From 1cac7e16862d90afdd653d6ce4265d78a4cafe6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= <daniel.marjamaki@gmail.com>
Date: Fri, 24 Jan 2014 17:47:49 +0100
Subject: [PATCH] value flow: better handling in function call bailout of
 casting address of variable

---
 lib/valueflow.cpp      | 13 +++++++++++--
 test/testvalueflow.cpp |  8 ++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 01e69008f..d210d49c0 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -47,9 +47,18 @@ static void bailout(TokenList *tokenlist, ErrorLogger *errorLogger, const Token
 
 static bool bailoutFunctionPar(const Token *tok, const ValueFlow::Value &value, const Settings *settings, bool *inconclusive)
 {
-    // passing variable to subfunction?
+    if (!tok)
+        return false;
+
+    // address of variable
     const bool addressOf = tok && Token::Match(tok->previous(), "&");
-    if (!tok || !Token::Match(tok->tokAt(addressOf?-2:-1), "[(,] &| %var% [,)]"))
+
+    // passing variable to subfunction?
+    if (Token::Match(tok->tokAt(-2), ") & %var% [,)]") && Token::Match(tok->linkAt(-2)->previous(), "[,(] ("))
+        ;
+    else if (Token::Match(tok->tokAt(addressOf?-2:-1), "[(,] &| %var% [,)]"))
+        ;
+    else
         return false;
 
     // goto start of function call and get argnr
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index 5fe057d69..8b42e762e 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -477,6 +477,14 @@ private:
                "}";
         ASSERT_EQUALS(true, testValueOfX(code, 3U, 123));
 
+        // function
+        code = "void f() {\n"
+               "    char *x = 0;\n"
+               "    int success = getx((char**)&x);\n"
+               "    if (success) x[0] = 0;\n"
+               "}";
+        ASSERT_EQUALS(false, testValueOfX(code, 4U, 0));
+
         // if/else
         code = "void f() {\n"
                "    int x = 123;\n"