From 866619c7f2ecd49ac555b4f3da4b6f81c1b83b51 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Sun, 10 Mar 2024 18:10:44 +0100
Subject: [PATCH] Fix #12498 FP memleak with getline() and array (#6108)

---
 cfg/posix.cfg            | 2 +-
 lib/checkleakautovar.cpp | 3 ++-
 test/cfg/posix.c         | 9 +++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index 1a90eea0963..24dc3656af4 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -5237,7 +5237,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <arg nr="2" direction="inout">
       <not-null/>
     </arg>
-    <arg nr="3" direction="in">
+    <arg nr="3" direction="inout">
       <not-null/>
       <not-uninit/>
     </arg>
diff --git a/lib/checkleakautovar.cpp b/lib/checkleakautovar.cpp
index 267a4c313b3..d8dc628d2de 100644
--- a/lib/checkleakautovar.cpp
+++ b/lib/checkleakautovar.cpp
@@ -985,7 +985,8 @@ void CheckLeakAutoVar::functionCall(const Token *tokName, const Token *tokOpenin
         while (Token::Match(arg, "%name% .|:: %name%"))
             arg = arg->tokAt(2);
 
-        if (Token::Match(arg, "%var% [-,)] !!.") || Token::Match(arg, "& %var% !!.")) {
+        if ((Token::Match(arg, "%var% [-,)] !!.") && !(arg->variable() && arg->variable()->isArray())) ||
+            (Token::Match(arg, "& %var% !!.") && !(arg->next()->variable() && arg->next()->variable()->isArray()))) {
             // goto variable
             const bool isAddressOf = arg->str() == "&";
             if (isAddressOf)
diff --git a/test/cfg/posix.c b/test/cfg/posix.c
index 869e9c4a996..0420cf5e131 100644
--- a/test/cfg/posix.c
+++ b/test/cfg/posix.c
@@ -1070,6 +1070,15 @@ void memleak_getline() { // #11043
     line = NULL;
 }
 
+void memleak_getline_array(FILE* stream) { // #12498
+    char* a[2] = { 0 };
+    size_t n;
+    getline(&a[0], &n, stream);
+    getline(&a[1], &n, stream);
+    free(a[0]);
+    free(a[1]);
+}
+
 void * identicalCondition_mmap(int fd, size_t size) // #9940
 {
     void* buffer = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);