#11805 FP uninitvar for stringstream into deref pointer to uninit var

chrchr-github · Aug 11, 2023 · 6ad5538 · 6ad5538
1 parent 23deadb
commit 6ad5538
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/lib/astutils.cpp b/lib/astutils.cpp
@@ -3142,11 +3142,14 @@ ExprUsage getExprUsage(const Token* tok, int indirect, const Settings* settings)
             return getExprUsage(tok->astParent()->astParent(), indirect, settings);
     }
     if (indirect == 0) {
-        if (Token::Match(tok->astParent(), "%cop%|%assign%|++|--") && !Token::simpleMatch(tok->astParent(), "=") &&
+        if (Token::Match(tok->astParent(), "%cop%|%assign%|++|--") && !Token::Match(tok->astParent(), "=|>>") &&
             !tok->astParent()->isUnaryOp("&"))
             return ExprUsage::Used;
-        if (Token::simpleMatch(tok->astParent(), "=") && astIsRHS(tok))
+        if (Token::simpleMatch(tok->astParent(), "=") && astIsRHS(tok)) {
+            if (tok->astParent()->astOperand1() && tok->astParent()->astOperand1()->variable() && tok->astParent()->astOperand1()->variable()->isReference())
+                return ExprUsage::NotUsed;
             return ExprUsage::Used;
+        }
         // Function call or index
         if (((Token::simpleMatch(tok->astParent(), "(") && !tok->astParent()->isCast()) || (Token::simpleMatch(tok->astParent(), "[") && tok->valueType())) &&
             (astIsLHS(tok) || Token::simpleMatch(tok->astParent(), "( )")))

diff --git a/test/testuninitvar.cpp b/test/testuninitvar.cpp
@@ -6127,6 +6127,18 @@ class TestUninitVar : public TestFixture {
                         "  int *q = 1 ? &y : 0;\n"
                         "}\n");
         ASSERT_EQUALS("", errout.str());
+
+        valueFlowUninit("void f(std::stringstream& ss) {\n" // #11805
+                        "    int x;\n"
+                        "    int* p = &x;\n"
+                        "    ss >> *p;\n"
+                        "}\n"
+                        "void g() {\n"
+                        "    int x;\n"
+                        "    int* p = &x;\n"
+                        "    int& r = *p;\n"
+                        "}\n");
+        ASSERT_EQUALS("", errout.str());
     }
 
     void valueFlowUninitBreak() { // Do not show duplicate warnings about the same uninitialized value