[ajanuary]

From my experience with static analysis tools it's very easy to write perfectly valid code that the tool doesn't like, so it wouldn't surprise me too much.

Of course, the argument can often be made that if it isn't clear enough for the tool to find, it's not clear enough for a person to understand quickly.

[phazmatis]

So you refactor until the noise goes away. Why throw out the signal with the noise? Modern software engineering theory 101.

[ajanuary]

I absolutely agree it would be beneficial for static analysis tools to regularly be run on openssl.

My stance (which I made clearer elsewhere in the thread) is more along the lines of: if it's not being done by the core maintainers, but just by concerned third parties, it's very easy to lose the signal in noise you don't have the ability to refactor away (because of time, difficulty getting it merged upstream etc.)

So I'm not surprised that given the context it was missed by people running static analysis over it. That context is wrong, and it should have changed a long time ago, but under that context I can see it getting missed [1].

[1] By interpreting static analysis results, not necessarily by the code author and reviewer.