value flow: better handling in function call bailout of casting address of variable

lib/valueflow.cpp

@@ -47,9 +47,18 @@ static void bailout(TokenList *tokenlist, ErrorLogger *errorLogger, const Token
 
 static bool bailoutFunctionPar(const Token *tok, const ValueFlow::Value &value, const Settings *settings, bool *inconclusive)
 {
-    // passing variable to subfunction?
+    if (!tok)
+        return false;
+
+    // address of variable
     const bool addressOf = tok && Token::Match(tok->previous(), "&");
-    if (!tok || !Token::Match(tok->tokAt(addressOf?-2:-1), "[(,] &| %var% [,)]"))
+
+    // passing variable to subfunction?
+    if (Token::Match(tok->tokAt(-2), ") & %var% [,)]") && Token::Match(tok->linkAt(-2)->previous(), "[,(] ("))
+        ;
+    else if (Token::Match(tok->tokAt(addressOf?-2:-1), "[(,] &| %var% [,)]"))
+        ;
+    else
         return false;
 
     // goto start of function call and get argnr

test/testvalueflow.cpp

@@ -477,6 +477,14 @@ private:
                "}";
         ASSERT_EQUALS(true, testValueOfX(code, 3U, 123));
 
+        // function
+        code = "void f() {\n"
+               "    char *x = 0;\n"
+               "    int success = getx((char**)&x);\n"
+               "    if (success) x[0] = 0;\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 4U, 0));
+
         // if/else
         code = "void f() {\n"
                "    int x = 123;\n"