cppcheck/lib/checkmemoryleak.cpp

/*
 * Cppcheck - A tool for static C/C++ code analysis
 * Copyright (C) 2007-2010 Daniel Marjamäki and Cppcheck team.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */


#include "checkmemoryleak.h"
#include "mathlib.h"
#include "tokenize.h"
#include "executionpath.h"

#include <algorithm>
#include <cstring>
#include <cstdlib>
#include <iostream>
#include <sstream>
#include <set>
#include <stack>

//---------------------------------------------------------------------------

// Register this check class (by creating a static instance of it)
namespace
{
CheckMemoryLeakInFunction instance1;
CheckMemoryLeakInClass instance2;
CheckMemoryLeakStructMember instance3;
CheckMemoryLeakNoVar instance4;
}


// This list needs to be alphabetically sorted so we can run bsearch on it
static const char * const call_func_white_list[] =
{
    "asctime", "asctime_r", "asprintf", "assert", "atof", "atoi", "atol", "clearerr"
    , "ctime", "ctime_r", "delete", "fchmod", "fclose", "fcntl"
    , "fdatasync", "feof", "ferror", "fflush", "fgetc", "fgetpos", "fgets"
    , "flock", "for", "fprintf", "fputc", "fputs", "fread", "free", "fscanf", "fseek"
    , "fseeko", "fsetpos", "fstat", "fsync", "ftell", "ftello", "ftruncate"
    , "fwrite", "getc", "gets", "gmtime", "gmtime_r", "if", "ioctl"
    , "localtime", "localtime_r"
    , "lockf", "lseek", "memchr", "memcmp", "memcpy", "memmove", "memset"
    , "posix_fadvise", "posix_fallocate", "pread"
    , "printf", "puts", "pwrite", "qsort", "read", "readahead", "readdir", "readdir_r", "readv"
    , "realloc", "return", "rewind", "rewinddir", "scandir", "scanf", "seekdir"
    , "setbuf", "setbuffer", "setlinebuf", "setvbuf", "snprintf", "sprintf", "sscanf", "strcasecmp"
    , "strcat", "strchr", "strcmp", "strcpy", "stricmp", "strlen", "strncat", "strncmp"
    , "strncpy", "strrchr", "strstr", "strtod", "strtol", "strtoul", "switch"
    , "sync_file_range", "telldir", "time", "typeid", "vfprintf", "vprintf"
    , "vsnprintf", "vsprintf", "while", "write", "writev"
};

static int call_func_white_list_compare(const void *a, const void *b)
{
    return strcmp((const char *)a, *(const char **)b);
}

//---------------------------------------------------------------------------

bool CheckMemoryLeak::isclass(const Tokenizer *_tokenizer, const Token *tok) const
{
    if (tok->isStandardType())
        return false;

    std::ostringstream pattern;
    pattern << "struct " << tok->str();
    if (Token::findmatch(_tokenizer->tokens(), pattern.str().c_str()))
        return false;

    return true;
}
//---------------------------------------------------------------------------

CheckMemoryLeak::AllocType CheckMemoryLeak::getAllocationType(const Token *tok2, unsigned int varid) const
{
    // What we may have...
    //     * var = (char *)malloc(10);
    //     * var = new char[10];
    //     * var = strdup("hello");
    //     * var = strndup("hello", 3);
    if (tok2 && tok2->str() == "(")
    {
        tok2 = tok2->link();
        tok2 = tok2 ? tok2->next() : NULL;
    }
    if (! tok2)
        return No;
    if (! tok2->isName())
        return No;

    // Does tok2 point on "malloc", "strdup" or "kmalloc"..
    static const char * const mallocfunc[] = {"malloc",
            "calloc",
            "strdup",
            "strndup",
            "kmalloc",
            "kzalloc",
            "kcalloc",
            0
                                             };
    for (unsigned int i = 0; mallocfunc[i]; i++)
    {
        if (tok2->str() == mallocfunc[i])
            return Malloc;
    }

    // Using realloc..
    if (varid && Token::Match(tok2, "realloc ( %any% ,") && tok2->tokAt(2)->varId() != varid)
        return Malloc;

    // Does tok2 point on "g_malloc", "g_strdup", ..
    static const char * const gmallocfunc[] = {"g_new",
            "g_new0",
            "g_try_new",
            "g_try_new0",
            "g_malloc",
            "g_malloc0",
            "g_try_malloc",
            "g_try_malloc0",
            "g_strdup",
            "g_strndup",
            "g_strdup_printf",
            0
                                              };
    for (unsigned int i = 0; gmallocfunc[i]; i++)
    {
        if (tok2->str() == gmallocfunc[i])
            return gMalloc;
    }

    if (Token::Match(tok2, "new %type% [;()]") ||
        Token::Match(tok2, "new ( std :: nothrow ) %type% [;()]") ||
        Token::Match(tok2, "new ( nothrow ) %type% [;()]"))
        return New;

    if (Token::Match(tok2, "new %type% [") ||
        Token::Match(tok2, "new ( std :: nothrow ) %type% [") ||
        Token::Match(tok2, "new ( nothrow ) %type% ["))
        return NewArray;

    if (Token::Match(tok2, "fopen|tmpfile|g_fopen ("))
        return File;

    if (Token::Match(tok2, "open|openat|creat|mkstemp|mkostemp ("))
    {
        // is there a user function with this name?
        if (tokenizer && Token::findmatch(tokenizer->tokens(), ("%type% *|&| " + tok2->str()).c_str()))
            return No;
        return Fd;
    }

    if (Token::simpleMatch(tok2, "popen ("))
        return Pipe;

    if (Token::Match(tok2, "opendir|fdopendir ("))
        return Dir;

    return No;
}




CheckMemoryLeak::AllocType CheckMemoryLeak::getReallocationType(const Token *tok2, unsigned int varid) const
{
    // What we may have...
    //     * var = (char *)realloc(..;
    if (tok2 && tok2->str() == "(")
    {
        tok2 = tok2->link();
        tok2 = tok2 ? tok2->next() : NULL;
    }
    if (! tok2)
        return No;

    if (varid > 0 && ! Token::Match(tok2, "%var% ( %varid% [,)]", varid))
        return No;

    if (tok2->str() == "realloc")
        return Malloc;

    // GTK memory reallocation..
    if (Token::Match(tok2, "g_realloc|g_try_realloc|g_renew|g_try_renew"))
        return gMalloc;

    return No;
}


CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, unsigned int varid) const
{
    if (Token::Match(tok, "delete %varid% ;", varid))
        return New;

    if (Token::Match(tok, "delete [ ] %varid% ;", varid))
        return NewArray;

    if (Token::Match(tok, "delete ( %varid% ) ;", varid))
        return New;

    if (Token::Match(tok, "delete [ ] ( %varid% ) ;", varid))
        return NewArray;

    if (Token::Match(tok, "free|kfree ( %varid% ) ;", varid) ||
        Token::Match(tok, "free|kfree ( %varid% -", varid))
        return Malloc;

    if (Token::Match(tok, "g_free ( %varid% ) ;", varid) ||
        Token::Match(tok, "g_free ( %varid% -", varid))
        return gMalloc;

    if (Token::Match(tok, "fclose ( %varid% )", varid) ||
        Token::Match(tok, "fcloseall ( )"))
        return File;

    if (Token::Match(tok, "close ( %varid% )", varid))
        return Fd;

    if (Token::Match(tok, "pclose ( %varid% )", varid))
        return Pipe;

    if (Token::Match(tok, "closedir ( %varid% )", varid))
        return Dir;

    return No;
}

CheckMemoryLeak::AllocType CheckMemoryLeak::getDeallocationType(const Token *tok, const std::string &varname) const
{
    if (Token::simpleMatch(tok, std::string("delete " + varname + " ;").c_str()))
        return New;

    if (Token::simpleMatch(tok, std::string("delete [ ] " + varname + " ;").c_str()))
        return NewArray;

    if (Token::simpleMatch(tok, std::string("delete ( " + varname + " ) ;").c_str()))
        return New;

    if (Token::simpleMatch(tok, std::string("delete [ ] ( " + varname + " ) ;").c_str()))
        return NewArray;

    if (Token::simpleMatch(tok, std::string("free ( " + varname + " ) ;").c_str()) ||
        Token::simpleMatch(tok, std::string("kfree ( " + varname + " ) ;").c_str()))
        return Malloc;

    if (Token::simpleMatch(tok, std::string("g_free ( " + varname + " ) ;").c_str()))
        return gMalloc;

    if (Token::simpleMatch(tok, std::string("fclose ( " + varname + " )").c_str()) ||
        Token::simpleMatch(tok, "fcloseall ( )"))
        return File;

    if (Token::simpleMatch(tok, std::string("close ( " + varname + " )").c_str()))
        return Fd;

    if (Token::simpleMatch(tok, std::string("pclose ( " + varname + " )").c_str()))
        return Pipe;

    if (Token::simpleMatch(tok, std::string("closedir ( " + varname + " )").c_str()))
        return Dir;

    return No;
}

//--------------------------------------------------------------------------


//--------------------------------------------------------------------------

void CheckMemoryLeak::memoryLeak(const Token *tok, const std::string &varname, AllocType alloctype)
{
    if (alloctype == CheckMemoryLeak::File ||
        alloctype == CheckMemoryLeak::Pipe ||
        alloctype == CheckMemoryLeak::Fd   ||
        alloctype == CheckMemoryLeak::Dir)
        resourceLeakError(tok, varname.c_str());
    else
        memleakError(tok, varname.c_str());
}
//---------------------------------------------------------------------------


void CheckMemoryLeak::reportErr(const Token *tok, Severity::SeverityType severity, const std::string &id, const std::string &msg) const
{
    std::list<const Token *> callstack;

    if (tok)
        callstack.push_back(tok);

    reportErr(callstack, severity, id, msg);
}

void CheckMemoryLeak::reportErr(const std::list<const Token *> &callstack, Severity::SeverityType severity, const std::string &id, const std::string &msg) const
{
    std::list<ErrorLogger::ErrorMessage::FileLocation> locations;

    for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it)
    {
        const Token * const tok = *it;

        ErrorLogger::ErrorMessage::FileLocation loc;
        loc.line = tok->linenr();
        loc.setfile(tokenizer->file(tok));

        locations.push_back(loc);
    }

    const ErrorLogger::ErrorMessage errmsg(locations, severity, msg, id);

    if (errorLogger)
        errorLogger->reportErr(errmsg);
    else
        Check::reportError(errmsg);
}

void CheckMemoryLeak::memleakError(const Token *tok, const std::string &varname)
{
    reportErr(tok, Severity::error, "memleak", "Memory leak: " + varname);
}

void CheckMemoryLeak::memleakUponReallocFailureError(const Token *tok, const std::string &varname)
{
    reportErr(tok, Severity::error, "memleakOnRealloc", "Common realloc mistake: \"" + varname + "\" nulled but not freed upon failure");
}

void CheckMemoryLeak::resourceLeakError(const Token *tok, const std::string &varname)
{
    std::string errmsg("Resource leak");
    if (!varname.empty())
        errmsg += ": " + varname;
    reportErr(tok, Severity::error, "resourceLeak", errmsg);
}

void CheckMemoryLeak::deallocDeallocError(const Token *tok, const std::string &varname)
{
    reportErr(tok, Severity::error, "deallocDealloc", "Deallocating a deallocated pointer: " + varname);
}

void CheckMemoryLeak::deallocuseError(const Token *tok, const std::string &varname)
{
    reportErr(tok, Severity::error, "deallocuse", "Dereferencing '" + varname + "' after it is deallocated / released");
}

void CheckMemoryLeak::mismatchSizeError(const Token *tok, const std::string &sz)
{
    reportErr(tok, Severity::error, "mismatchSize", "The given size " + sz + " is mismatching");
}

void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &callstack, const std::string &varname)
{
    reportErr(callstack, Severity::error, "mismatchAllocDealloc", "Mismatching allocation and deallocation: " + varname);
}

CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok) const
{
    // Locate the start of the function..
    unsigned int parlevel = 0;
    while (tok)
    {
        if (tok->str() == "{" || tok->str() == "}")
            return No;

        if (tok->str() == "(")
        {
            if (parlevel != 0)
                return No;
            ++parlevel;
        }

        else if (tok->str() == ")")
        {
            if (parlevel != 1)
                return No;
            break;
        }

        tok = tok->next();
    }

    // Is this the start of a function?
    if (!Token::Match(tok, ") const| {"))
        return No;

    while (tok->str() != "{")
        tok = tok->next();

    // Get return pointer..
    unsigned int varid = 0;
    unsigned int indentlevel = 0;
    for (const Token *tok2 = tok; tok2; tok2 = tok2->next())
    {
        if (tok2->str() == "{")
            ++indentlevel;
        else if (tok2->str() == "}")
        {
            if (indentlevel <= 1)
                return No;
            --indentlevel;
        }
        if (Token::Match(tok2, "return %var% ;"))
        {
            if (indentlevel != 1)
                return No;
            varid = tok2->next()->varId();
            break;
        }
        else if (tok2->str() == "return")
        {
            AllocType allocType = getAllocationType(tok2->next(), 0);
            if (allocType != No)
                return allocType;
            allocType = getReallocationType(tok2->next(), 0);
            if (allocType != No)
                return allocType;
        }
    }

    // Not returning pointer value..
    if (varid == 0)
        return No;

    // Check if return pointer is allocated..
    AllocType allocType = No;
    while (0 != (tok = tok->next()))
    {
        if (Token::Match(tok, "%varid% =", varid))
        {
            allocType = getAllocationType(tok->tokAt(2), varid);
            if (allocType == No)
            {
                allocType = getReallocationType(tok->tokAt(2), varid);
            }
            if (allocType != No)
                return allocType;
        }
        if (tok->str() == "return")
            return allocType;
    }

    return No;
}


const char *CheckMemoryLeak::functionArgAlloc(const Token *tok, unsigned int targetpar, AllocType &allocType) const
{
    // Find the varid of targetpar, then locate the start of the function..
    unsigned int parlevel = 0;
    unsigned int par = 0;
    unsigned int varid = 0;

    allocType = No;

    while (tok)
    {
        if (tok->str() == "{" || tok->str() == "}")
            return "";

        if (tok->str() == "(")
        {
            if (parlevel != 0)
                return "";
            ++parlevel;
            ++par;
        }

        else if (tok->str() == ")")
        {
            if (parlevel != 1)
                return "";
            break;
        }

        else if (parlevel == 1 && tok->str() == ",")
        {
            ++par;
        }

        tok = tok->next();

        if (parlevel == 1 && par == targetpar && Token::Match(tok, "%type% * * %var%"))
        {
            varid = tok->tokAt(3)->varId();
        }
    }

    if (varid == 0)
        return "";

    // Is this the start of a function?
    if (!Token::Match(tok, ") const| {"))
        return "";

    while (tok->str() != "{")
        tok = tok->next();

    // Check if pointer is allocated.
    unsigned int indentlevel = 0;
    int realloc = 0;
    while (0 != (tok = tok->next()))
    {
        if (tok->str() == "{")
            ++indentlevel;
        else if (tok->str() == "}")
        {
            if (indentlevel <= 1)
                break;
            --indentlevel;
        }
        else if (tok->varId() == varid)
        {
            if (Token::Match(tok->tokAt(-3), "free ( * %varid% )", varid))
            {
                realloc = 1;
                allocType = No;
            }
            else if (Token::Match(tok->previous(), "* %varid% =", varid))
            {
                allocType = getAllocationType(tok->tokAt(2), varid);
                if (allocType == No)
                {
                    allocType = getReallocationType(tok->tokAt(2), varid);
                }
                if (allocType != No)
                {
                    if (realloc)
                        return "realloc";
                    return "alloc";
                }
            }
            else
            {
                // unhandled variable usage: bailout
                return "";
            }
        }
    }

    return "";
}


void CheckMemoryLeakInFunction::parse_noreturn()
{
    noreturn.insert("exit");
    noreturn.insert("_exit");
    noreturn.insert("_Exit");
    noreturn.insert("abort");
    noreturn.insert("err");
    noreturn.insert("verr");
    noreturn.insert("errx");
    noreturn.insert("verrx");

    std::list<SymbolDatabase::SpaceInfo *>::const_iterator i;

    for (i = symbolDatabase->spaceInfoList.begin(); i != symbolDatabase->spaceInfoList.end(); ++i)
    {
        SymbolDatabase::SpaceInfo *info = *i;

        // only check functions
        if (info->type != SymbolDatabase::SpaceInfo::Function)
            continue;

        // parse this function to check if it contains an "exit" call..
        unsigned int indentlevel = 1;
        for (const Token *tok2 = info->classStart->next(); tok2; tok2 = tok2->next())
        {
            if (tok2->str() == "{")
                ++indentlevel;
            else if (tok2->str() == "}")
            {
                --indentlevel;
                if (indentlevel == 0)
                    break;
            }
            if (Token::Match(tok2, "[;{}] exit ("))
            {
                noreturn.insert(info->className);
                break;
            }
        }
    }
}


bool CheckMemoryLeakInFunction::matchFunctionsThatReturnArg(const Token *tok, unsigned int varid) const
{
    return Token::Match(tok, "; %varid% = strcat|memcpy|memmove|strcpy ( %varid% ,", varid);
}


bool CheckMemoryLeakInFunction::notvar(const Token *tok, unsigned int varid, bool endpar) const
{
    const std::string end(endpar ? " &&|)" : " [;)&|]");
    return bool(Token::Match(tok, ("! %varid%" + end).c_str(), varid) ||
                Token::Match(tok, ("! ( %varid% )" + end).c_str(), varid));
}


static int countParameters(const Token *tok)
{
    if (!Token::Match(tok, "%var% ("))
        return -1;
    if (Token::Match(tok->tokAt(2), "void| )"))
        return 0;

    int numpar = 1;
    int parlevel = 0;
    for (; tok; tok = tok->next())
    {
        if (tok->str() == "(")
            ++parlevel;

        else if (tok->str() == ")")
        {
            if (parlevel <= 1)
                return numpar;
            --parlevel;
        }

        else if (parlevel == 1 && tok->str() == ",")
        {
            ++numpar;
        }
    }

    return -1;
}

bool CheckMemoryLeakInFunction::test_white_list(const std::string &funcname)
{
    return (std::bsearch(funcname.c_str(), call_func_white_list,
                         sizeof(call_func_white_list) / sizeof(call_func_white_list[0]),
                         sizeof(call_func_white_list[0]), call_func_white_list_compare) != NULL);
}

const char * CheckMemoryLeakInFunction::call_func(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, AllocType &alloctype, AllocType &dealloctype, bool &allocpar, unsigned int sz)
{
    if (test_white_list(tok->str()))
    {
        if (tok->str() == "asprintf" ||
            tok->str() == "delete" ||
            tok->str() == "fclose" ||
            tok->str() == "for" ||
            tok->str() == "free" ||
            tok->str() == "if" ||
            tok->str() == "realloc" ||
            tok->str() == "return" ||
            tok->str() == "switch" ||
            tok->str() == "while")
        {
            return 0;
        }

        // is the varid a parameter?
        for (const Token *tok2 = tok->tokAt(2); tok2; tok2 = tok2->next())
        {
            if (tok2->str() == "(" || tok2->str() == ")")
                break;
            if (tok2->varId() == varid)
                return "use_";
        }

        return 0;
    }

    if (noreturn.find(tok->str()) != noreturn.end())
        return "exit";

    if (varid > 0 && (getAllocationType(tok, varid) != No || getReallocationType(tok, varid) != No || getDeallocationType(tok, varid) != No))
        return 0;

    if (callstack.size() > 2)
        return "dealloc_";

    const std::string funcname(tok->str());
    for (std::list<const Token *>::const_iterator it = callstack.begin(); it != callstack.end(); ++it)
    {
        if ((*it) && (*it)->str() == funcname)
            return "recursive";
    }
    callstack.push_back(tok);

    // lock/unlock..
    if (varid == 0)
    {
        const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());
        while (ftok && (ftok->str() != "{"))
            ftok = ftok->next();
        if (!ftok)
            return 0;

        Token *func = getcode(ftok->tokAt(1), callstack, 0, alloctype, dealloctype, false, 1);
        simplifycode(func);
        const char *ret = 0;
        if (Token::simpleMatch(func, "; alloc ; }"))
            ret = "alloc";
        else if (Token::simpleMatch(func, "; dealloc ; }"))
            ret = "dealloc";
        Tokenizer::deleteTokens(func);
        return ret;
    }

    // Check if this is a function that allocates memory..
    if (Token::Match(tok->tokAt(-3), "[;{}] %varid% = %var% (", varid))
    {
        const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());
        AllocType a = functionReturnType(ftok);
        if (a != No)
        {
            if (alloctype == No)
                alloctype = a;
            else if (alloctype != a)
                alloctype = Many;
            return "alloc";
        }
    }

    // how many parameters is there in the function call?
    int numpar = countParameters(tok);
    if (numpar <= 0)
        return "callfunc";

    unsigned int par = 1;
    unsigned int parlevel = 0;

    const bool dot(tok->previous()->str() == ".");

    for (; tok; tok = tok->next())
    {
        if (tok->str() == "(")
            ++parlevel;
        else if (tok->str() == ")")
        {
            --parlevel;
            if (parlevel < 1)
            {
                return (_settings->inconclusive) ? 0 : "callfunc";
            }
        }

        if (parlevel == 1)
        {
            if (tok->str() == ",")
                ++par;
            if (varid > 0 && Token::Match(tok, "[,()] %varid% [,()]", varid))
            {
                if (dot)
                    return "use";

                const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());
                if (!ftok)
                    return "use";

                // how many parameters does the function want?
                if (numpar != countParameters(ftok))
                    return "recursive";

                const char *parname = Tokenizer::getParameterName(ftok, par);
                if (! parname)
                    return "recursive";
                unsigned int parameterVarid = 0;
                {
                    const Token *partok = Token::findmatch(ftok, parname);
                    if (partok)
                        parameterVarid = partok->varId();
                }
                if (parameterVarid == 0)
                    return "recursive";
                // Check if the function deallocates the variable..
                while (ftok && (ftok->str() != "{"))
                    ftok = ftok->next();
                Token *func = getcode(ftok->tokAt(1), callstack, parameterVarid, alloctype, dealloctype, false, sz);
                //simplifycode(func, all);
                const Token *func_ = func;
                while (func_ && func_->str() == ";")
                    func_ = func_->next();

                const char *ret = 0;
                /** @todo handle "goto" */
                if (Token::findmatch(func_, "dealloc"))
                    ret = "dealloc";
                else if (Token::findmatch(func_, "use"))
                    ret = "use";
                else if (Token::findmatch(func_, "&use"))
                    ret = "&use";

