From 068e5bad2728101eae922da0fd8205f3ad666d99 Mon Sep 17 00:00:00 2001
From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Date: Fri, 27 May 2022 07:57:43 +0200
Subject: [PATCH] Fix #9966: FP memleak with multiple assignments in
 if-statement (#4138)

Similar to how we do for assignments outside if-statements, bail out
since we do not track multiple variables.
---
 lib/checkleakautovar.cpp |  3 ++-
 test/testleakautovar.cpp | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/lib/checkleakautovar.cpp b/lib/checkleakautovar.cpp
index c5ecacdd5..7d5dec8b5 100644
--- a/lib/checkleakautovar.cpp
+++ b/lib/checkleakautovar.cpp
@@ -441,7 +441,8 @@ void CheckLeakAutoVar::checkScope(const Token * const startToken,
                 if (!isLocalVarNoAutoDealloc(innerTok, mTokenizer->isCPP()))
                     continue;
 
-                if (Token::Match(innerTok, "%var% =") && innerTok->astParent() == innerTok->next()) {
+                // Check assignments in the if-statement. Skip multiple assignments since we don't track those
+                if (Token::Match(innerTok, "%var% =") && innerTok->astParent() == innerTok->next() && !innerTok->next()->astParent()->isAssignmentOp()) {
                     // allocation?
                     // right ast part (after `=` operator)
                     const Token* tokRightAstOperand = innerTok->next()->astOperand2();
diff --git a/test/testleakautovar.cpp b/test/testleakautovar.cpp
index 8904f700d..5f69a2281 100644
--- a/test/testleakautovar.cpp
+++ b/test/testleakautovar.cpp
@@ -164,6 +164,7 @@ private:
         TEST_CASE(ifelse22); // #10187
         TEST_CASE(ifelse23); // #5473
         TEST_CASE(ifelse24); // #1733
+        TEST_CASE(ifelse25); // #9966
 
         // switch
         TEST_CASE(switch1);
@@ -1827,6 +1828,17 @@ private:
         TODO_ASSERT_EQUALS("[test.cpp:3]: (error) Memory leak: temp\n", "", errout.str());
     }
 
+    void ifelse25() { // #9966
+        check("void f() {\n"
+              "    void *p, *p2;\n"
+              "    if((p2 = p = malloc(10)) == NULL)\n"
+              "        return;\n"
+              "    (void)p;\n"
+              "    free(p2);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void switch1() {
         check("void f() {\n"
               "    char *p = 0;\n"