Fix 11784: FP arrayIndexOutOfBounds when increment is counted twice (#…

…5186)
danmar · Jun 24, 2023 · 60321ed · 60321ed
1 parent 6c750d9
commit 60321ed
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/lib/forwardanalyzer.cpp b/lib/forwardanalyzer.cpp
@@ -671,7 +671,8 @@ struct ForwardTraversal {
                             return Break();
                     } else {
                         Token* stepTok = getStepTok(tok);
-                        if (updateLoop(end, endBlock, condTok, initTok, stepTok) == Progress::Break)
+                        // Dont pass initTok since it was already evaluated
+                        if (updateLoop(end, endBlock, condTok, nullptr, stepTok) == Progress::Break)
                             return Break();
                     }
                     tok = endBlock;

diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
@@ -174,6 +174,7 @@ class TestBufferOverrun : public TestFixture {
         TEST_CASE(array_index_69); // #6370
         TEST_CASE(array_index_70); // #11355
         TEST_CASE(array_index_71); // #11461
+        TEST_CASE(array_index_72); // #11784
         TEST_CASE(array_index_multidim);
         TEST_CASE(array_index_switch_in_for);
         TEST_CASE(array_index_for_in_for);   // FP: #2634
@@ -1924,6 +1925,21 @@ class TestBufferOverrun : public TestFixture {
         ASSERT_EQUALS("", errout.str());
     }
 
+    // #11784
+    void array_index_72()
+    {
+        check("char f(int i) {\n"
+              "  char d[4] = {};\n"
+              "  for (; i < 3; i++) {}\n"
+              "  for (i++; i > 0;) {\n"
+              "    d[--i] = 1;\n"
+              "    break;\n"
+              "  }\n"
+              "  return d[3];\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void array_index_multidim() {
         check("void f()\n"
               "{\n"