Fix #11801 False Positive warning for possible null pointer access in…

…side if that checks for null pointer
chrchr-github · Jul 15, 2023 · 02f7818 · 02f7818
1 parent 9ad18f5
commit 02f7818
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
@@ -5621,8 +5621,13 @@ static void valueFlowForwardConst(Token* start,
         throw InternalError(var->nameToken(), "valueFlowForwardConst: start token does not precede the end token.");
     for (Token* tok = start; tok != end; tok = tok->next()) {
         if (tok->varId() == var->declarationId()) {
-            for (const ValueFlow::Value& value : values)
+            for (const ValueFlow::Value& value : values) {
+                if (std::any_of(tok->values().begin(), tok->values().end(), [&value](const ValueFlow::Value& v) {
+                    return v.isImpossible() && v.condition && v.valueType == ValueFlow::Value::ValueType::INT && v.valueType == value.valueType;
+                }))
+                    continue;
                 setTokenValue(tok, value, settings);
+            }
         } else {
             [&] {
                 // Follow references

diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
@@ -142,6 +142,7 @@ class TestNullPointer : public TestFixture {
         TEST_CASE(nullpointer99); // #10602
         TEST_CASE(nullpointer100);        // #11636
         TEST_CASE(nullpointer101);        // #11382
+        TEST_CASE(nullpointer102);
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -2852,6 +2853,17 @@ class TestNullPointer : public TestFixture {
         ASSERT_EQUALS("", errout.str());
     }
 
+    void nullpointer102() // #11801
+    {
+        check("int* g() { return nullptr; }\n"
+              "void h() {\n"
+              "    int* const p = g();\n"
+              "    if (p)\n"
+              "        *p = 0;\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"