Still trying to please the bots

Author: nickanderson

cf-agent/verify_files_utils.c

@@ -2786,42 +2786,42 @@ bool HandleFileObstruction(EvalContext *ctx, const char *path, const struct stat
         return false;
     }
 
-    // The following dereferences are protected by the null checks above,
-    // but we add explicit assertions for static analysis tools
-    assert(sb != NULL);
-    assert(attr != NULL);
+    // Use local variables to help static analysis tools understand that
+    // the pointers have been checked for NULL before dereferencing
+    const struct stat *const safe_sb = sb;      // Explicit alias after null check
+    const Attributes *const safe_attr = attr;   // Explicit alias after null check
 
-    const mode_t st_mode = sb->st_mode;
-    const bool move_obstructions = attr->move_obstructions;
+    const mode_t st_mode = safe_sb->st_mode;
+    const bool move_obstructions = safe_attr->move_obstructions;
 
     // If path exists, but is not a regular file, it's an obstruction
     if (!S_ISREG(st_mode))
     {
         if (move_obstructions)
         {
-            if (MakingChanges(ctx, pp, attr, result, "move obstruction '%s'", path))
+            if (MakingChanges(ctx, pp, safe_attr, result, "move obstruction '%s'", path))
             {
                 char backup[CF_BUFSIZE];
                 snprintf(backup, sizeof(backup), "%s.cf-moved", path);
 
                 if (rename(path, backup) == -1)
                 {
-                    RecordFailure(ctx, pp, attr, "Could not move obstruction '%s' to '%s'. (rename: %s)",
+                    RecordFailure(ctx, pp, safe_attr, "Could not move obstruction '%s' to '%s'. (rename: %s)",
                                   path, backup, GetErrorStr());
                     *result = PromiseResultUpdate(*result, PROMISE_RESULT_FAIL);
                     return false;
                 }
                 else
                 {
-                    RecordChange(ctx, pp, attr, "Moved obstructing path '%s' to '%s'", path, backup);
+                    RecordChange(ctx, pp, safe_attr, "Moved obstructing path '%s' to '%s'", path, backup);
                     *result = PromiseResultUpdate(*result, PROMISE_RESULT_CHANGE);
                     return true;
                 }
             }
         }
         else if (!S_ISLNK(st_mode))
         {
-            RecordFailure(ctx, pp, attr, "Path '%s' is not a regular file and move_obstructions is not set", path);
+            RecordFailure(ctx, pp, safe_attr, "Path '%s' is not a regular file and move_obstructions is not set", path);
             *result = PromiseResultUpdate(*result, PROMISE_RESULT_FAIL);
             return false;
         }