                Tokenizer::deleteTokens(func);
                return ret;
            }
            if (varid > 0 && Token::Match(tok, "[,()] & %varid% [,()]", varid))
            {
                const Token *ftok = _tokenizer->getFunctionTokenByName(funcname.c_str());
                AllocType a;
                const char *ret = functionArgAlloc(ftok, par, a);

                if (a != No)
                {
                    if (alloctype == No)
                        alloctype = a;
                    else if (alloctype != a)
                        alloctype = Many;
                    allocpar = true;
                    return ret;
                }
            }
        }
    }
    return NULL;
}


static void addtoken(Token **rettail, const Token *tok, const std::string &str)
{
    (*rettail)->insertToken(str);
    (*rettail) = (*rettail)->next();
    (*rettail)->linenr(tok->linenr());
    (*rettail)->fileIndex(tok->fileIndex());
}


Token *CheckMemoryLeakInFunction::getcode(const Token *tok, std::list<const Token *> callstack, const unsigned int varid, CheckMemoryLeak::AllocType &alloctype, CheckMemoryLeak::AllocType &dealloctype, bool classmember, unsigned int sz)
{
    Token *rethead = 0, *rettail = 0;

    // The first token should be ";"
    rethead = new Token(0);
    rethead->str(";");
    rethead->linenr(tok->linenr());
    rethead->fileIndex(tok->fileIndex());
    rettail = rethead;

    bool isloop = false;

    int indentlevel = 0;
    int parlevel = 0;
    for (; tok; tok = tok->next())
    {
        if (tok->str() == "{")
        {
            addtoken(&rettail, tok, "{");
            ++indentlevel;
        }
        else if (tok->str() == "}")
        {
            addtoken(&rettail, tok, "}");
            if (indentlevel <= 0)
                break;
            --indentlevel;
        }

        if (tok->str() == "(")
            ++parlevel;
        else if (tok->str() == ")")
            --parlevel;
        isloop &= (parlevel > 0);

        if (parlevel == 0 && tok->str() == ";")
            addtoken(&rettail, tok, ";");

        if (varid == 0)
        {
            if (!callstack.empty() && Token::Match(tok, "[;{}] __cppcheck_lock|__cppcheck_unlock ( ) ;"))
            {
                // Type of leak = Resource leak
                alloctype = dealloctype = CheckMemoryLeak::File;

                if (tok->next()->str() == "__cppcheck_lock")
                {
                    addtoken(&rettail, tok, "alloc");
                }
                else
                {
                    addtoken(&rettail, tok, "dealloc");
                }

                tok = tok->tokAt(3);
                continue;
            }

            if (Token::simpleMatch(tok, "if ("))
            {
                addtoken(&rettail, tok, "if");
                tok = tok->next()->link();
                continue;
            }
        }
        else
        {
            // var = strcpy|.. ( var ,
            if (Token::Match(tok, "[;{}] %varid% = memcpy|memmove|memset|strcpy|strncpy|strcat|strncat ( %varid% ,", varid))
            {
                tok = tok->tokAt(4)->link();
                continue;
            }

            if (Token::Match(tok->previous(), "[(;{}] %varid% =", varid) ||
                Token::Match(tok, "asprintf ( & %varid% ,", varid))
            {
                CheckMemoryLeak::AllocType alloc;

                if (Token::simpleMatch(tok, "asprintf ("))
                {
                    // todo: check how the return value is used.
                    if (!Token::Match(tok->previous(), "[;{}]"))
                    {
                        Tokenizer::deleteTokens(rethead);
                        return 0;
                    }
                    alloc = Malloc;
                    tok = tok->next()->link();
                }
                else
                {
                    alloc = getAllocationType(tok->tokAt(2), varid);
                }
                bool realloc = false;

                if (sz > 1 &&
                    Token::Match(tok->tokAt(2), "malloc ( %num% )") &&
                    (MathLib::toLongNumber(tok->strAt(4)) % long(sz)) != 0)
                {
                    mismatchSizeError(tok->tokAt(4), tok->strAt(4));
                }

                if (alloc == CheckMemoryLeak::No)
                {
                    alloc = getReallocationType(tok->tokAt(2), varid);
                    if (alloc != CheckMemoryLeak::No)
                    {
                        addtoken(&rettail, tok, "realloc");
                        addtoken(&rettail, tok, ";");
                        realloc = true;
                        tok = tok->tokAt(2);
                        continue;
                    }
                }

                // don't check classes..
                if (alloc == CheckMemoryLeak::New)
                {
                    if (Token::Match(tok->tokAt(2), "new %type% [(;]"))
                    {
                        if (isclass(_tokenizer, tok->tokAt(3)))
                        {
                            alloc = No;
                        }
                    }
                    else if (Token::Match(tok->tokAt(2), "new ( nothrow ) %type%"))
                    {
                        if (isclass(_tokenizer, tok->tokAt(6)))
                        {
                            alloc = No;
                        }
                    }
                    else if (Token::Match(tok->tokAt(2), "new ( std :: nothrow ) %type%"))
                    {
                        if (isclass(_tokenizer, tok->tokAt(8)))
                        {
                            alloc = No;
                        }
                    }
                }

                if (alloc != No)
                {
                    if (! realloc)
                        addtoken(&rettail, tok, "alloc");

                    if (alloctype != No && alloctype != alloc)
                        alloc = Many;

                    if (alloc != Many && dealloctype != No && dealloctype != Many && dealloctype != alloc)
                    {
                        callstack.push_back(tok);
                        mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());
                        callstack.pop_back();
                    }

                    alloctype = alloc;

                    if (Token::Match(tok, "%var% = %type% ("))
                    {
                        tok = tok->tokAt(3)->link();
                        continue;
                    }
                }

                // assignment..
                else
                {
                    // is the pointer in rhs?
                    bool rhs = false;
                    for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next())
                    {
                        if (tok2->str() == ";")
                        {
                            if (rhs)
                                tok = tok2;
                            break;
                        }

                        if (Token::Match(tok2, "[=+] %varid%", varid))
                        {
                            rhs = true;
                        }
                    }

                    if (!rhs)
                        addtoken(&rettail, tok, "assign");
                    continue;
                }
            }

            if (Token::Match(tok->previous(), "[;{})=] %var%") ||
                Token::Match(tok->previous(), "| %var%"))
            {
                AllocType dealloc = getDeallocationType(tok, varid);

                if (dealloc != No && tok->str() == "fcloseall" && alloctype != dealloc)
                    dealloc = No;

                else if (dealloc != No)
                {
                    addtoken(&rettail, tok, "dealloc");

                    if (dealloctype != No && dealloctype != dealloc)
                        dealloc = Many;

                    if (dealloc != Many && alloctype != No && alloctype != Many && alloctype != dealloc)
                    {
                        callstack.push_back(tok);
                        mismatchAllocDealloc(callstack, Token::findmatch(_tokenizer->tokens(), "%varid%", varid)->str());
                        callstack.pop_back();
                    }
                    dealloctype = dealloc;
                    continue;
                }
            }

            // if else switch
            if (tok->str() == "if")
            {
                if (alloctype == Fd)
                {
                    if (Token::Match(tok, "if ( 0 <=|< %varid% )", varid) ||
                        Token::Match(tok, "if ( %varid% != -1 )", varid))
                    {
                        addtoken(&rettail, tok, "if(var)");
                        tok = tok->next()->link();
                        continue;
                    }
                    else if (Token::Match(tok, "if ( %varid% == -1 )", varid) ||
                             Token::Match(tok, "if ( %varid% < 0 )", varid))
                    {
                        addtoken(&rettail, tok, "if(!var)");
                        tok = tok->next()->link();
                        continue;
                    }
                }

                if (Token::Match(tok, "if ( %varid% )", varid))
                {
                    addtoken(&rettail, tok, "if(var)");

                    // Make sure the "use" will not be added
                    tok = tok->next()->link();
                }
                else if (Token::simpleMatch(tok, "if (") && notvar(tok->tokAt(2), varid, true))
                {
                    addtoken(&rettail, tok, "if(!var)");
                }
                else
                {
                    // Check if the condition depends on var somehow..
                    bool dep = false;
                    int innerParlevel = 0;
                    for (const Token *tok2 = tok; tok2; tok2 = tok2->next())
                    {
                        if (tok2->str() == "(")
                            ++innerParlevel;
                        if (tok2->str() == ")")
                        {
                            --innerParlevel;
                            if (innerParlevel <= 0)
                                break;
                        }
                        if (Token::Match(tok2, "close|pclose|fclose|closedir ( %varid% )", varid))
                        {
                            addtoken(&rettail, tok, "dealloc");
                            addtoken(&rettail, tok, ";");
                            dep = true;
                            break;
                        }
                        if (alloctype == Fd && Token::Match(tok2, "%varid% !=|>=", varid))
                        {
                            dep = true;
                        }
                        if (innerParlevel > 0 && Token::Match(tok2, "! %varid%", varid))
                        {
                            dep = true;
                            break;
                        }
                        if (innerParlevel > 0 && Token::Match(tok2, "%var% (") && !test_white_list(tok2->str()))
                        {
                            bool use = false;
                            for (const Token *tok3 = tok2->tokAt(2); tok3; tok3 = tok3->next())
                            {
                                if (tok3->str() == "(")
                                    tok3 = tok3->link();
                                else if (tok3->str() == ")")
                                    break;
                                else if (Token::Match(tok3->previous(), "(|, &| %varid% ,|)", varid))
                                {
                                    use = true;
                                    break;
                                }
                            }
                            if (use)
                            {
                                addtoken(&rettail, tok, "use");
                                addtoken(&rettail, tok, ";");
                                break;
                            }
                        }
                    }

                    if (Token::Match(tok, "if ( ! %varid% &&", varid))
                    {
                        addtoken(&rettail, tok, "if(!var)");
                    }
                    else if (tok->next() &&
                             tok->next()->link() &&
                             Token::Match(tok->next()->link()->tokAt(-3), "&& ! %varid%", varid))
                    {
                        addtoken(&rettail, tok, "if(!var)");
                    }
                    else
                    {
                        addtoken(&rettail, tok, (dep ? "ifv" : "if"));
                    }

                    tok = tok->next();
                    if (tok->link())
                        tok = tok->link();
                }
            }
        }

        if ((tok->str() == "else") || (tok->str() == "switch"))
        {
            addtoken(&rettail, tok, tok->str());
        }

        else if ((tok->str() == "case"))
        {
            addtoken(&rettail, tok, "case");
            addtoken(&rettail, tok, ";");
        }

        else if ((tok->str() == "default"))
        {
            addtoken(&rettail, tok, "default");
            addtoken(&rettail, tok, ";");
        }

