>(
    std::move(PdbFileBuffer), Allocator);

  File->ContainerLayout = *ExpectedLayout;

  if (Info) {
    auto ExpectedInfo = Info->build(*File, *PdbFileBuffer);
  ....
}

The code is not clear to me, as I have not studied what llvm::make_unique is, and how it works in general. Nevertheless, both myself and the analyzer are confused by the fact that at first glance the possession of an object from a smart pointer PdbFileBuffer goes to File. After that we have dereferencing of a null pointer PdbFileBuffer that already contains nullptr

Identical errors can be found in some other places:

  • V522 Dereferencing of the null pointer 'PdbFileBuffer' might take place. PDBFileBuilder.cpp 113
  • V522 Dereferencing of the null pointer 'PdbFileBuffer' might take place. PDBFileBuilder.cpp 120
  • V522 Dereferencing of the null pointer 'PdbFileBuffer' might take place. PDBFileBuilder.cpp 127

FreeBSD Kernel

V522 Dereferencing of the null pointer 'ccb' might take place. The null pointer is passed into 'iscsi_outstanding_add' function. Inspect the third argument. Check lines: 'iscsi.c:2157'. iscsi.c 2091


static struct iscsi_outstanding *
iscsi_outstanding_add(struct iscsi_session *is,
                      struct icl_pdu *request,
                      union ccb *ccb,
                      uint32_t *initiator_task_tagp)
{
  struct iscsi_outstanding *io;
  int error;

  ISCSI_SESSION_LOCK_ASSERT(is);

  io = uma_zalloc(iscsi_outstanding_zone, M_NOWAIT | M_ZERO);
  if (io == NULL) {
    ISCSI_SESSION_WARN(is, "failed to allocate %zd bytes",
        sizeof(*io));
    return (NULL);
  }

  error = icl_conn_task_setup(is->is_conn, request, &ccb->csio,
    initiator_task_tagp, &io->io_icl_prv);
  ....
}

static void
iscsi_action_abort(struct iscsi_session *is, union ccb *ccb)
{
  ....
  io = iscsi_outstanding_add(is, request, NULL,
                             &initiator_task_tag);
  ....
}

CryEngine V

V522 Dereferencing of the null pointer 'pCEntity' might take place. BreakableManager.cpp 2396


int CBreakableManager::HandlePhysics_UpdateMeshEvent(....)
{
  CEntity* pCEntity = 0;
  ....
  if (pmu && pSrcStatObj && GetSurfaceType(pSrcStatObj))
  {
    ....
    if (pEffect)
    {
      ....
      if (normal.len2() > 0)
        pEffect->Spawn(true, pCEntity->GetSlotWorldTM(...); // <=
    }
  }

  ....

  if (iForeignData == PHYS_FOREIGN_ID_ENTITY)
  {
    pCEntity = (CEntity*)pForeignData;
    if (!pCEntity || !pCEntity->GetPhysicalProxy())
      return 1;
  }
  ....
}


Do you make errors in the code?

Check your code
with PVS-Studio

Static code analysis
for C, C++ and C#

goto PVS-Studio;