After having been compared to a NULL value
https://github.com/redis/redis/blob/ff2f0b092c24d5cc590ff1eb596fc0865e0fb721/src/redis-cli.c#L1205
pointer arg->token
is passed in call to function addHintForRepeatedArgument
https://github.com/redis/redis/blob/ff2f0b092c24d5cc590ff1eb596fc0865e0fb721/src/redis-cli.c#L1241
where it is dereferenced:
https://github.com/redis/redis/blob/ff2f0b092c24d5cc590ff1eb596fc0865e0fb721/src/redis-cli.c#L1166
(dereference inside function sdscat_orempty
)
https://github.com/redis/redis/blob/ff2f0b092c24d5cc590ff1eb596fc0865e0fb721/src/redis-cli.c#L513
Found by Linux Verification Center with SVACE
Comment From: sundb
@Anchels thx, can you reproduce this issue?
Comment From: Anchels
@sundb - This isn't an actual bug, but it does indicate a finding from the static analyzer that I believe is confirmed.
Comment From: sundb
@Anchels Static analysis tools can still produce false positives, and we still need to prove it correct in practice.