        // Loops..
        else if ((tok->str() == "for") || (tok->str() == "while"))
        {
            isloop = true;

            if (Token::simpleMatch(tok, "while ( true )") ||
                Token::simpleMatch(tok, "for ( ; ; )"))
            {
                addtoken(&rettail, tok, "while1");
                tok = tok->next()->link();
                continue;
            }

            else if (varid && getDeallocationType(tok->tokAt(2), varid) != No)
            {
                addtoken(&rettail, tok, "dealloc");
                addtoken(&rettail, tok, ";");
            }

            else if (alloctype == Fd && varid)
            {
                if (Token::Match(tok, "while ( 0 <= %varid% )", varid) ||
                    Token::Match(tok, "while ( %varid% != -1 )", varid))
                {
                    addtoken(&rettail, tok, "while(var)");
                    tok = tok->next()->link();
                    continue;
                }
                else if (Token::Match(tok, "while ( %varid% == -1 )", varid) ||
                         Token::Match(tok, "while ( %varid% < 0 )", varid))
                {
                    addtoken(&rettail, tok, "while(!var)");
                    tok = tok->next()->link();
                    continue;
                }
            }

            else if (varid && Token::Match(tok, "while ( %varid% )", varid))
            {
                addtoken(&rettail, tok, "while(var)");
                tok = tok->next()->link();
                continue;
            }
            else if (varid && Token::simpleMatch(tok, "while (") && notvar(tok->tokAt(2), varid, true))
            {
                addtoken(&rettail, tok, "while(!var)");
                tok = tok->next()->link();
                continue;
            }

            addtoken(&rettail, tok, "loop");
        }
        else if ((tok->str() == "do"))
        {
            addtoken(&rettail, tok, "do");
        }
        if (varid > 0 && isloop && notvar(tok, varid))
        {
            addtoken(&rettail, tok, "!var");
        }

        // continue / break..
        if (tok->str() == "continue")
        {
            addtoken(&rettail, tok, "continue");
        }
        else if (tok->str() == "break")
        {
            addtoken(&rettail, tok, "break");
        }
        else if (tok->str() == "goto")
        {
            addtoken(&rettail, tok, "goto");
        }

        // Return..
        else if (tok->str() == "return")
        {
            addtoken(&rettail, tok, "return");
            if (varid == 0)
            {
                addtoken(&rettail, tok, ";");
                while (tok && tok->str() != ";")
                    tok = tok->next();
                if (!tok)
                    break;
                continue;
            }

            // Returning a auto_ptr of this allocated variable..
            if (Token::simpleMatch(tok->next(), "std :: auto_ptr <"))
            {
                const Token *tok2 = tok->tokAt(5);
                while (tok2 && tok2->str() != ">")
                    tok2 = tok2->next();
                if (Token::Match(tok2, "> ( %varid% )", varid))
                {
                    addtoken(&rettail, tok, "use");
                    tok = tok2->tokAt(3);
                }
            }

            else if (varid && Token::Match(tok, "return strcpy|strncpy|memcpy ( %varid%", varid))
            {
                addtoken(&rettail, tok, "use");
                tok = tok->tokAt(2);
            }

            else
            {
                bool use = false;

                std::stack<const Token *> f;

                for (const Token *tok2 = tok->next(); tok2; tok2 = tok2->next())
                {
                    if (tok2->str() == ";")
                    {
                        tok = tok2;
                        break;
                    }

                    if (tok2->str() == "(")
                        f.push(tok2->previous());
                    else if (!f.empty() && tok2->str() == ")")
                        f.pop();

                    if (tok2->varId() == varid)
                    {
                        // Read data..
                        if (!Token::Match(tok2->previous(), "&|(") &&
                            Token::simpleMatch(tok2->next(), "["))
                        {
                        }
                        else if (f.empty() ||
                                 !test_white_list(f.top()->str()) ||
                                 getDeallocationType(f.top(),varid))
                        {
                            use = true;
                        }
                    }
                }
                if (use)
                    addtoken(&rettail, tok, "use");
                addtoken(&rettail, tok, ";");
            }
        }

        // throw..
        else if (Token::Match(tok, "try|throw|catch"))
            addtoken(&rettail, tok, tok->str());

        // Assignment..
        if (varid)
        {
            if (Token::Match(tok, "= {"))
            {
                unsigned int indentlevel2 = 0;
                bool use = false;
                for (const Token *tok2 = tok; tok2; tok2 = tok2->next())
                {
                    if (tok2->str() == "{")
                        ++indentlevel2;
                    else if (tok2->str() == "}")
                    {
                        if (indentlevel2 <= 1)
                            break;
                        --indentlevel2;
                    }
                    else if (tok2->varId() == varid)
                    {
                        use = true;
                        break;
                    }
                }

                if (use)
                {
                    addtoken(&rettail, tok, "use");
                    addtoken(&rettail, tok, ";");
                    tok = tok->next()->link();
                    continue;
                }
            }

            if (Token::Match(tok, "[)=] %varid% [+;)]", varid) ||
                Token::Match(tok, "%var% + %varid%", varid) ||
                Token::Match(tok, "%varid% +=|-=", varid) ||
                Token::Match(tok, "+=|<< %varid% ;", varid) ||
                Token::Match(tok, "= strcpy|strcat|memmove|memcpy ( %varid% ,", varid) ||
                Token::Match(tok, "[;{}] %var% [ %varid% ]", varid))
            {
                addtoken(&rettail, tok, "use");
            }
            else if (Token::Match(tok->previous(), "[;{}=(,+-*/] %varid% [", varid))
            {
                // warning is written for "dealloc ; use_ ;".
                // but this use doesn't affect the leak-checking
                addtoken(&rettail, tok, "use_");
            }
        }

        // Investigate function calls..
        if (Token::Match(tok, "%var% ("))
        {
            // A function call should normally be followed by ";"
            if (Token::simpleMatch(tok->next()->link(), ") {"))
            {
                if (!Token::Match(tok, "if|for|while|switch"))
                {
                    addtoken(&rettail, tok, "exit");
                    addtoken(&rettail, tok, ";");
                    tok = tok->next()->link();
                    continue;
                }
            }

            // Calling setjmp / longjmp => bail out
            else if (Token::Match(tok, "setjmp|longjmp"))
            {
                while (rethead->next())
                    rethead->deleteNext();
                return rethead;
            }

            // Inside class function.. if the var is passed as a parameter then
            // just add a "::use"
            // The "::use" means that a member function was probably called but it wasn't analysed further
            else if (classmember)
            {
                if (noreturn.find(tok->str()) != noreturn.end())
                    addtoken(&rettail, tok, "exit");

                else if (!test_white_list(tok->str()))
                {
                    int innerParlevel = 1;
                    for (const Token *tok2 = tok->tokAt(2); tok2; tok2 = tok2->next())
                    {
                        if (tok2->str() == "(")
                            ++innerParlevel;
                        else if (tok2->str() == ")")
                        {
                            --innerParlevel;
                            if (innerParlevel <= 0)
                                break;
                        }
                        if (tok2->varId() == varid)
                        {
                            addtoken(&rettail, tok, "::use");
                            break;
                        }
                    }
                }
            }

            else
            {
                if (varid > 0 && Token::Match(tok, "%var% ( close|fclose|pclose ( %varid% ) ) ;", varid))
                {
                    addtoken(&rettail, tok, "dealloc");
                    tok = tok->next()->link();
                    continue;
                }

                bool allocpar = false;
                const char *str = call_func(tok, callstack, varid, alloctype, dealloctype, allocpar, sz);
                if (str)
                {
                    if (allocpar)
                    {
                        addtoken(&rettail, tok, str);
                        tok = tok->next()->link();
                    }
                    else if (varid == 0 || str != std::string("alloc"))
                    {
                        addtoken(&rettail, tok, str);
                    }
                    else if (Token::Match(tok->tokAt(-2), "%varid% =", varid))
                    {
                        addtoken(&rettail, tok, str);
                    }
                }
                else if (varid > 0 &&
                         getReallocationType(tok, varid) != No &&
                         tok->tokAt(2)->varId() == varid)
                {
                    addtoken(&rettail, tok, "if");
                    addtoken(&rettail, tok, "{");
                    addtoken(&rettail, tok, "dealloc");
                    addtoken(&rettail, tok, ";");
                    addtoken(&rettail, tok, "}");
                    tok = tok->next()->link();
                    continue;
                }
            }
        }

        // Callback..
        bool matchFirst = Token::Match(tok, "( %var%");
        if (matchFirst || Token::Match(tok, "( * %var%"))
        {
            int tokIdx = matchFirst ? 2 : 3;

            while (Token::Match(tok->tokAt(tokIdx), ". %var%"))
                tokIdx += 2;

            if (Token::simpleMatch(tok->tokAt(tokIdx), ") ("))
            {
                for (const Token *tok2 = tok->tokAt(tokIdx + 2); tok2; tok2 = tok2->next())
                {
                    if (Token::Match(tok2, "[;{]"))
                        break;
                    else if (tok2->varId() == varid)
                    {
                        addtoken(&rettail, tok, "use");
                        break;
                    }
                }
            }
        }

        // Linux lists..
        if (varid > 0 && Token::Match(tok, "[=(,] & %varid% [.[,)]", varid))
        {
            addtoken(&rettail, tok, "&use");
        }
    }

    for (Token *tok1 = rethead; tok1; tok1 = tok1->next())
    {
        if (Token::simpleMatch(tok1, "callfunc alloc ;"))
        {
            tok1->deleteThis();
            tok1->insertToken("use");
            tok1->insertToken(";");
        }
    }

    return rethead;
}






void CheckMemoryLeakInFunction::simplifycode(Token *tok)
{
    // Replace "throw" that is not in a try block with "return"
    int indentlevel = 0;
    int trylevel = -1;
    for (Token *tok2 = tok; tok2; tok2 = tok2->next())
    {
        if (tok2->str() == "{")
            ++indentlevel;
        else if (tok2->str() == "}")
        {
            --indentlevel;
            if (indentlevel <= trylevel)
                trylevel = -1;
        }
        else if (trylevel == -1 && tok2->str() == "try")
            trylevel = indentlevel;
        else if (trylevel == -1 && tok2->str() == "throw")
            tok2->str("return");
    }

    // Insert extra ";"
    for (Token *tok2 = tok; tok2; tok2 = tok2->next())
    {
        if (!tok2->previous() || Token::Match(tok2->previous(), "[;{}]"))
        {
            if (Token::Match(tok2, "assign|callfunc|use assign|callfunc|use"))
            {
                tok2->insertToken(";");
            }
        }
    }

    // remove redundant braces..
    for (Token *start = tok; start; start = start->next())
    {
        if (Token::simpleMatch(start, "; {"))
        {
            // the "link" doesn't work here. Find the end brace..
            unsigned int indent = 0;
            for (Token *end = start; end; end = end->next())
            {
                if (end->str() == "{")
                    ++indent;
                else if (end->str() == "}")
                {
                    if (indent <= 1)
                    {
                        if (indent == 1 && Token::Match(end->previous(), "[;{}] } %any%"))
                        {
                            start->deleteNext();
                            end->deleteThis();
                        }
                        break;
                    }
                    --indent;
                }
            }
        }
    }

