Fix #11845 FP variableScope if buffer is passed to a conditionally ca…

…lled function
chrchr-github · Jul 26, 2023 · 8a35c40 · 8a35c40
1 parent d2546d5
commit 8a35c40
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 1 deletion.
diff --git a/lib/checkother.cpp b/lib/checkother.cpp
@@ -1071,6 +1071,20 @@ bool CheckOther::checkInnerScope(const Token *tok, const Variable* var, bool& us
                 if (scope->bodyStart && scope->bodyStart->isSimplifiedScope())
                     return false; // simplified if/for/switch init statement
             }
+            if (var->isArrayOrPointer()) {
+                const Token* parent = tok->astParent();
+                while (parent && parent->isArithmeticalOp())
+                    parent = parent->astParent();
+                while (Token::simpleMatch(parent, ","))
+                    parent = parent->astParent();
+                if (parent && Token::Match(parent->previous(), "%name% (")) { // var passed to function?
+                    if (parent->previous()->function() && Function::returnsPointer(parent->previous()->function()))
+                        return false;
+                    const std::string ret = mSettings->library.returnValueType(parent->previous()); // assume that var is returned
+                    if (!ret.empty() && ret.back() == '*')
+                        return false;
+                }
+            }
         }
     }
 

diff --git a/lib/checkother.h b/lib/checkother.h
@@ -123,7 +123,7 @@ class CPPCHECKLIB CheckOther : public Check {
 
     /** @brief %Check scope of variables */
     void checkVariableScope();
-    static bool checkInnerScope(const Token *tok, const Variable* var, bool& used);
+    bool checkInnerScope(const Token *tok, const Variable* var, bool& used);
 
     /** @brief %Check for comma separated statements in return */
     void checkCommaSeparatedReturn();

diff --git a/test/testother.cpp b/test/testother.cpp
@@ -106,6 +106,7 @@ class TestOther : public TestFixture {
         TEST_CASE(varScope32);      // #11441
         TEST_CASE(varScope33);
         TEST_CASE(varScope34);
+        TEST_CASE(varScope35);
 
         TEST_CASE(oldStylePointerCast);
         TEST_CASE(invalidPointerCast);
@@ -1636,6 +1637,27 @@ class TestOther : public TestFixture {
         ASSERT_EQUALS("", errout.str());
     }
 
+    void varScope35() { // #11845
+        check("void f(int err, const char* src) {\n"
+              "    const char* msg = \"Success\";\n"
+              "    char buf[42];\n"
+              "    if (err != 0)\n"
+              "        msg = strcpy(buf, src);\n"
+              "    printf(\"%d: %s\\n\", err, msg);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+
+        check("char* g(char* dst, const char* src);\n"
+              "void f(int err, const char* src) {\n"
+              "    const char* msg = \"Success\";\n"
+              "    char buf[42];\n"
+              "    if (err != 0)\n"
+              "        msg = g(buf, src);\n"
+              "    printf(\"%d: %s\\n\", err, msg);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
 #define checkOldStylePointerCast(code) checkOldStylePointerCast_(code, __FILE__, __LINE__)
     void checkOldStylePointerCast_(const char code[], const char* file, int line) {
         // Clear the error buffer..