fix PREFAST (windows static code analysis) warnings for null checking and hidden variables #3590