    // reduce the code..
    bool done = false;
    while (! done)
    {
        //tok->printOut("simplifycode loop..");
        done = true;

        // reduce callfunc
        for (Token *tok2 = tok; tok2; tok2 = tok2->next())
        {
            if (tok2->str() == "callfunc")
            {
                if (!Token::Match(tok2->previous(), "[;{}] callfunc ; }"))
                    tok2->deleteThis();
            }
        }

        if (Token::Match(tok, ";| if return ;"))
        {
            tok->deleteThis();
            tok->deleteThis();
            if (tok->str() == "return")
                tok->deleteThis();
            if (tok->strAt(1) == "else")
                tok->deleteNext();
        }

        // simplify "while1" contents..
        for (Token *tok2 = tok; tok2; tok2 = tok2->next())
        {
            if (Token::simpleMatch(tok2, "while1 {"))
            {
                unsigned int innerIndentlevel = 0;
                for (Token *tok3 = tok2->tokAt(2); tok3; tok3 = tok3->next())
                {
                    if (tok3->str() == "{")
                        ++innerIndentlevel;
                    else if (tok3->str() == "}")
                    {
                        if (innerIndentlevel == 0)
                            break;
                        --innerIndentlevel;
                    }
                    while (innerIndentlevel == 0 && Token::Match(tok3, "[{};] if|ifv|else { continue ; }"))
                    {
                        Token::eraseTokens(tok3, tok3->tokAt(6));
                        if (Token::simpleMatch(tok3->next(), "else"))
                            tok3->deleteNext();
                    }
                }

                if (Token::Match(tok2, "while1 { if { dealloc ; return ; } }"))
                {
                    tok2->str(";");
                    Token::eraseTokens(tok2, tok2->tokAt(4));
                    Token::eraseTokens(tok2->tokAt(4), tok2->tokAt(7));
                }
            }
        }

        for (Token *tok2 = tok; tok2; tok2 = tok2 ? tok2->next() : NULL)
        {
            // Delete extra ";"
            while (Token::Match(tok2, "[;{}] ;"))
            {
                tok2->deleteNext();
                done = false;
            }

            // Replace "{ }" with ";"
            if (Token::simpleMatch(tok2->next(), "{ }"))
            {
                tok2->eraseTokens(tok2, tok2->tokAt(3));
                tok2->insertToken(";");
                done = false;
            }

            // Delete braces around a single instruction..
            if (Token::Match(tok2->next(), "{ %var% ; }"))
            {
                tok2->deleteNext();
                Token::eraseTokens(tok2->tokAt(2), tok2->tokAt(4));
                done = false;
            }
            if (Token::Match(tok2->next(), "{ %var% %var% ; }"))
            {
                tok2->deleteNext();
                Token::eraseTokens(tok2->tokAt(3), tok2->tokAt(5));
                done = false;
            }

            // Reduce "if if|callfunc" => "if"
            else if (Token::Match(tok2, "if if|callfunc"))
            {
                tok2->deleteNext();
                done = false;
            }

            else if (tok2->next() && tok2->next()->str() == "if")
            {
                // Delete empty if that is not followed by an else
                if (Token::Match(tok2->next(), "if ; !!else"))
                {
                    tok2->deleteNext();
                    done = false;
                }

                // Reduce "if X ; else X ;" => "X ;"
                else if (Token::Match(tok2->next(), "if %var% ; else %var% ;") &&
                         std::string(tok2->strAt(2)) == std::string(tok2->strAt(5)))
                {
                    Token::eraseTokens(tok2, tok2->tokAt(5));
                    done = false;
                }

                // Reduce "if continue ; if continue ;" => "if continue ;"
                else if (Token::Match(tok2->next(), "if continue ; if continue ;"))
                {
                    Token::eraseTokens(tok2, tok2->tokAt(4));
                    done = false;
                }

                // Reduce "if return ; alloc ;" => "alloc ;"
                else if (Token::Match(tok2, "[;{}] if return ; alloc|return ;"))
                {
                    Token::eraseTokens(tok2, tok2->tokAt(4));
                    done = false;
                }

                // "[;{}] if alloc ; else return ;" => "[;{}] alloc ;"
                else if (Token::Match(tok2, "[;{}] if alloc ; else return ;"))
                {
                    tok2->deleteNext();                                // Remove "if"
                    Token::eraseTokens(tok2->next(), tok2->tokAt(5));  // Remove "; else return"
                    done = false;
                }

                // Reduce "if ; else %var% ;" => "if %var% ;"
                else if (Token::Match(tok2->next(), "if ; else %var% ;"))
                {
                    Token::eraseTokens(tok2->next(), tok2->tokAt(4));
                    done = false;
                }

                // Reduce "if ; else" => "if"
                else if (Token::simpleMatch(tok2->next(), "if ; else"))
                {
                    Token::eraseTokens(tok2->next(), tok2->tokAt(4));
                    done = false;
                }

                // Reduce "if return ; else|if return|continue ;" => "if return ;"
                else if (Token::Match(tok2->next(), "if return ; else|if return|continue|break ;"))
                {
                    Token::eraseTokens(tok2->tokAt(3), tok2->tokAt(6));
                    done = false;
                }

                // Reduce "if continue|break ; else|if return ;" => "if return ;"
                else if (Token::Match(tok2->next(), "if continue|break ; if|else return ;"))
                {
                    Token::eraseTokens(tok2->next(), tok2->tokAt(5));
                    done = false;
                }

                // Remove "else" after "if continue|break|return"
                else if (Token::Match(tok2->next(), "if continue|break|return ; else"))
                {
                    tok2->tokAt(4)->deleteThis();
                    done = false;
                }

                // Delete "if { dealloc|assign|use ; return ; }"
                else if (Token::Match(tok2, "[;{}] if { dealloc|assign|use ; return ; }"))
                {
                    Token::eraseTokens(tok2, tok2->tokAt(8));
                    if (Token::simpleMatch(tok2->next(), "else"))
                        tok2->deleteNext();
                    done = false;
                }

                // Remove "if { dealloc ; callfunc ; } !!else"
                else if (Token::Match(tok2->next(), "if { dealloc|assign ; callfunc ; } !!else"))
                {
                    Token::eraseTokens(tok2, tok2->tokAt(8));
                    done = false;
                }

                continue;
            }

            // Reduce "alloc while(!var) alloc ;" => "alloc ;"
            if (Token::Match(tok2, "[;{}] alloc ; while(!var) alloc ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(4));
                done = false;
            }

            // Reduce "ifv return;" => "if return use;"
            if (Token::simpleMatch(tok2, "ifv return ;"))
            {
                tok2->str("if");
                tok2->next()->insertToken("use");
                done = false;
            }

            // Reduce "if(var) dealloc ;" and "if(var) use ;" that is not followed by an else..
            if (Token::Match(tok2, "[;{}] if(var) assign|dealloc|use ; !!else"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(2));
                done = false;
            }

            // Reduce "; if(!var) alloc ; !!else" => "; dealloc ; alloc ;"
            if (Token::Match(tok2, "; if(!var) alloc ; !!else"))
            {
                // Remove the "if(!var)"
                Token::eraseTokens(tok2, tok2->tokAt(2));

                // Insert "dealloc ;" before the "alloc ;"
                tok2->insertToken(";");
                tok2->insertToken("dealloc");

                done = false;
            }

            // Reduce "; if(!var) exit ;" => ";"
            if (Token::Match(tok2, "; if(!var) exit ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // Reduce "if* ;"..
            if (Token::Match(tok2->next(), "if(var)|if(!var)|ifv ;"))
            {
                // Followed by else..
                if (Token::simpleMatch(tok2->tokAt(3), "else"))
                {
                    tok2 = tok2->next();
                    if (tok2->str() == "if(var)")
                        tok2->str("if(!var)");
                    else if (tok2->str() == "if(!var)")
                        tok2->str("if(var)");

                    // remove the "; else"
                    Token::eraseTokens(tok2, tok2->tokAt(3));
                }
                else
                {
                    // remove the "if* ;"
                    Token::eraseTokens(tok2, tok2->tokAt(3));
                }
                done = false;
            }

            // Reduce "else ;" => ";"
            if (Token::simpleMatch(tok2->next(), "else ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(2));
                done = false;
            }

            // Reduce "while1 continue| ;" => "use ;"
            if (Token::Match(tok2, "while1 if| continue| ;"))
            {
                tok2->str("use");
                while (tok2->strAt(1) != ";")
                    tok2->deleteNext();
                done = false;
            }

            // Reduce "while1 if break ;" => ";"
            if (Token::simpleMatch(tok2, "while1 if break ;"))
            {
                tok2->str(";");
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // Delete if block: "alloc; if return use ;"
            if (Token::Match(tok2, "alloc ; if return use ; !!else"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(5));
                done = false;
            }

            // Reduce "alloc|dealloc|use|callfunc ; exit ;" => "; exit ;"
            if (Token::Match(tok2, "[;{}] alloc|dealloc|use|callfunc ; exit ;"))
            {
                tok2->deleteNext();
                done = false;
            }

            // Reduce "alloc|dealloc|use ; if(var) exit ;"
            if (Token::Match(tok2, "alloc|dealloc|use ; if(var) exit ;"))
            {
                tok2->deleteThis();
                done = false;
            }

            // Remove "if exit ;"
            if (Token::simpleMatch(tok2, "if exit ;"))
            {
                tok2->deleteThis();
                tok2->deleteThis();
                done = false;
            }

            // Remove the "if break|continue ;" that follows "dealloc ; alloc ;"
            if (! _settings->inconclusive && Token::Match(tok2, "dealloc ; alloc ; if break|continue ;"))
            {
                tok2 = tok2->tokAt(3);
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // if break ; break ; => break ;
            if (Token::Match(tok2->previous(), "[;{}] if break ; break ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(4));
                done = false;
            }

            // Reduce "do { dealloc ; alloc ; } while(var) ;" => ";"
            if (Token::simpleMatch(tok2->next(), "do { dealloc ; alloc ; } while(var) ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(9));
                done = false;
            }

            // Reduce "do { alloc ; } " => "alloc ;"
            /** @todo If the loop "do { alloc ; }" can be executed twice, reduce it to "loop alloc ;" */
            if (Token::simpleMatch(tok2->next(), "do { alloc ; }"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                Token::eraseTokens(tok2->tokAt(2), tok2->tokAt(4));
                done = false;
            }

            // Reduce "loop break ; => ";"
            if (Token::Match(tok2->next(), "loop break|continue ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // Reduce "loop|do ;" => ";"
            if (Token::Match(tok2, "loop|do ;"))
            {
                tok2->deleteThis();
                done = false;
            }

            // Reduce "loop if break|continue ; !!else" => ";"
            if (Token::Match(tok2->next(), "loop if break|continue ; !!else"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(4));
                done = false;
            }

            // Reduce "loop { if break|continue ; !!else" => "loop {"
            if (Token::Match(tok2, "loop { if break|continue ; !!else"))
            {
                Token::eraseTokens(tok2->next(), tok2->tokAt(5));
                done = false;
            }

            // Replace "do ; loop ;" with ";"
            if (Token::simpleMatch(tok2, "; loop ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // Replace "loop loop .." with "loop .."
            if (Token::simpleMatch(tok2, "loop loop"))
            {
                tok2->deleteThis();
                done = false;
            }

