Author: Julia Lawall <julia@diku.dk> If the NULL test on buf is needed, then the dereference should be after the NULL test. A simplified version of the semantic match that detects this problem is as follows (http://coccinelle.lip6.fr/): // @match exists@ expression x, E; identifier fld; @@ * x->fld … when != \(x = E\|&x\) * x …