Fix nullability annotations for zix_canonical_path() and friends

These functions can (and likely will) fail due to filesystem operations
failing, rather than a (rare) failed allocation, so they should be nullable so
clang can find potential null dereferences.

1 files changed, 2 insertions, 2 deletions

diff --git a/include/zix/filesystem.h b/include/zix/filesystem.h
index e07b579..9abafe1 100644
--- a/include/zix/filesystem.h
+++ b/include/zix/filesystem.h
@@ -147,7 +147,7 @@ zix_create_directory_symlink(const char* ZIX_NONNULL target_path,
    @return The path of the created directory, or null.
 */
 ZIX_API
-char* ZIX_ALLOCATED
+char* ZIX_NULLABLE
 zix_create_temporary_directory(ZixAllocator* ZIX_NULLABLE allocator,
                                const char* ZIX_NONNULL    path_pattern);
 
@@ -228,7 +228,7 @@ zix_file_equals(ZixAllocator* ZIX_NULLABLE allocator,
    @return A new canonical version of `path`, or null if it doesn't exist.
 */
 ZIX_API
-char* ZIX_ALLOCATED
+char* ZIX_NULLABLE
 zix_canonical_path(ZixAllocator* ZIX_NULLABLE allocator,
                    const char* ZIX_NULLABLE   path);