            // Replace "loop if return ;" with "if return ;"
            if (Token::simpleMatch(tok2->next(), "loop if return"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(2));
                done = false;
            }

            // Reduce "loop|while1 { dealloc ; alloc ; }"
            if (Token::Match(tok2, "loop|while1 { dealloc ; alloc ; }"))
            {
                // delete "loop|while1"
                tok2->deleteThis();
                // delete "{"
                tok2->deleteThis();

                // delete "}"
                Token::eraseTokens(tok2->tokAt(3), tok2->tokAt(5));

                done = false;
            }

            // loop { use ; callfunc ; }  =>  use ;
            // assume that the "callfunc" is not noreturn
            if (Token::simpleMatch(tok2, "loop { use ; callfunc ; }"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(7));
                tok2->str("use");
                tok2->insertToken(";");
                done = false;
            }

            // Delete if block in "alloc ; if(!var) return ;"
            if (Token::Match(tok2, "alloc ; if(!var) return ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(4));
                done = false;
            }

            // Reduce "[;{}] return use ; %var%" => "[;{}] return use ;"
            if (Token::Match(tok2, "[;{}] return use ; %var%"))
            {
                Token::eraseTokens(tok2->tokAt(3), tok2->tokAt(5));
                done = false;
            }

            // Reduce "if(var) return use ;" => "return use ;"
            if (Token::Match(tok2->next(), "if(var) return use ; !!else"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(2));
                done = false;
            }

            // malloc - realloc => alloc ; dealloc ; alloc ;
            // Reduce "[;{}] alloc ; dealloc ; alloc ;" => "[;{}] alloc ;"
            if (Token::Match(tok2, "[;{}] alloc ; dealloc ; alloc ;"))
            {
                Token::eraseTokens(tok2->next(), tok2->tokAt(6));
                done = false;
            }

            // use; dealloc; => dealloc;
            if (Token::Match(tok2, "[;{}] use ; dealloc ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // use use => use
            if (Token::simpleMatch(tok2, "use use"))
            {
                tok2->deleteThis();
                done = false;
            }

            // use; if| use; => use;
            while (Token::Match(tok2, "[;{}] use ; if| use ;"))
            {
                Token *t = tok2->tokAt(2);
                t->deleteNext();
                t->deleteNext();
                if (t->strAt(1) == ";")
                    t->deleteNext();
                done = false;
            }

            // Delete first part in "use ; return use ;"
            if (Token::Match(tok2, "[;{}] use ; return use ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // try/catch
            if (Token::simpleMatch(tok2, "try ; catch exit ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(4));
                tok2->deleteThis();
                done = false;
            }

            // Delete second case in "case ; case ;"
            while (Token::simpleMatch(tok2, "case ; case ;"))
            {
                Token::eraseTokens(tok2, tok2->tokAt(3));
                done = false;
            }

            // Replace switch with if (if not complicated)
            if (Token::simpleMatch(tok2, "switch {"))
            {
                // Right now, I just handle if there are a few case and perhaps a default.
                bool valid = false;
                bool incase = false;
                for (const Token * _tok = tok2->tokAt(2); _tok; _tok = _tok->next())
                {
                    if (_tok->str() == "{")
                        break;

                    else if (_tok->str() == "}")
                    {
                        valid = true;
                        break;
                    }

                    else if (_tok->str() == "switch")
                        break;

                    else if (_tok->str() == "loop")
                        break;

                    else if (incase && _tok->str() == "case")
                        break;

                    else if (Token::Match(_tok, "return !!;"))
                        break;

                    if (Token::Match(_tok, "if return|break use| ;"))
                        _tok = _tok->tokAt(2);

                    incase |= (_tok->str() == "case");
                    incase &= (_tok->str() != "break" && _tok->str() != "return");
                }

                if (!incase && valid)
                {
                    done = false;
                    tok2->str(";");
                    Token::eraseTokens(tok2, tok2->tokAt(2));
                    tok2 = tok2->next();
                    bool first = true;
                    while (Token::Match(tok2, "case|default"))
                    {
                        const bool def(tok2->str() == "default");
                        tok2->str(first ? "if" : "}");
                        if (first)
                        {
                            first = false;
                            tok2->insertToken("{");
                        }
                        else
                        {
                            // Insert "else [if] {
                            tok2->insertToken("{");
                            if (! def)
                                tok2->insertToken("if");
                            tok2->insertToken("else");
                            tok2 = tok2->next();
                        }
                        while (tok2)
                        {
                            if (tok2->str() == "}")
                                break;
                            if (Token::Match(tok2, "break|return ;"))
                                break;
                            if (Token::Match(tok2, "if return|break use| ;"))
                                tok2 = tok2->tokAt(2);
                            else
                                tok2 = tok2->next();
                        }
                        if (Token::simpleMatch(tok2, "break ;"))
                        {
                            tok2->str(";");
                            tok2 = tok2->tokAt(2);
                        }
                        else if (tok2 && tok2->str() == "return")
                        {
                            tok2 = tok2->tokAt(2);
                        }
                    }
                }
            }
        }

        // If "--all" is given, remove all "callfunc"..
        if (done && _settings->inconclusive)
        {
            for (Token *tok2 = tok; tok2; tok2 = tok2->next())
            {
                if (tok2->str() == "callfunc")
                {
                    tok2->deleteThis();
                    done = false;
                }
            }
        }
    }
}





const Token *CheckMemoryLeakInFunction::findleak(const Token *tokens)
{
    const Token *result;

    if ((result = Token::findmatch(tokens, "loop alloc ;")) != NULL)
    {
        return result;
    }

    if (Token::Match(tokens, "alloc ; if|if(var)|ifv break|continue|return ;"))
    {
        return tokens->tokAt(3);
    }

    if ((result = Token::findmatch(tokens, "alloc ; if|if(var)|ifv return ;")) != NULL)
    {
        return result->tokAt(3);
    }

    if ((result = Token::findmatch(tokens, "alloc ; alloc|assign|return callfunc| ;")) != NULL)
    {
        return result->tokAt(2);
    }

    if ((result = Token::findmatch(tokens, "; alloc ; if assign ;")) != NULL)
    {
        return result->tokAt(4);
    }

    if (((result = Token::findmatch(tokens, "; alloc ; if dealloc ; }")) != NULL) &&
        !result->tokAt(7))
    {
        return result->tokAt(6);
    }

    if ((result = Token::findmatch(tokens, "alloc ; }")) != NULL)
    {
        if (result->tokAt(3) == NULL)
            return result->tokAt(2);
    }

    // No deallocation / usage => report leak at the last token
    if (!Token::findmatch(tokens, "dealloc|use"))
    {
        const Token *last = tokens;
        while (last->next())
            last = last->next();

        // not a leak if exit is called before the end of the function
        if (!Token::Match(last->tokAt(-2), "exit|callfunc ; }"))
            return last;
    }

    return NULL;
}






// Check for memory leaks for a function variable.
void CheckMemoryLeakInFunction::checkScope(const Token *Tok1, const std::string &varname, unsigned int varid, bool classmember, unsigned int sz)
{
    std::list<const Token *> callstack;

    AllocType alloctype = No;
    AllocType dealloctype = No;

    const Token *result;

    Token *tok = getcode(Tok1, callstack, varid, alloctype, dealloctype, classmember, sz);
    //tok->printOut((std::string("Checkmemoryleak: getcode result for: ") + varname).c_str());

    // Simplify the code and check if freed memory is used..
    for (Token *tok2 = tok; tok2; tok2 = tok2->next())
    {
        while (Token::Match(tok2, "[;{}] ;"))
            Token::eraseTokens(tok2, tok2->tokAt(2));
    }
    if ((result = Token::findmatch(tok, "[;{}] dealloc ; use_ ;")) != NULL)
    {
        deallocuseError(result->tokAt(3), varname);
    }

    // Replace "&use" with "use". Replace "use_" with ";"
    for (Token *tok2 = tok; tok2; tok2 = tok2->next())
    {
        if (tok2->str() == "&use")
            tok2->str("use");
        else if (tok2->str() == "use_")
            tok2->str(";");
        else if (Token::simpleMatch(tok2, "loop use_ {"))
            tok2->deleteNext();
        else if (tok2->str() == "::use")    // Some kind of member function usage. Not analyzed very well.
            tok2->str("use");
        else if (tok2->str() == "recursive")
            tok2->str("use");
        else if (tok2->str() == "dealloc_")
            tok2->str("dealloc");
        else if (tok2->str() == "realloc")
        {
            tok2->str("dealloc");
            tok2->insertToken("alloc");
            tok2->insertToken(";");
        }
    }

    // If the variable is not allocated at all => no memory leak
    if (Token::findmatch(tok, "alloc") == 0)
    {
        Tokenizer::deleteTokens(tok);
        return;
    }

    simplifycode(tok);

    if (_settings->debug && _settings->_verbose)
    {
        tok->printOut(("Checkmemoryleak: simplifycode result for: " + varname).c_str());
    }

    // If the variable is not allocated at all => no memory leak
    if (Token::findmatch(tok, "alloc") == 0)
    {
        Tokenizer::deleteTokens(tok);
        return;
    }

    /** @todo handle "goto" */
    if (Token::findmatch(tok, "goto"))
    {
        Tokenizer::deleteTokens(tok);
        return;
    }

    if ((result = findleak(tok)) != NULL)
    {
        memoryLeak(result, varname, alloctype);
    }

    else if ((result = Token::findmatch(tok, "dealloc ; dealloc ;")) != NULL)
    {
        deallocDeallocError(result->tokAt(2), varname);
    }

    // detect cases that "simplifycode" don't handle well..
    else if (_settings->debugwarnings)
    {
        Token *first = tok;
        while (first && first->str() == ";")
            first = first->next();

        bool noerr = false;
        noerr |= Token::simpleMatch(first, "alloc ; }");
        noerr |= Token::simpleMatch(first, "alloc ; dealloc ; }");
        noerr |= Token::simpleMatch(first, "alloc ; return use ; }");
        noerr |= Token::simpleMatch(first, "alloc ; use ; }");
        noerr |= Token::simpleMatch(first, "alloc ; use ; return ; }");
        noerr |= Token::simpleMatch(first, "alloc ; dealloc ; return ; }");
        noerr |= Token::simpleMatch(first, "if alloc ; dealloc ; }");
        noerr |= Token::simpleMatch(first, "if alloc ; return use ; }");
        noerr |= Token::simpleMatch(first, "if alloc ; use ; }");
        noerr |= Token::simpleMatch(first, "alloc ; ifv return ; dealloc ; }");
        noerr |= Token::simpleMatch(first, "alloc ; if return ; dealloc; }");

        // Unhandled case..
        if (! noerr)
        {
            std::ostringstream errmsg;
            errmsg << "inconclusive leak: ";
            for (const Token *tok2 = tok; tok2; tok2 = tok2->next())
                errmsg << " " << tok2->str();
            reportError(_tokenizer->tokens(), Severity::debug, "debug", errmsg.str());
        }
    }

    Tokenizer::deleteTokens(tok);
}
//---------------------------------------------------------------------------





