@kees @vathpela @gregkh In this specific case I feel like much of the analysis has already been carried out, see https://lwn.net/Articles/627419/ and https://lwn.net/Articles/723317/.
If we believe otherwise, that should be documented or discussed (like Jann's reply: https://mastodon.social/@jann@infosec.exchange/111995095738261114).
I'm fine admitting some wiggle room for borderline cases, but in this case the CVE description is literally "this can't actually fail" and "adding a check ... makes the static checkers happy".
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.