Fixed #2662 (Segfault: overloaded function call function with same name)

lib/checkmemoryleak.cpp

@@ -376,8 +376,12 @@ void CheckMemoryLeak::mismatchAllocDealloc(const std::list<const Token *> &calls
 
 CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok) const
 {
-    // Locate the start of the function..
+    if (!tok)
-    unsigned int parlevel = 0;
+        return No;
+
+    const std::string functionName = tok->str();
+
+    // Locate start of function
     while (tok)
     {
         if (tok->str() == "{" || tok->str() == "}")
@@ -385,15 +389,7 @@ CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok)
 
         if (tok->str() == "(")
         {
-            if (parlevel != 0)
+            tok = tok->link();
-                return No;
-            ++parlevel;
-        }
-
-        else if (tok->str() == ")")
-        {
-            if (parlevel != 1)
-                return No;
             break;
         }
 
@@ -429,6 +425,10 @@ CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok)
         }
         else if (tok2->str() == "return")
         {
+            // recursion => bail out
+            if (tok2->strAt(1) == functionName)
+                return No;
+
             AllocType allocType = getAllocationType(tok2->next(), 0);
             if (allocType != No)
                 return allocType;
@@ -445,11 +445,11 @@ CheckMemoryLeak::AllocType CheckMemoryLeak::functionReturnType(const Token *tok)
     {
         if (Token::Match(tok, "%varid% =", varid))
         {
+            // recursion => bail out
+            if (tok->strAt(2) == functionName)
+                return No;
+
             allocType = getAllocationType(tok->tokAt(2), varid);
-            if (allocType == No)
-            {
-                allocType = getReallocationType(tok->tokAt(2), varid);
-            }
         }
         if (Token::Match(tok, "= %varid% ;", varid))
         {

test/testmemleak.cpp

@@ -333,6 +333,10 @@ private:
         TEST_CASE(jmp);
 
         TEST_CASE(trac1949);
+
+        // #2662: segfault because of endless recursion (call_func -> getAllocationType -> functionReturnType -> call_func ..)
+        TEST_CASE(trac2662);
+
     }
 
 
@@ -3157,6 +3161,31 @@ private:
              );
         ASSERT_EQUALS("[test.cpp:10]: (error) Memory leak: buff\n", errout.str());
     }
+
+    void trac2662()
+    {
+        // segfault because of endless recursion
+        // call_func -> getAllocationType -> functionReturnType -> call_func ..
+
+        check("char *foo() {\n"
+              "    return foo();\n"
+              "}\n"
+              "\n"
+              "void bar() {\n"
+              "    char *s = foo();\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+
+        check("char *foo() {\n"
+              "    char *s = foo();\n"
+              "    return s;\n"
+              "}\n"
+              "\n"
+              "void bar() {\n"
+              "    char *s = foo();\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
 };
 
 static TestMemleakInFunction testMemleakInFunction;