//---------------------------------------------------------------------------
// Check for memory leaks due to improper realloc() usage.
//   Below, "a" may be set to null without being freed if realloc() cannot
//   allocate the requested memory:
//     a = malloc(10); a = realloc(a, 100);
//---------------------------------------------------------------------------
void CheckMemoryLeakInFunction::checkReallocUsage()
{
    std::list<SymbolDatabase::SpaceInfo *>::const_iterator i;

    for (i = symbolDatabase->spaceInfoList.begin(); i != symbolDatabase->spaceInfoList.end(); ++i)
    {
        SymbolDatabase::SpaceInfo *info = *i;

        // only check functions
        if (info->type != SymbolDatabase::SpaceInfo::Function)
            continue;

        // Record the varid's of the function parameters
        std::set<unsigned int> parameterVarIds;
        for (const Token *tok2 = info->classDef->next(); tok2 && tok2->str() != ")"; tok2 = tok2->next())
        {
            if (tok2->varId() != 0)
                parameterVarIds.insert(tok2->varId());
        }

        const Token *tok = info->classStart;
        const Token *startOfFunction = tok;

        // Search for the "var = realloc(var, 100);" pattern within this function
        unsigned int indentlevel = 1;
        for (tok = tok->next(); tok; tok = tok->next())
        {
            if (tok->str() == "{")
                ++indentlevel;
            else if (tok->str() == "}")
            {
                --indentlevel;
                if (indentlevel == 0)
                    break;
            }

            if (tok->varId() > 0 &&
                Token::Match(tok, "%var% = realloc|g_try_realloc ( %var% ,") &&
                tok->varId() == tok->tokAt(4)->varId() &&
                parameterVarIds.find(tok->varId()) == parameterVarIds.end())
            {
                // Check that another copy of the pointer wasn't saved earlier in the function
                if (!Token::findmatch(startOfFunction, "%var% = %varid% ;", tok->varId()) &&
                    !Token::findmatch(startOfFunction, "[{};] %varid% = %var% [;=]", tok->varId()))
                    memleakUponReallocFailureError(tok, tok->str());
            }
        }
    }
}
//---------------------------------------------------------------------------






//---------------------------------------------------------------------------
// Checks for memory leaks inside function..
//---------------------------------------------------------------------------

void CheckMemoryLeakInFunction::parseFunctionScope(const Token *tok, const Token *tok1, const bool classmember)
{
    // Check locking/unlocking of global resources..
    checkScope(tok->next(), "", 0, classmember, 1);

    // Locate parameters and check their usage..
    for (const Token *tok2 = tok1; tok2; tok2 = tok2->next())
    {
        if (tok2 == tok)
            break;
        if (tok2->str() == ")")
            break;
        if (Token::Match(tok2, "[(,] %type% * %var% [,)]") && tok2->next()->isStandardType())
        {
            const std::string varname(tok2->strAt(3));
            const unsigned int varid = tok2->tokAt(3)->varId();
            const unsigned int sz = _tokenizer->sizeOfType(tok2->next());
            checkScope(tok->next(), varname, varid, classmember, sz);
        }
    }

    // Locate variable declarations and check their usage..
    unsigned int indentlevel = 0;
    do
    {
        if (tok->str() == "{")
            ++indentlevel;
        else if (tok->str() == "}")
        {
            if (indentlevel <= 1)
                break;
            --indentlevel;
        }

        // Skip these weird blocks... "( { ... } )"
        if (Token::simpleMatch(tok, "( {"))
        {
            tok = tok->link();
            if (!tok)
                break;
            continue;
        }

        if (!Token::Match(tok, "[{};] %type%"))
            continue;

        // Don't check static/extern variables
        if (Token::Match(tok->next(), "static|extern"))
            continue;

        // return/else is not part of a variable declaration..
        if (Token::Match(tok->next(), "return|else"))
            continue;

        unsigned int sz = _tokenizer->sizeOfType(tok->next());
        if (sz < 1)
            sz = 1;

        if (Token::Match(tok, "[{};] %type% * const| %var% [;=]"))
        {
            const Token *vartok = tok->tokAt(tok->tokAt(3)->str() != "const" ? 3 : 4);
            checkScope(tok->next(), vartok->str(), vartok->varId(), classmember, sz);
        }

        else if (Token::Match(tok, "[{};] %type% %type% * const| %var% [;=]"))
        {
            const Token *vartok = tok->tokAt(tok->tokAt(4)->str() != "const" ? 4 : 5);
            checkScope(tok->next(), vartok->str(), vartok->varId(), classmember, sz);
        }

        else if (Token::Match(tok, "[{};] int %var% [;=]"))
        {
            const Token *vartok = tok->tokAt(2);
            checkScope(tok->next(), vartok->str(), vartok->varId(), classmember, sz);
        }
    }
    while (0 != (tok = tok->next()));
}

void CheckMemoryLeakInFunction::check()
{
    // fill the "noreturn"
    parse_noreturn();

    std::list<SymbolDatabase::SpaceInfo *>::const_iterator i;

    for (i = symbolDatabase->spaceInfoList.begin(); i != symbolDatabase->spaceInfoList.end(); ++i)
    {
        SymbolDatabase::SpaceInfo *info = *i;

        // only check functions
        if (info->type != SymbolDatabase::SpaceInfo::Function)
            continue;

        const Token *tok = info->classStart;
        const Token *tok1 = info->classDef->next();
        bool classmember = info->functionOf != NULL;

        parseFunctionScope(tok, tok1, classmember);
    }
}
//---------------------------------------------------------------------------





























//---------------------------------------------------------------------------
// Checks for memory leaks in classes..
//---------------------------------------------------------------------------



void CheckMemoryLeakInClass::check()
{
    SymbolDatabase *symbolDatabase = _tokenizer->getSymbolDatabase();

    std::list<SymbolDatabase::SpaceInfo *>::iterator i;

    for (i = symbolDatabase->spaceInfoList.begin(); i != symbolDatabase->spaceInfoList.end(); ++i)
    {
        const SymbolDatabase::SpaceInfo *info = *i;

        // only check classes and structures
        if (info->type == SymbolDatabase::SpaceInfo::Class)
        {
            std::list<SymbolDatabase::Var>::const_iterator var;
            for (var = info->varlist.begin(); var != info->varlist.end(); ++var)
            {
                if (!var->isStatic && var->token->previous()->str() == "*")
                {
                    // allocation but no deallocation of private variables in public function..
                    if (var->token->tokAt(-2)->isStandardType())
                    {
                        if (var->access == SymbolDatabase::Private)
                            checkPublicFunctions(info, var->token);

                        variable(info, var->token);
                    }

                    // known class?
                    else if (var->type)
                    {
                        // not derived and no constructor?
                        if (var->type->derivedFrom.empty() && var->type->numConstructors == 0)
                        {
                            if (var->access == SymbolDatabase::Private)
                                checkPublicFunctions(info, var->token);

                            variable(info, var->token);
                        }
                    }
                }
            }
        }
    }
}


void CheckMemoryLeakInClass::variable(const SymbolDatabase::SpaceInfo *classinfo, const Token *tokVarname)
{
    const std::string varname = tokVarname->strAt(0);
    const std::string classname = classinfo->className;

    // Check if member variable has been allocated and deallocated..
    CheckMemoryLeak::AllocType Alloc = CheckMemoryLeak::No;
    CheckMemoryLeak::AllocType Dealloc = CheckMemoryLeak::No;

    bool allocInConstructor = false;
    bool deallocInDestructor = false;

    // Inspect member functions
    std::list<SymbolDatabase::Func>::const_iterator func;
    for (func = classinfo->functionList.begin(); func != classinfo->functionList.end(); ++func)
    {
        const Token *functionToken = func->token;
        const bool constructor = func->type == SymbolDatabase::Func::Constructor;
        const bool destructor = func->type == SymbolDatabase::Func::Destructor;
        unsigned int indent = 0;
        bool initlist = false;
        for (const Token *tok = functionToken; tok; tok = tok->next())
        {
            if (tok->str() == "{")
                ++indent;
            else if (tok->str() == "}")
            {
                if (indent <= 1)
                    break;
                --indent;
            }
            else if (indent == 0 && Token::simpleMatch(tok, ") :"))
                initlist = true;
            else if (initlist || indent > 0)
            {
                if (indent == 0)
                {
                    if (!Token::Match(tok, (":|, " + varname + " (").c_str()))
                        continue;
                }

                // Allocate..
                if (indent == 0 || Token::Match(tok, (varname + " =").c_str()))
                {
                    // var1 = var2 = ...
                    // bail out
                    if (Token::simpleMatch(tok->previous(), "="))
                        return;

                    // Foo::var1 = ..
                    // bail out when not same class
                    if (Token::simpleMatch(tok->previous(), "::") &&
                        tok->strAt(-2) != classinfo->className)
                        return;

                    AllocType alloc = getAllocationType(tok->tokAt((indent > 0) ? 2 : 3), 0);
                    if (alloc != CheckMemoryLeak::No)
                    {
                        if (constructor)
                            allocInConstructor = true;

                        if (Alloc != No && Alloc != alloc)
                            alloc = CheckMemoryLeak::Many;

                        std::list<const Token *> callstack;
                        if (alloc != CheckMemoryLeak::Many && Dealloc != CheckMemoryLeak::No && Dealloc != CheckMemoryLeak::Many && Dealloc != alloc)
                        {
                            callstack.push_back(tok);
                            mismatchAllocDealloc(callstack, classname + "::" + varname);
                            callstack.pop_back();
                        }

                        Alloc = alloc;
                    }
                }

                if (indent == 0)
                    continue;

                // Deallocate..
                AllocType dealloc = getDeallocationType(tok, varname);
                if (dealloc == No)
                {
                    std::string temp = classinfo->className + " :: " + varname;
                    dealloc = getDeallocationType(tok, temp);
                }
                if (dealloc == No)
                {
                    std::string temp = "this . " + varname;
                    dealloc = getDeallocationType(tok, temp);
                }
                if (dealloc != CheckMemoryLeak::No)
                {
                    if (destructor)
                        deallocInDestructor = true;

                    // several types of allocation/deallocation?
                    if (Dealloc != CheckMemoryLeak::No && Dealloc != dealloc)
                        dealloc = CheckMemoryLeak::Many;

                    std::list<const Token *> callstack;
                    if (dealloc != CheckMemoryLeak::Many && Alloc != CheckMemoryLeak::No &&  Alloc != Many && Alloc != dealloc)
                    {
                        callstack.push_back(tok);
                        mismatchAllocDealloc(callstack, classname + "::" + varname);
                        callstack.pop_back();
                    }

                    Dealloc = dealloc;
                }

                // Function call .. possible deallocation
                else if (Token::Match(tok->previous(), "[{};] %var% ("))
                {
                    if (!std::bsearch(tok->str().c_str(), call_func_white_list,
                                      sizeof(call_func_white_list) / sizeof(call_func_white_list[0]),
                                      sizeof(call_func_white_list[0]), call_func_white_list_compare))
                    {
                        return;
                    }
                }
            }
        }
    }

    if (allocInConstructor && !deallocInDestructor)
    {
        memoryLeak(tokVarname, (classname + "::" + varname).c_str(), Alloc);
    }
    else if (Alloc != CheckMemoryLeak::No && Dealloc == CheckMemoryLeak::No)
    {
        memoryLeak(tokVarname, (classname + "::" + varname).c_str(), Alloc);
    }
}


void CheckMemoryLeakInClass::checkPublicFunctions(const SymbolDatabase::SpaceInfo *spaceinfo, const Token *classtok)
{
    // Check that public functions deallocate the pointers that they allocate.
    // There is no checking how these functions are used and therefore it
    // isn't established if there is real leaks or not.
    if (!_settings->_checkCodingStyle)
        return;

    const unsigned int varid = classtok->varId();

