> Is avoiding transforming the case where E is not verified to be a pointer a concern? I imagine that answers to this question have got consequences also on the confidence level for such SmPL scripts. The desire and requirement to specify data type restrictions (for expressions) can influence data processing efforts in significant ways. * If it would be accepted to choose a simpler source code search approach, there are corresponding risks to consider. * If you would like to reduce the general possibility for false positives according to advanced software analysis, the amount of data processing will increase because information from header files will probably be needed. The run time characteristics will become more interesting then. Additional program execution parameters will be relevant for this use case. Regards, Markus