    // Parse public functions..
    // If they allocate member variables, they should also deallocate
    std::list<SymbolDatabase::Func>::const_iterator func;

    for (func = spaceinfo->functionList.begin(); func != spaceinfo->functionList.end(); ++func)
    {
        if (func->type != SymbolDatabase::Func::Constructor &&
            func->access == SymbolDatabase::Public && func->hasBody)
        {
            const Token *tok2 = func->token;
            while (tok2->str() != "{")
                tok2 = tok2->next();
            if (Token::Match(tok2, "{|}|; %varid% =", varid))
            {
                const CheckMemoryLeak::AllocType alloc = getAllocationType(tok2->tokAt(3), varid);
                if (alloc != CheckMemoryLeak::No)
                    publicAllocationError(tok2, tok2->strAt(1));
            }
            else if (Token::Match(tok2, "{|}|; %type% :: %varid% =", varid) &&
                     tok2->next()->str() == spaceinfo->className)
            {
                const CheckMemoryLeak::AllocType alloc = getAllocationType(tok2->tokAt(5), varid);
                if (alloc != CheckMemoryLeak::No)
                    publicAllocationError(tok2, tok2->strAt(3));
            }
        }
    }
}

void CheckMemoryLeakInClass::publicAllocationError(const Token *tok, const std::string &varname)
{
    reportError(tok, Severity::warning, "publicAllocationError", "Possible leak in public function. The pointer '" + varname + "' is not deallocated before it is allocated.");
}



void CheckMemoryLeakStructMember::check()
{
    // This should be in the CheckMemoryLeak base class
    std::set<std::string> ignoredFunctions;
    ignoredFunctions.insert("if");
    ignoredFunctions.insert("for");
    ignoredFunctions.insert("while");
    ignoredFunctions.insert("malloc");


    unsigned int indentlevel1 = 0;
    for (const Token *tok = _tokenizer->tokens(); tok; tok = tok->next())
    {
        if (tok->str() == "{")
            ++indentlevel1;
        else if (tok->str() == "}")
            --indentlevel1;

        // Locate struct variables..
        if (indentlevel1 > 0 && Token::Match(tok, "struct|;|{|} %type% * %var% [=;]"))
        {
            const Token * const vartok = tok->tokAt(3);
            if (vartok->varId() == 0)
                continue;

            // Check that struct is allocated..
            {
                const unsigned int varid(vartok->varId());
                bool alloc = false;
                unsigned int indentlevel2 = 0;
                for (const Token *tok2 = vartok; tok2; tok2 = tok2->next())
                {
                    if (tok2->str() == "{")
                        ++indentlevel2;
                    else if (tok2->str() == "}")
                    {
                        if (indentlevel2 == 0)
                            break;
                        --indentlevel2;
                    }
                    else if (Token::Match(tok2, "= %varid% [;=]", varid))
                    {
                        alloc = false;
                        break;
                    }
                    else if (Token::Match(tok2, "%varid% = malloc|kmalloc (", varid))
                    {
                        alloc = true;
                    }
                }
                if (!alloc)
                    continue;
            }

            // Check struct..
            unsigned int indentlevel2 = 0;
            for (const Token *tok2 = vartok; tok2; tok2 = tok2->next())
            {
                if (tok2->str() == "{")
                    ++indentlevel2;

                else if (tok2->str() == "}")
                {
                    if (indentlevel2 == 0)
                        break;
                    --indentlevel2;
                }

                // Unknown usage of struct
                /** @todo Check how the struct is used. Only bail out if necessary */
                else if (Token::Match(tok2, "[(,] %varid% [,)]", vartok->varId()))
                    break;

                // Struct member is allocated => check if it is also properly deallocated..
                else if (Token::Match(tok2, "%varid% . %var% = malloc|strdup|kmalloc (", vartok->varId()))
                {
                    const unsigned int structid(vartok->varId());
                    const unsigned int structmemberid(tok2->tokAt(2)->varId());

                    // This struct member is allocated.. check that it is deallocated
                    unsigned int indentlevel3 = indentlevel2;
                    for (const Token *tok3 = tok2; tok3; tok3 = tok3->next())
                    {
                        if (tok3->str() == "{")
                            ++indentlevel3;

                        else if (tok3->str() == "}")
                        {
                            if (indentlevel3 == 0)
                            {
                                memoryLeak(tok3, (vartok->str() + "." + tok2->strAt(2)).c_str(), Malloc);
                                break;
                            }
                            --indentlevel3;
                        }

                        // Deallocating the struct member..
                        else if (Token::Match(tok3, "free|kfree ( %var% . %varid% )", structmemberid))
                        {
                            // If the deallocation happens at the base level, don't check this member anymore
                            if (indentlevel3 == 0)
                                break;

                            // deallocating and then returning from function in a conditional block =>
                            // skip ahead out of the block
                            bool ret = false;
                            while (tok3)
                            {
                                // debug info
                                const std::string tok3str_(tok3->str());
                                if (tok3->str() == "return")
                                    ret = true;
                                else if (tok3->str() == "{" || tok3->str() == "}")
                                    break;
                                tok3 = tok3->next();
                            }
                            if (!ret || !tok3 || tok3->str() != "}")
                                break;
                            --indentlevel3;
                            continue;
                        }

                        // Deallocating the struct..
                        else if (indentlevel2 == 0 && Token::Match(tok3, "free|kfree ( %varid% )", structid))
                        {
                            memoryLeak(tok3, (vartok->str() + "." + tok2->strAt(2)).c_str(), Malloc);
                            break;
                        }

                        // failed allocation => skip code..
                        else if (Token::Match(tok3, "if ( ! %var% . %varid% )", structmemberid))
                        {
                            // Goto the ")"
                            tok3 = tok3->next()->link();

                            // make sure we have ") {".. it should be
                            if (!Token::simpleMatch(tok3, ") {"))
                                break;

                            // Goto the "}"
                            tok3 = tok3->next()->link();
                        }

                        // succeeded allocation
                        else if (Token::Match(tok3, "if ( %var% . %varid% ) {", structmemberid))
                        {
                            // goto the ")"
                            tok3 = tok3->next()->link();

                            // check if the variable is deallocated or returned..
                            unsigned int indentlevel4 = 0;
                            for (const Token *tok4 = tok3; tok4; tok4 = tok4->next())
                            {
                                if (tok4->str() == "{")
                                    ++indentlevel4;
                                else if (tok4->str() == "}")
                                {
                                    --indentlevel4;
                                    if (indentlevel4 == 0)
                                        break;
                                }
                                else if (Token::Match(tok4, "free|kfree ( %var% . %varid% )", structmemberid))
                                {
                                    break;
                                }
                            }

                            // was there a proper deallocation?
                            if (indentlevel4 > 0)
                                break;
                        }

                        // Returning from function..
                        else if (tok3->str() == "return")
                        {
                            // Returning from function without deallocating struct member?
                            if (!Token::Match(tok3, "return %varid% ;", structid))
                            {
                                memoryLeak(tok3, (vartok->str() + "." + tok2->strAt(2)).c_str(), Malloc);
                            }
                            break;
                        }

                        // goto isn't handled well.. bail out even though there might be leaks
                        else if (tok3->str() == "goto")
                            break;

                        // using struct in a function call..
                        else if (Token::Match(tok3, "%var% ("))
                        {
                            // Calling non-function / function that doesn't deallocate?
                            if (ignoredFunctions.find(tok3->str()) != ignoredFunctions.end())
                                continue;

                            // Check if the struct is used..
                            bool deallocated = false;
                            unsigned int parlevel = 0;
                            for (const Token *tok4 = tok3; tok4; tok4 = tok4->next())
                            {
                                if (tok4->str() == "(")
                                    ++parlevel;

                                else if (tok4->str() == ")")
                                {
                                    if (parlevel <= 1)
                                        break;
                                    --parlevel;
                                }

                                if (Token::Match(tok4, "[(,] %varid% [,)]", structid))
                                {
                                    /** @todo check if the function deallocates the memory */
                                    deallocated = true;
                                    break;
                                }
                            }

                            if (deallocated)
                                break;
                        }
                    }
                }
            }
        }
    }
}



#include "checkuninitvar.h"		// CheckUninitVar::analyse

void CheckMemoryLeakNoVar::check()
{
    std::set<std::string> uvarFunctions;
    {
        const CheckUninitVar c(_tokenizer, _settings, _errorLogger);
        c.analyse(_tokenizer->tokens(), uvarFunctions);
    }

    SymbolDatabase *symbolDatabase = _tokenizer->getSymbolDatabase();

    std::list<SymbolDatabase::SpaceInfo *>::const_iterator i;

    for (i = symbolDatabase->spaceInfoList.begin(); i != symbolDatabase->spaceInfoList.end(); ++i)
    {
        SymbolDatabase::SpaceInfo *info = *i;

        // only check functions
        if (info->type != SymbolDatabase::SpaceInfo::Function)
            continue;

        // goto the "}" that ends the executable scope..
        const Token *tok = info->classEnd;

        // parse the executable scope until tok is reached...
        for (const Token *tok2 = tok->link(); tok2 && tok2 != tok; tok2 = tok2->next())
        {
            // allocating memory in parameter for function call..
            if (Token::Match(tok2, "[(,] %var% (") && Token::Match(tok2->tokAt(2)->link(), ") [,)]"))
            {
                const AllocType allocType = getAllocationType(tok2->next(), 0);
                if (allocType != No)
                {
                    // locate outer function call..
                    for (const Token *tok3 = tok2; tok3; tok3 = tok3->previous())
                    {
                        if (tok3->str() == "(")
                        {
                            // Is it a function call..
                            if (Token::Match(tok3->tokAt(-2), "[(,;{}] %var% ("))
                            {
                                const std::string functionName = tok3->strAt(-1);
                                if (CheckMemoryLeakInFunction::test_white_list(functionName))
                                {
                                    functionCallLeak(tok2, tok2->strAt(1), functionName);
                                    break;
                                }
                                if (uvarFunctions.find(functionName) != uvarFunctions.end())
                                {
                                    functionCallLeak(tok2, tok2->strAt(1), functionName);
                                    break;
                                }
                            }
                            break;
                        }
                        else if (tok3->str() == ")")
                            tok3 = tok3->link();
                        else if (Token::Match(tok3, "[;{}]"))
                            break;
                    }
                }
            }
        }
    }
}

void CheckMemoryLeakNoVar::functionCallLeak(const Token *loc, const std::string &alloc, const std::string &functionCall)
{
    reportError(loc, Severity::error, "leakNoVarFunctionCall", "Allocation with " + alloc + ", " + functionCall + " doesn't release it.");
}